Privacy Policy

1. Information We Collect

We collect the following categories of information:

2. How We Use Information

• To provide the Service — authentication, attendance tracking, and payroll calculation.
• To maintain multi-tenant data separation so each organisation only sees its own data.
• To process and reconcile biometric device punches into attendance and payroll records.
• To manage subscriptions, billing, and device-linking entitlements.
• To communicate service-related notices, security alerts, and support responses.
• To detect, investigate, and prevent fraud, abuse, or security incidents.

3. How We Store & Protect Data

• All data is stored in a MySQL database scoped by organisation (org_id); application queries enforce this scoping so one organisation cannot access another's data.
• Passwords are stored as irreversible hashes and are never stored or transmitted in plain text after registration.
• Write operations use parameterised/prepared database queries to protect against injection attacks.
• Access to payroll generation and device linking is gated behind an active subscription and role-based permissions (owner > admin > staff).

4. Biometric Data Handling

Where your organisation links a fingerprint/face biometric device, the raw biometric templates (fingerprint/face images) are captured and stored on the device/biometric vendor's own system, not within EasySalary. EasySalary only receives and stores the resulting punch events (timestamp, enrolment ID, device serial) needed to compute attendance. You are responsible for obtaining any employee consents required by applicable law before enrolling their biometric data on a device linked to your organisation.

5. Data Sharing

We do not sell your data. We may share information only:

• Within your organisation, as permitted by each user's assigned role.
• With the biometric device/vendor infrastructure strictly to retrieve attendance punches you have configured us to sync.
• With service providers who help us operate the Service (e.g. hosting), under confidentiality obligations.
• When required by law, regulation, or a valid legal process.

6. Data Retention

We retain organisation, employee, attendance, and payroll data for as long as your organisation's account remains active, and for a reasonable period afterward to comply with legal, tax, or accounting obligations. You may request deletion of your organisation's data, subject to any statutory retention requirements applicable to payroll records.

7. Your Rights

• You may access, correct, or request deletion of personal data associated with your account, subject to organisational admin permissions and legal retention requirements.
• Organisation owners/admins are responsible for managing the data of employees added under their organisation.

8. Cookies & Sessions

The Service uses server-side session cookies solely to keep you signed in and to remember your active organisation. We do not use third-party advertising or tracking cookies.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

10. Contact

For questions about this Privacy Policy or to exercise your data rights, please contact Gayatri Software through the support channels provided within the Service.