What we collect, and what we cannot

Who holds your data

Your employer decides what is switched on, who inside their organization can see it, and when it is deleted. Zyrane Technology stores and displays it on their instructions. We do not sell it, rent it, or use it to train anything. An organization that self-hosts Zyrane Track keeps its data on its own servers, and we never receive it at all.

The Zyrane Field app on your phone

The app records a position only while every one of these holds at once: you have punched in and are not on a break, you are inside the working hours your organization has set, and the phone has actually moved. Those rules run on the handset rather than on our server — the app is built to be incapable of reporting your evening, not to collect it and discard it politely. Punching out stops the recording; so does a break. The status line on the home screen always says which rule is the reason it is quiet, and prints the time of the last position it kept.

What it sends while it is recording:

• Location. Latitude and longitude, accuracy, altitude, speed and heading, and whether the phone was moving or standing still. In the background as well, which is the permission Android asks for separately: without it the trail stops the moment the phone goes into a pocket, and a full day of field work reads as somebody who went home mid-morning.
• Battery level. So a trail that ends at four o'clock can be told from a phone that died at four o'clock.
• Whether the position was mocked. A single flag, set when Android reports that the fix came from a mock-location app.
• What you enter yourself. Visit check-ins and check-outs with the client, purpose, outcome and your notes; tasks you tick off; expense claims with their amount, category and date; and the photographs you choose to take for a receipt or as proof of a visit, with the time and place of capture.
• Your device. Model and platform, and an installation identifier, so your organization can tell one of your handsets from another.
• Your account. The name, work email and mobile number your employer created. You sign in with that mobile number and a code sent to it by SMS — the number is used to reach you with that code and for your employer to identify you, not for marketing. Email and a password remain available as a second way in. A device token is held in the Android keystore so that you are not signing in daily.

The app has no access to your messages, calls, contacts, browsing, other applications, or the photographs already on your phone. The camera is used only in the moment you tap to take a picture. There is no screen recording and no microphone.

Your face, at punch-in and punch-out

If your organization has switched it on, the app photographs you when you punch in and out and checks that it is the same person who enrolled. This is biometric data, it is treated separately from everything else on this page, and you are asked for it separately: the consent screen for your face is its own screen, and agreeing to be tracked on duty is not agreeing to this.

• The comparison runs on your phone. The selfie is matched against your face template on the handset itself. No face is sent anywhere to be recognised, and the comparison does not depend on our server being reachable.
• What is stored. A face template — a set of numbers derived from your first approved selfie, from which a photograph cannot be reconstructed — held encrypted, and the selfies from your punches. Both are used for one thing: confirming your attendance, and letting an administrator in your own organization look at a punch that was rejected.
• Blink check. The app asks you to blink so that a photograph of a photograph does not pass. Nothing from that check is kept beyond the selfie itself.
• How long. Punch selfies are deleted after the retention period your organization sets — 90 days unless they change it — by a job that runs nightly. Your template and every selfie of you are deleted when you are deactivated, unless a legal hold applies to that record.
• You may refuse. Nothing in the app forces the face consent. If you decline, your employer records your attendance another way.

Your face is never used to identify you anywhere other than your own punches, never matched against anybody else's, never shared outside your organization, and never used to train a model.

The desktop agent

On a computer, the agent records which application and window is in focus, idle time, and screenshots at the interval the organization has set. Screenshots are blurred by default, applications matching the organization's blacklist — anything banking, and password managers — are never captured at all, and private time can be claimed. Where the policy allows it, you can delete your own screenshots. None of this is keylogging: no keystroke is recorded anywhere in Zyrane Track.

Who can see it

You can see your own data, unless your organization has turned that off. Beyond you, only managers and administrators inside your own organization. Each organization's data is isolated from every other one. Our own staff reach a customer's data only when that customer asks us to for support. We hand it to anybody else only where Indian law compels us to.

How long it is kept

• Screenshots: 30 days by default. An organization can raise that to 60, 90 or 180 days; it cannot keep them indefinitely.
• The GPS trail: 13 months, which is what a year-on-year comparison needs and no longer.
• Punch selfies: 90 days by default, and whatever your organization has set instead — between a week and two years.
• Your face template: until you are deactivated, and then deleted with every selfie of you.
• Visits, tasks, expenses and photographs: as long as the organization's account is open, because they are its business records — an approved expense claim is an accounting document.

Deleting a screenshot deletes the stored file, the copy on the content network, and the database row. When an organization closes its account, its data is removed from our systems.

Asking for your data, or for its deletion

Ask your employer first: they control the account, most of this is already visible to you in the app, and some of it you can delete there yourself. If that does not get you an answer, write to privacy@zyrane.in and we will take it up with the organization that holds your record. Uninstalling the app stops the recording immediately; the positions already sent belong to your employer's account and are deleted on the schedule above.

How to have your account and your data deleted sets out what gets deleted, what is kept and why, and how long each step takes.

Where it is stored

On servers in India, with screenshots and photographs on a content network. Everything in transit is encrypted: the app refuses to send your location over plain HTTP, and will not quietly downgrade a typed address to it.

Children

Zyrane Track is a workplace tool, sold to employers for use by their employees. It is not directed at children, and we do not knowingly collect their data.

Changes, and how to reach us

If we change what is collected, we change this page and move the date at the top of it. Zyrane Technology, Lucknow, Uttar Pradesh, India — privacy@zyrane.in.