Privacy policy

This policy is published by Cadence (“we”), operating from:

It is published under Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, made under section 43A of the Information Technology Act, 2000, and is written to align with the Digital Personal Data Protection Act, 2023 as its provisions are brought into force.

In the language of the DPDP Act: your employer is the Data Fiduciary. They decide who is enrolled, where the geofence is, and how long records are kept. We are a Data Processor, handling that data on their instructions and under contract with them. If you are an employee, you are the Data Principal.

This matters in practice: to see, correct or erase your records, ask your employer first. They can do both from the admin console, and they are the party entitled to decide. The app carries the request to them for you: Profile → Privacy requests. If they do not respond, our Grievance Officer below will help.

Only at the moment you punch in or out:

• A photograph of your face. Captured by you, stored against that attendance record, visible to your employer’s administrators. Because it is used to identify you, it is biometric information and therefore sensitive personal data or information under Rule 3 of the SPDI Rules. It is what stops one person punching in for another.
• A location fix — latitude, longitude and the accuracy your phone reports — checked against the office locations your employer set, and stored with the record, together with the name of the office it was made at.
• A device identifier, so a punch can be tied to a phone your employer has approved. Your employer may choose to approve the first phone you sign in from automatically; any other phone still waits for their approval. An administrator can revoke a device at any time.

The app does not track you in the background. There is no continuous location collection, no geofence monitoring while the app is closed, and no movement history. Location is read when you press the button and at no other time.

The Android app declares a contacts permission, and it is fair to ask why an attendance app wants one. It is used in exactly one place: when an administrator adds an employee, they may pick a contact to prefill a name and phone number. That goes through Android’s own contact picker, so the app receives only the single contact chosen and never reads the address book.

It does nothing on an employee’s device.

The Android app uses two services from Google’s Firebase. They are the only part of Cadence that sends anything to Google, and Google processes it on our behalf, on its own servers, which are mostly outside India.

• Crash reports (Firebase Crashlytics). When the app crashes or hits an unexpected error, it sends a report so we can fix it: what went wrong in the code, the app version, the phone model and Android version, and a random identifier for this installation. If you are signed in, the report also carries your Cadence account number, your role, and your employer’s company number — not your name, phone number, photographs or location. Google keeps crash reports for 90 days.
• Notifications (Firebase Cloud Messaging). Android delivers notifications through Google. The app registers a token for your device with Google and with us, and the text of each notification passes through Google on its way to your phone — for example “Payslip ready”, or a leave request naming the employee, the leave type and the dates. Google holds a notification only until it is delivered (at most four weeks if your phone stays offline).

There is no advertising. The app does not collect the Android advertising ID and contains no advertising or analytics SDK. The web consoles and this website load no tracking scripts.

• Your name and mobile number, and any employee code, designation or joining date your employer records, whether in the console or from their own HR system through the API, together with the reference that system uses for you.
• Attendance records: punch times, worked minutes, and the status of each day.
• Leave requests and their outcome.
• Salary and payslip figures, where your employer uses Cadence for payroll.
• A notification token, if you allow notifications, so approvals reach you.
• Which notifications you have turned on. For each notification we send you, whether your phone received it and when you opened it, so we can tell whether notifications are getting through. This stays with Cadence; it is not sent to Google.
• Ordinary server logs — IP address, timestamp and endpoint called.
• An activity log of changes made in your employer’s account — by their administrators and staff, by systems they connect through the API, and by Cadence support: who made each change, when, what it was before and after, and the IP address it came from. It covers changes to records about you, such as an attendance correction or a salary change, and changes you make yourself, such as setting your password (the password itself is never recorded). Your employer’s administrators can read it; it exists so that every change to your records can be accounted for.
• The version of the app you last used, the platform it runs on, and when — so we know who still needs an update before one is made required.
• A record of each time you accept this policy and the terms of use: the version accepted, when, whether in the app or the web console, the app version, and the IP address and device or browser description the request came from. It is the evidence that you were shown them.
• Privacy requests you raise in the app, and your employer’s replies to them.

Your employer must give you notice and obtain your consent before enrolling you, as section 5 of the DPDP Act requires and as Rule 5 of the SPDI Rules requires for sensitive personal data. That notice is their obligation.

Cadence also asks you to read and accept this policy and the terms of use the first time you sign in, and again whenever either changes in substance. That acceptance is recorded, as described above. It is not a substitute for your employer’s notice and consent.

You may withdraw the camera or location permission in your phone’s settings at any time. Punching in will then stop working, because both are what make a punch mean anything — but nothing else about your account changes, and withdrawal does not affect processing already carried out lawfully.

• You — your own attendance, leave and payslips.
• Your employer’s administrators — the above for their own company, and nothing from any other company. That includes whether and when you accepted this policy. Privacy requests are seen by your company’s administrators only, not by other staff.
• Systems your employer connects. An employer may issue an API key or webhook so their payroll or HR system receives this data. Such a system can also create your account and pass you your sign-in PIN; the message comes from your employer, not from us. That is their decision and their responsibility; the credential is scoped to their company alone.
• Us — only as needed to operate and support the service, including which app version each account last used.
• Google, as our service provider — crash reports and the delivery of notifications, as described under “Crash reports and notifications”.
• Authorities, where disclosure is required by Indian law, including under section 91 of the Bharatiya Nagarik Suraksha Sanhita, 2023 or a direction under the Information Technology Act, 2000.

We do not sell this data, and we do not use it for advertising or to train any model.

Data is stored in India, in Microsoft Azure’s Central India region (Pune): the database, punch photographs, files and server logs. Access is restricted to the people who operate the service.

The one exception is what the app sends to Google for crash reports and notification delivery, described above, which Google may process outside India. The DPDP Act permits this, except to countries the Central Government restricts by notification, and none currently is. Nothing else leaves India, and if that changes we will say so here before it does.

Retention:

• Attendance records — kept for as long as your employer’s account is open. They are the register your employer is separately obliged to maintain under the applicable Shops and Establishments Act, the Factories Act, 1948 or the Code on Wages, 2019, which is why they are not deleted on a rolling schedule.
• Punch photographs — 6 months, then deleted. The attendance record itself survives; the face attached to it does not. It exists to verify a punch as it happens, and that purpose is served long before six months are up.
• Acceptance records and privacy requests — kept for as long as your employer’s account is open, because they are the record of what you were told and what you asked for.
• The activity log — kept for as long as your employer’s account is open. It is the record of who changed what, and is only useful if it is complete.
• Integration event history: 90 days.
• Webhook delivery logs: 30 days.
• Server logs: 2 months.
• Crash reports, held by Google: 90 days.

When your employer stops using Cadence, their data — attendance records included — is deleted 45 days after the account closes, subject to any retention Indian law requires of us. That window is there so an employer who leaves can still obtain an export.

As a Data Principal you may:

• obtain a summary of the personal data being processed and of the processing (section 11);
• have inaccurate or incomplete data corrected, updated or erased (section 12);
• have a readily available means of grievance redressal (section 13);
• nominate another individual to exercise these rights should you die or become incapacitated (section 14).

Address these to your employer as Data Fiduciary — in the app, under Profile → Privacy requests, which records the request and their reply. If they do not respond within a reasonable time, contact our Grievance Officer. You may also complain to the Data Protection Board of India once the Board is constituted and operational.

The DPDP Act also places duties on you as a Data Principal — notably not to impersonate another person and not to file a false or frivolous grievance (section 15). Punching in for a colleague is exactly the conduct that provision has in mind.

Rule 5(9) of the SPDI Rules, 2011 and section 13 of the DPDP Act, 2023 require a published route for grievances, so there is one:

Grievances are acknowledged within 24 hours and redressed within one month of receipt, as the SPDI Rules require.

Cadence is a workplace system and is not for anyone under 18. We do not knowingly process the personal data of a child, which the DPDP Act would require verifiable parental consent for and would prohibit us from tracking or profiling. Employers must not enrol anyone whose employment would contravene the Child and Adolescent Labour (Prohibition and Regulation) Act, 1986.

We maintain reasonable security practices and procedures within the meaning of Rule 8 of the SPDI Rules. Traffic is encrypted in transit with TLS. Passwords are stored as bcrypt hashes and are never recoverable — a temporary PIN or password issued to you can only replace yours, never read it. Integration keys are stored hashed, and webhook payloads are signed so a receiving system can verify they came from us.

We do not currently hold ISO 27001 or an equivalent independent certification. We would rather say so than imply an assurance nobody has audited.

We will notify affected Data Fiduciaries and, where required, the Data Protection Board of India and CERT-In of a personal data breach within the timelines Indian law prescribes. If you believe you have found a vulnerability, please write to ateeksar@gmail.com before disclosing it publicly.

If this policy changes in a way that affects what we collect or who sees it, we will say so here and date it, and ask you to read and accept the new version the next time you open the app or the web console. The app and console wait on that screen until you accept or sign out, and the earlier version you accepted stays on record.