Privacy
Draft, last updated 6 September 2026. Written to describe what the system actually stores. Not yet reviewed by a lawyer.
The short version
Your employer can see when you started and finished work, and where you were while you were working. Nothing about your location is recorded once you check out.
If your employer uses a kiosk tablet, it takes one photograph of whoever is standing in front of it at the moment of a scan.
Who is responsible for what
Your employer decides what is collected and why. In data-protection terms they are the controller. Worvexa stores and processes it on their instruction, as the processor. That means a request about your own records starts with your employer, not with us, although we will help them answer it.
Your employer is also responsible for telling you that this system is in use and for having a lawful basis to use it where you work.
What we collect
Everything below is a category the system genuinely stores. Nothing is collected that is not listed here.
Your account
- Name and email address.
- A password, stored only as a bcrypt hash. Neither we nor your employer can read it.
- Phone number and preferred language, if you provide them.
- Your role in the organization, whether your membership is active, and an employee code if your employer uses one.
Every check-in and check-out
- The time it happened and which site it was at.
- How it was recorded: a printed QR code, a kiosk tablet, or a manual correction entered by a manager.
- An identifier for the device that submitted it, the platform, and the app version.
- The written reason a manager gave, when they correct a record by hand, and which manager did it.
Location at the moment you scan
- Latitude and longitude, and how accurate the reading was.
- How far you were from the site, and whether that fell inside the geofence your employer configured.
If your phone cannot get a position, the scan is still recorded, without one. Your employer can choose to refuse check-ins from outside the geofence, or to accept them and flag them.
Location while a shift is open
- Position samples taken while you are checked in, each with the accuracy of the reading and, where your device reports it, your speed of travel.
- The distance from the site for each sample, and whether it was inside the geofence.
This starts when you check in and stops when you check out. The server refuses location data when no shift is open, so it is enforced by the system and not only by the app on your phone.
Whether location was available
Separately from where you were, the system records events about the availability of location during a shift:
- Leaving the geofence, and returning to it.
- Location permission being switched off, and switched back on.
A “location turned off” event records only that the trail is incomplete, and flags the shift for your manager to look at. It does not record where you were during the gap, because nothing was collected then.
Photographs at a kiosk
Where your employer uses a kiosk tablet at the entrance, the tablet uses its camera to take a photograph at the moment a badge is scanned, so the record shows who was actually standing in front of it.
- One still image per scan. There is no video, no continuous capture, and nothing is recorded between scans.
- The image is stored with that attendance record and can be seen by your employer’s owner, admins and managers.
- We do not run face recognition on it. It is not matched against any other photograph, not converted into a biometric template, and not used to identify you anywhere else. A person looks at it, or nobody does.
- Photographs are deleted on a shorter schedule than attendance records. See the retention table below.
The kiosk is not yet available. This section describes it in advance so that nothing about it is a surprise when it arrives. CONFIRM BEFORE KIOSK LAUNCH
Your schedule, and how your shifts compared to it
- The shifts you were rostered for, and at which site.
- Differences the system found between that roster and what happened: a late start, a missed shift, an early finish, or hours below the roster, together with the size of the difference in minutes.
These comparisons are made automatically, every few minutes, and they send a message to your managers. They are a prompt for a person to look into something, not a decision about you. Nothing about your pay, your hours or your employment is decided by this system without a person involved.
Messages sent to you
Your email address is used for invitations, password resets, and the alerts above. Alerts also appear inside the app. You can switch each type of alert off individually in your settings.
Technical and security records
- An audit entry each time an owner, admin or manager changes something, recording who did it, what changed, and the IP address they did it from.
- A notification token for your device, if you allow notifications, so alerts can reach you.
- Password reset links, stored hashed so that a copy of our database does not hand anyone a working link.
What we never do
- We do not track your location outside an open shift.
- We do not record audio or video at any time.
- We do not run face recognition, and we store no biometric data.
- We do not read your messages, contacts, photos or other apps.
- We do not use tracking cookies. Signing in stores a token in your browser’s local storage and nothing else.
- We do not sell personal data, and we do not use it for advertising.
Who can see it
| Role | What they can see |
|---|---|
| Employee | Their own attendance, their own shifts, and their own schedule. Nobody else’s. |
| Viewer | Everything a manager sees, and can change nothing. |
| Manager | The whole organization’s attendance, location trails, issues and reports, and can correct records. |
| Admin | All of the above, plus people, sites, rosters and settings. |
| Owner | All of the above, plus billing. |
| Worvexa staff | Only what is needed to run and support the service, and only on your employer’s request or to fix a fault. |
No customer can see another customer’s data. Every request is scoped to one organization and checked against your role.
Where it is stored, and who else touches it
Records are held on servers in REGION operated by HOSTING PROVIDER. Kiosk photographs and database backups are held by OBJECT STORAGE PROVIDER. Email is delivered by EMAIL PROVIDER. These are our sub-processors, and the full list with their locations goes here before launch.
How long it is kept
| What | Default | Who controls it |
|---|---|---|
| Location samples during shifts | 90 days, then deleted automatically every night | Your employer, anywhere from 1 day to 10 years |
| Kiosk photographs | 30 days PROPOSED | Your employer |
| Attendance records and issues | While your employer keeps their account, since these are working-time records | Your employer |
| Audit log | While your employer keeps their account | Fixed, so the record cannot be edited away |
| Your account details | Until the account is deleted, then removed within 30 days | You and your employer |
| Password reset links | One hour, and one use | Fixed |
Your rights
You can ask for a copy of your data, ask for a correction, ask for deletion, or object to how it is used. Because your employer decides what is collected, start with them. If they do not resolve it, write to us at privacy@worvexa.test and we will help. You may also complain to SUPERVISORY AUTHORITY.
Some records cannot be deleted on request while your employment continues, because working-time records are kept for legal reasons. Your employer can explain which ones apply to you.
Security
- Passwords are stored hashed with bcrypt, and reset links are stored hashed too.
- Every request is checked against your role and your organization before any record is returned.
- Check-in codes are signed, and rotating a site’s code invalidates every printed copy at once.
- Traffic is encrypted in transit. ADD ENCRYPTION AT REST DETAIL
Changes and contact
If we start collecting something not listed above, this page changes first and your employer is told. Questions: privacy@worvexa.test. Our terms are at Terms of service.