Privacy Policy for InHr One

Effective Date: August 31, 2026

InHr One ("we", "us", or "our") is committed to protecting the privacy of our users and staff members (Employees). This Privacy Policy explains how we collect, use, process, and protect personal data across our Employee Mobile Application and related platform services.

1. Information We Collect

A. Employee Profile Information

At the direction and invitation of your Employer organization, we process:

• Basic profile information (Full Name, Employee Code, Date of Joining, Designation, Department).
• Contact information (Work Email, Mobile Phone Number).
• Bank account details for salary payouts (Bank Account Number, Branch Name, IFSC Code).

B. Account & Authentication Information

• OTP logs and login metadata to secure access.
• Session tokens managed through high-security caches to authenticate your active devices.

C. Device & IP Information

• Device specifications (Device ID, Operating System version, Device Model Name) to facilitate secure device binding and prevent unauthorized account takeover.
• Network details (IP Address, access timestamps, and diagnostic logs).

D. Attendance & Geofencing Information

• Punch-in / Clock-in and Punch-out / Clock-out timestamps.
• Geofence boundary verification coordinates set by your Employer.

E. Camera & Location Information

• Camera Access: Used solely to capture optional profile photos or selfie validation images during attendance punch actions as configured by the Employer.
• Location Access: Processed exclusively to verify that your attendance check-in occurs within the designated workplace Geofence boundary.

2. Important Location Processing Notice

InHr One does NOT perform continuous, live, or background tracking of employee locations.

Your location coordinates are accessed and processed only at the precise moment you tap the attendance button (such as "Clock In / Punch In" or "Clock Out / Punch Out") to confirm whether you are within the Employer's authorized geofenced workspace. Once the geofence check is complete and your punch timestamp is recorded, location processing immediately stops.

3. How Data is Used

We process collected data to provide reliable workplace operations, including:

• Verifying identity and facilitating secure login access via mobile OTP.
• Recording and validating attendance timestamps for shift tracking and payroll calculations.
• Preventing fraudulent clock-ins through device binding validation.
• Sending essential push notifications and SMS alerts regarding shift allocations, approvals, and announcements.

4. Data Sharing & Third Parties

We do not sell, rent, or trade your personal data to third parties or data brokers. Data is shared strictly with essential infrastructure service providers necessary to operate the application:

• Cloud Storage & Databases (AWS): For encrypted database storage (PostgreSQL) and media hosting.
• Caching & Authentication (Redis): For temporary OTP lifecycle management and session caching.
• SMS & Notification Gateways: To dispatch verification codes and critical platform notifications.
• Legal Compliance: When required to do so by applicable law, court order, or governmental regulation.

5. Data Security

We employ industry-leading security practices to protect your data:

• End-to-end encryption in transit (TLS 1.3/HTTPS) and robust encryption at rest.
• Cryptographic hashing for sensitive authentication credentials.
• Strict role-based access control policies restricting production database access.

6. Data Retention

• Personal and employment records are retained as long as your Employer maintains an active workspace subscription with the platform.
• Historical employment logs (such as attendance and payroll records) are retained in compliance with applicable statutory labor and tax laws.
• Authentication OTP tokens are automatically expunged within 5 minutes.

7. Account & Data Deletion

• Employees may request account removal or data deletion at any time through the in-app profile settings or by visiting our Account & Data Deletion Portal.
• While account deletion revokes active login access and credentials, organizational records created at the employer's direction (such as logged attendance records) remain archived with the Employer as required by corporate record-keeping policies.

8. Children's Privacy

InHr One is an enterprise workplace platform and is strictly intended for individuals 18 years of age or older. We do not knowingly collect personal data from minors.

9. Policy Updates

We may update this Privacy Policy periodically to reflect technological or regulatory changes. Updated policies will be posted on this URL with an updated "Effective Date".

10. Contact Information

For privacy questions, data requests, or compliance inquiries, please contact:

• Email: support@insangerhr.com
• Company: Disco Technologies
• Address: New Delhi, India