Privacy Policy
This policy explains how Rank First Technologies Private Limited ("Staffify", "we") handles personal data in the Staffify HRMS website (staffify.in) and the Staffify HRMS mobile app. It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.
1. Who is responsible for your data
Staffify is software that employers use to run HR, attendance and payroll.
- If you are an employee, your employer decides what data is collected about you and why. Under the DPDP Act your employer is the Data Fiduciary, and Staffify processes the data on your employer's behalf as a Data Processor. Questions about why your employer collects something should go to your employer's HR team first.
- If you sign up a company on staffify.in, we are the Data Fiduciary for your own account details (name, email, phone, company details).
2. What we collect
| Category | What | Where it comes from |
|---|---|---|
| Account | Name, work email, phone number, role, password (stored only as a one-way hash) | You or your employer |
| Employee profile | Employee code, department, designation, date of joining, date of birth, gender, marital status, blood group, address, personal email, emergency contacts | You or your employer |
| Financial | Bank name, account number, IFSC, salary structure, payslips, reimbursement claims and bills, tax declarations and proofs, PAN, UAN / PF / ESI numbers | You or your employer |
| Identity documents | ID numbers and copies you upload (Aadhaar, PAN, passport, driving licence, voter ID) and other documents such as certificates and letters | You |
| Attendance | Punch-in and punch-out times, work hours, shift, leave, overtime and regularisation requests | You and the app |
| Precise location | GPS location when you punch in or out, and periodically while you are punched in and the app is open (with location accuracy, battery level and whether a mock-location app is active) | Your device, only with your permission |
| Face data | A numerical face template (128 numbers) created from a photo, used to confirm it is you when you punch in or out. The photo itself is analysed on your device and is not uploaded or stored; only the template is sent to our servers. | Your device camera, only when you choose face check-in or face enrolment |
| Work activity | Performance reviews, goals, self-appraisals, feedback, training records, helpdesk tickets | You, your manager and HR |
| Device and security | Device identifier, device model, operating system and app version (to keep one active login per device), login times and IP addresses (for security logs) | The app and website |
We do not collect contacts, SMS, call logs or microphone audio, and the app does not track location when it is closed.
3. Why we use it
- To run the HR services your employer uses: attendance, leave, payroll, reimbursements, performance, training and helpdesk.
- To verify attendance: face templates and location confirm that the right person punched in at an allowed place.
- To keep accounts secure: login history, device binding and audit logs.
- To meet legal duties: payroll, tax, provident fund and labour-law records.
- To answer support requests.
We do not sell personal data, show advertising, or use your data for profiling unrelated to the HR service.
4. Permissions the app asks for
- Camera: face check-in, face enrolment and photographing documents or bills. Optional; manual punch can be used where your employer allows it.
- Location (while using the app): recording where you punch in and out, and while you are on shift with the app open.
- Notifications: attendance and request updates.
You can withdraw any permission in your phone's settings at any time.
5. Who we share it with
- Your employer (HR, administrators and your managers) according to their roles.
- Service providers that run the service for us: web hosting and database hosting, and email delivery. On the website, if your employer turns on the AI assistant, the questions you type and the related records are sent to Anthropic (Claude) to generate the answer.
- Face recognition software: the face-recognition code and model files are downloaded from public content networks (jsDelivr, GitHub). No photo or personal data is sent to them.
- Authorities, when the law requires it (for example tax or labour authorities).
6. How long we keep it
We keep data for as long as your employer's account is active and your employer needs it. After you leave, or when your employer closes its account, data is deleted or anonymised, except records that Indian law requires to be kept (for example payroll, tax and provident-fund records, typically up to 8 years). Face templates are deleted when you or HR remove your face enrolment, or when your account is deleted.
7. Your rights
Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent, nominate a person to act for you, and raise a grievance.
- In the app: Profile → Delete my account, or edit your details in Profile.
- On the website: log in and open Privacy Centre.
- Without logging in: request account deletion or email support@staffify.in.
8. Security
All traffic uses HTTPS. Passwords and app login tokens are stored only as one-way hashes, access is limited by role, and important actions are recorded in audit logs. No system is perfectly secure; if a breach affects you we will notify you and the Data Protection Board as the DPDP Act requires.
9. Children
Staffify is a workplace tool for people aged 18 and over. We do not knowingly collect data from children.
10. Changes
We will post changes on this page and update the date above. Significant changes will also be shown in the app.
11. Contact and Grievance Officer
Rank First Technologies Private Limited
Mohali, Punjab, India
Email: support@staffify.in
We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.