1. Who is responsible for your data
Score Xcreen (“we”, “us”) provides the Aajar Attendance App at aajar.scorexcreen.com. Two different roles matter:
- For the people in an organization's workspace (employees, HR staff, admins): the organization that employs them decides why and how their attendance, leave, salary and other records are used. In data-protection terms the organization is the data fiduciary (controller) and Score Xcreen is its data processor, working on its instructions under the Data Processing Addendum. If you are an employee and want to see, correct or delete your records, ask your employer's HR or Owner first; we will help them respond.
- For everyone else: the Owner who signs up, people who contact us, visitors to our website, and billing contacts. For their data we decide the purpose and means, so Score Xcreen is the data fiduciary.
This policy follows the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 with its rules, and applies to personal data of people in India and to Aajar's service generally.
2. What we collect
| Group | What | Why |
|---|---|---|
| Account and sign-in | Email address, password (stored only as a one-way hash), name, role, Employee ID, manager, shift, login tokens, email verification and password-reset records. | To create and secure accounts and run the app. |
| Attendance | Check-in and check-out times, work mode (office, remote), notes, manual corrections and who made them, and the source of the punch (app or biometric device). | To record and report attendance, as configured by your employer. |
| Location | If your employer turns on geofencing, the latitude and longitude your phone or browser reports at the moment you check in or out, and whether it was inside the allowed area. We do not track your location in the background or between punches. | To confirm a punch was made from an approved place. |
| Biometric devices | If your employer connects a fingerprint or face terminal, the punch records the device sends us (device user ID, date, time, type of verification). We do not receive or store fingerprint or face images or templates. | To turn device punches into attendance. |
| Leave and requests | Leave, permission, on-duty, comp-off, overtime and name-change requests, their reasons, dates and decisions. | To run approvals and keep leave balances. |
| Payroll and tax | Salary structures, deductions, payslips, income-tax declarations and any proof documents your employer asks for. | To calculate and publish payslips and support tax work. |
| HR records | Onboarding documents, expense claims and receipts, hiring requests, assets assigned, and similar items, where your employer's plan includes them. | To support HR processes. |
| Notifications | Your browser's push-notification address, if you choose to turn reminders on. | To send clock-in reminders. |
| Billing contacts | Billing name, address, GSTIN, email and phone of the paying organization; invoice and payment records (payment-gateway reference, amount, date, payer name). Card or bank-account numbers are handled by the payment provider and never reach our servers. | To invoice, collect payment and meet tax duties. |
| Messages to us | What you submit through the Help form (name, email, phone, organization, message) and chat-assistant conversations. | To answer you and improve our help content. |
| Technical | IP address, browser and device type, and error and security logs. For password-reset limits we keep only a shortened hash of the IP address. | To keep the service secure, stop abuse and fix problems. |
Your employer, not Aajar, decides which of these records exist for you. We do not ask for or require sensitive categories such as health records, religion or caste. If your employer chooses to upload such information in a document or note, it stays in their workspace and is covered by section 6.
3. How we use it
- to provide, secure, support and improve Aajar;
- to send service messages: verification, password reset, invoices, receipts, renewal reminders and important notices;
- to bill and to comply with tax, accounting and other laws;
- to detect, investigate and prevent fraud, abuse and security incidents;
- to answer questions and complaints.
We do not sell personal data, we do not use workspace data for advertising, and we do not use employees' records to build profiles for any purpose other than running the service for their employer.
4. Our legal basis
We process personal data (a) with the consent of the person where consent is the right basis, for example when you tick to turn on push reminders or allow your browser to share location; (b) to perform our contract with the organization that signed up; and (c) for the “legitimate uses” the DPDP Act allows, including meeting legal obligations and keeping the service secure. In an employer's workspace, the employer is responsible for its own legal basis and for giving its employees any notice the law requires.
5. Who we share it with
- Within the organization. Aajar roles decide who sees what: Owners, Admins and HR see their organization's records; managers see their team; employees see their own. People in one organization cannot see another organization's data.
- Service providers who help us run Aajar and who may only use data for that purpose: web hosting and storage, email delivery, payment gateways and banks (for the payment details you give them), and similar infrastructure.
- Authorities and advisers when the law, a court order or a valid government request requires it, or to protect our rights or the safety of others, and professional advisers under confidentiality.
- A successor if our business or the Aajar service is transferred, under the same protections.
Our hosting provider may store data on servers outside India. We rely on the contractual and technical safeguards described in the Data Processing Addendum, and we do not transfer personal data to any country the Government of India has restricted.
6. How long we keep it
- Workspace data (attendance, leave, payroll and so on) is kept while the organization has an account, and for a reasonable period after a plan ends so the organization can return or export it. When the organization is deleted, or when we are told to erase it, the data and the users' logins are permanently removed.
- Invoices and payment records are kept for as long as tax and accounting laws require, typically six to eight years, even after the organization is deleted.
- Help messages and chat conversations are kept for as long as needed to resolve the matter and for a limited time afterwards.
- Backups and logs may hold copies for a short period after deletion before they are overwritten.
- Employers decide how long attendance and payroll records are needed for their own legal duties and can export or delete them.
7. Cookies and similar technologies
Aajar keeps you signed in using a login token saved in your browser's local storage, and may cache pages so the app opens quickly and works with a poor connection (the installable-app feature). These are needed for the service to work. We do not use advertising cookies or third-party analytics trackers on the site. If we add any measurement tools in future we will list them here. You can clear this data any time in your browser settings; you will then have to sign in again.
8. Security
We protect data with the measures described on our Security Overview, including encrypted connections, hashed passwords and role-based access. No system is perfectly secure. If a breach affects personal data we will notify the organizations concerned without undue delay, and the authorities where the law requires.
9. Your rights
Under the DPDP Act, you can:
- ask for a summary of the personal data we hold about you and how it is used;
- ask us to correct inaccurate data, complete it, or update it;
- ask us to erase data we no longer need to keep (some records, such as invoices, must be kept by law);
- withdraw consent you have given, as easily as you gave it;
- nominate another person to exercise these rights if you die or cannot do so;
- complain to us and, if you are not satisfied, to the Data Protection Board of India as the Act provides.
For data in an employer's workspace, start with your employer (their HR or Owner can correct or export most records directly in Aajar); if you cannot reach them, contact us and we will pass your request on. To exercise any right with us, or to make a complaint, follow the Grievance Redressal process. We may need to confirm who you are before we act.
10. Children
Aajar is a workplace tool for adults and is not meant for anyone under 18. If you think a child's data has been entered, tell us and we will help the organization remove it.
11. Changes to this policy
We will post any change here with a new “Last updated” date and tell Owners by email if the change is significant.
12. Contact
For privacy questions and requests, use the Help & contact form and begin your message with “Privacy”, or write to the Grievance Officer at Score Xcreen as described on the Grievance Redressal page.