This Privacy Policy explains how CATaskKit ("we", "us") collects, uses, shares and protects personal data when you use our website and the Attendly platform (the "Services"). We are committed to handling personal data in accordance with India's Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and applicable rules.
1. Information we collect
a. Account & organization data
Name, work email, company name, role, and password (stored only as a secure hash) when you create or join a Workspace.
b. HR & attendance data
Data your organization enters or generates: employee profiles, attendance check-in/out times and geolocation captured at check-in/out, leave requests and balances, payroll inputs, holidays, reimbursement claims and uploaded receipts, and announcements.
c. Payment data
When you purchase a paid plan, payment is processed by Razorpay. We receive confirmation, amount, seat count and a payment reference; we do not collect or store your full card number, CVV or UPI credentials.
d. Technical data
Device and app information, log data, and notification tokens (for push notifications). We use minimal cookies/local storage needed to keep you signed in and to remember preferences.
2. How we use information
- To provide, operate, secure and support the Services;
- To authenticate users and enforce role-based access;
- To process payments, manage subscriptions and prevent fraud;
- To send service communications (e.g., password resets, invites, approvals, announcements, payment receipts);
- To compute attendance, leave, payroll and reimbursement outcomes that you have configured;
- To comply with legal obligations and enforce our Terms.
3. Legal bases & consent
We process personal data to perform our contract with you, for our legitimate business interests, to comply with law, and—where required—on the basis of consent. Geolocation is collected only at the time of a check-in/out action; your organization is responsible for informing employees and obtaining any consent required for location capture.
4. How we share information
We do not sell personal data. We share it only with:
| Sub-processor | Purpose |
|---|---|
| Supabase | Database, authentication, file storage (receipts) |
| Razorpay | Payment processing |
| Firebase Cloud Messaging (Google) | Push notifications |
| Mapping provider | Displaying check-in locations on a map |
We may also disclose data where required by law, to protect our rights, or in connection with a business transfer. Each sub-processor is bound to appropriate confidentiality and security obligations.
5. Data isolation & security
Every record is scoped to its Workspace using database row-level security, so one organization can never access another's data. Access is governed by roles (Owner, HR, Manager, Employee). Data is transmitted over encrypted connections (HTTPS/TLS), and receipts are kept in a private, org-scoped storage bucket. No method of transmission or storage is 100% secure, but we apply reasonable safeguards aligned with industry practice.
6. Data retention
We retain Customer Data for as long as your Workspace is active. Reimbursement records and receipts are retained for approximately two years to support audits, after which they may be deleted. On account closure, data is available for export for a reasonable period and is then deleted or anonymised, unless a longer period is required by law.
7. Your rights
Subject to applicable law, you may request to access, correct, update or delete your personal data, withdraw consent, or raise a grievance. Employees should usually direct such requests to their own organization (the data fiduciary); we will assist that organization as its processor. To exercise rights regarding data for which CATaskKit is the fiduciary, contact us using the details below.
8. Children
The Services are intended for use by businesses and their adult employees and are not directed at children under 18.
9. International transfers
Our sub-processors may process data outside India. Where they do, we rely on appropriate safeguards and only transfer to the extent permitted by applicable law.
10. Grievance Officer
In accordance with Indian law, you may contact our Grievance Officer for any data-protection concern:
- Name: Grievance Officer, CATaskKit
- Email: info@cataskkit.com
- Address: Opp. to Lotus Court, Kharadi, Pune, Maharashtra, India – 411001
We will acknowledge and address grievances within the timelines prescribed by applicable law.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified through the Services or by email, and the "Last updated" date above will change.
12. Contact us
Email info@cataskkit.com or see our Contact page.