ASM LabsPrivacy Policy
This policy explains what Roznamcha: Attendance & Salary (formerly Attendance Manager) does with personal information. It is written in plain language on purpose. If anything here is unclear, write to roznamcha@asmlabs.in and we will explain it.
1. Who we are
Roznamcha is operated by ASM Labs, a sole proprietorship of Agam Singh Madaan, based in India. Throughout this policy, "we" and "us" mean ASM Labs.
Contact for anything in this policy, including privacy questions, requests and complaints: roznamcha@asmlabs.in. This is also the address for grievance redressal under India's Digital Personal Data Protection Act, 2023.
Grievance Officer: Agam Singh Madaan, Proprietor, ASM Labs. Email roznamcha@asmlabs.in. We acknowledge a grievance within 48 hours and resolve it within one month.
This policy covers the Roznamcha web application, the Roznamcha Android application, which are the same service, and this website, asmlabs.in.
2. Two different groups of people
This service holds information about two groups, and our responsibilities differ for each.
Account holders
People who sign in: business owners and the managers they add. Staff do not sign in. For their account information, we are the data fiduciary and this policy governs directly.
Employees recorded in the app
People whose attendance and salary a business records. That business decides what to record and why, so the business is the data fiduciary and we act as a data processor on its instructions. We do not decide what employee information is entered, and we do not use it for our own purposes.
3. What we collect
From account holders
| Information | Where it comes from |
|---|---|
| Email address | Your Google account, or the address you type to get a sign-in link |
| Display name and profile photo | Your Google account, if you sign in with Google |
| Account identifier | Created by Google Firebase when you first sign in |
| Which organisations you belong to, and your role in each | Created as you use the app |
Entered by a business about its employees
| Information | Notes |
|---|---|
| Name | Required |
| Designation, team, employee ID | Optional |
| Salary amount and salary history | Optional, and hidden entirely in Attendance Only Mode |
| Joining and leaving dates | Used to calculate pay correctly |
| Daily attendance marks | The core purpose of the app |
| Advances and salary payments | Optional |
Technical information
- Google records sign-in activity, including approximate time and network address, as part of operating the sign-in system.
- Our hosting provider records standard web-server information when pages load, including network address and browser type.
4. What we never collect
This list is deliberately specific, because "we respect your privacy" means nothing on its own. The app has no facility to collect any of the following:
- Phone numbers
- Aadhaar, PAN or any government identity number
- Bank account or card details
- Photographs of employees, fingerprints or any other biometric data
- Location or GPS data
- Your contacts, messages, call logs, files or camera
- Advertising identifiers
There is no analytics, no advertising and no tracking of any kind in this application. We do not profile you, we do not build behavioural records, and we do not sell, rent or share personal information with anyone for marketing.
The same is true of this website: it has no analytics, no advertising and no tracking.
5. Why we process this information
- To run the service — signing you in, showing your organisations, saving attendance, calculating pay, producing reports and exports.
- To keep your data safe — automatic backups you can restore yourself.
- To support you — answering questions you send to our support address.
- To meet legal obligations — where a law requires us to keep or produce records.
For account holders, the basis is your consent, given when you create an account, and the necessity of processing to provide a service you asked for. For employee records, the business that entered them is responsible for having a lawful basis.
6. Where your data is stored
Your data is stored in India. The database sits in Google Cloud's asia-south2 (Delhi) region. Attendance records, staff records and backups do not leave India in ordinary operation.
Two qualifications, stated honestly. Google operates the sign-in system and may process sign-in and security information on its global infrastructure. Our website files are delivered through a content network with servers in many countries; that network serves the application's files and does not receive your attendance or salary data.
7. Who else is involved
| Provider | What it does | What it can see |
|---|---|---|
| Google (Firebase) | Sign-in and the database | Account details and all application data, stored on our behalf |
| Netlify | Delivers the website and app files | Standard web-server records; not your application data |
| Google Fonts, cdnjs (Cloudflare) | Supply the typeface and the PDF export library | Standard web-server records when those files load |
| Only if you tap a share button | Whatever is in the message you choose to send |
When paid plans launch, a payment provider will handle the transaction on our website. Card details go to that provider and never reach us or this application. We will update this policy before that happens.
We do not sell personal information. We share it only with the providers above, or where the law compels us.
8. What is stored on your device
The app keeps three small items in your browser's local storage. None of them are advertising or tracking cookies:
- The email address you asked a sign-in link to be sent to
- Which organisation you last had open
- Whether you have answered today's working-day prompt
Clearing your browser data removes these. Nothing is lost, because your records live in the database, not on your device.
This website stores nothing on your device.
9. How long we keep it
- Account and organisation data — for as long as the account exists.
- Manual backups — the five most recent per organisation. Older ones are deleted automatically. When an organisation is transferred to a new owner, the former owner's manual backups of it move with the organisation: the new owner can see them and the former owner cannot.
- Automatic backups — the ten most recent, plus the last backup of each of the last four weeks, of each of the last six months, and one backup per calendar year. The yearly copy is kept indefinitely so a business can recover an old year.
- Deleted organisations — hidden from everyone the moment they are deleted: managers lose access at once and automatic backups stop. The owner can restore the organisation from their own business list for 30 days. After 30 days a scheduled job deletes the organisation and its backups permanently. Deleting the owner's account deletes the organisations they own straight away, without waiting for the 30 days.
- Deleted accounts — removed immediately and unreachable from the app by anyone, including us. Copies persist for up to 8 weeks in the infrastructure backups that protect the whole service against data loss, and are then overwritten automatically. Those backups are never used for any purpose other than recovering the service.
10. Your rights
Under India's Digital Personal Data Protection Act, 2023, you may ask us to:
- Tell you what personal data we hold about you and who it has been shared with
- Correct or complete anything inaccurate
- Erase your data, where we are not required to keep it
- Withdraw your consent, which means closing your account
- Nominate someone to exercise these rights if you die or become incapacitated
You can delete your account and its data yourself at any time: see Delete your account. For anything else, write to roznamcha@asmlabs.in. We will reply within 30 days. If you are unhappy with our response, you may complain to the Data Protection Board of India.
Where the request concerns employee records, we will refer you to the business that entered them, since that business decides what happens to those records.
11. Security
- All traffic is encrypted in transit using HTTPS.
- Every read and write is checked against server-side rules, so one business cannot reach another business's data even if someone tampers with the app.
- Within a business, only the owner and the managers they add can sign in to it. Only the owner can change business-wide settings such as pay rules, add or remove managers, or change what a manager may do. A manager can change only what the owner has allowed: our servers check each manager's permissions before accepting a change to attendance, the working-day calendar, staff records, advances or salary payments, and check the team before accepting a change to a staff record. Reading is not limited by team. A manager who can sign in to a business can read that business's records, including pay, whether or not the app shows them on screen. Give managers only the permissions they need, and add only people you trust with the business's records. Staff do not sign in.
- The app carries a Content Security Policy, which limits what code a browser will run on the page.
No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your data, we will inform you and the Data Protection Board as the law requires.
12. Children
This is business software and is not intended for anyone under 18. We do not knowingly create accounts for children. An employer is responsible for the lawfulness of any record it enters about a young worker.
13. Changes to this policy
If we change this policy we will update the date at the top, and for anything significant we will say so in the app or by email before it takes effect.