Privacy Policy

Version 1.1 · Last updated September 26, 2026

This Privacy Policy describes how KOSD ("we", "us", or "our") collects, uses, and protects your personal information when you use our mobile applications, ClockCard and Eventa (the "Service"). By using the Service, you agree to the practices described in this policy.

1. Information We Collect

1.1 Account Information

• Email address (used for authentication and account recovery)
• First name and last name (used for display within your organization)
• Encrypted password (managed by our authentication provider; we never see the plaintext)

1.2 Location Data

• When you check in or check out, we may collect your device's GPS coordinates at that moment in time.
• Location is only collected during an explicit check-in or check-out action. We do not track your location continuously or in the background.
• Location data is used solely to verify that you are within the geofence of your designated workplace, if your organization has enabled location verification.
• You may decline location permission. If you do, check-in/check-out will still work but will be marked as "location not verified."

1.3 Attendance Data

• Check-in and check-out timestamps
• Attendance status (present, late, absent, early departure, remote, on leave)
• Notes you optionally add to check-in/check-out records
• Late and early departure durations (calculated server-side)

1.4 Organization Data

• Your role within an organization (owner, admin, or member)
• The organization(s) you belong to
• Invite codes you create or use

1.5 Device and Usage Data

• App version and device model (for debugging and compatibility)

2. How We Use Your Information

• To authenticate you and manage your account
• To record and report your attendance to your organization's administrators
• To verify your location at check-in/check-out (if enabled by your organization)
• To calculate attendance summaries and reports
• To send you service notifications, such as password-reset emails
• To comply with legal obligations

3. Lawful Basis for Processing (GDPR)

• Contract performance: Processing your attendance data is necessary to provide the Service you requested as part of your employment arrangement.
• Consent: Location data collection during check-in/check-out requires your explicit consent. You can withdraw consent at any time in Settings.
• Legitimate interests: We process aggregated, anonymized data for service improvement and security.

4. Data Sharing

• Your organization's administrators (owners and admins) can view your attendance records, check-in/out times, and attendance status within their organization.
• We do not sell your personal data to third parties.
• We share data with our service providers (authentication and hosting) only as necessary to operate the Service, under data processing agreements.
• We may disclose data if required by law or to protect our legal rights.

5. Data Retention

• Attendance records are retained for a period determined by your organization's data-retention setting (default: 365 days).
• You may request deletion of your account and all associated data at any time via Profile > Delete Account or our account-deletion page.
• When you delete your account, your profile, attendance records, consent records, and organization memberships are permanently deleted within 30 days.
• De-identified information that can no longer be linked to you may remain in aggregate reports.

6. Your Rights

• Access: You can request a copy of your personal data.
• Rectification: You can correct inaccurate data via Edit Profile.
• Erasure: You can delete your account and associated data via Profile > Delete Account or request deletion through our account-deletion page.
• Restriction: You can restrict certain processing by withdrawing consent.
• Portability: You can export your attendance data.
• Objection: You can object to certain processing activities.
• Withdrawal of consent: You can withdraw location consent at any time without affecting the legality of prior processing.

To exercise these rights, contact your organization administrator or email admin@kosdllp.com. Account deletion requests can also be submitted through our account-deletion page. We may ask you to verify that you control the account before processing a request submitted outside the app. Never send us your password or a one-time authentication code.

7. Data Security

• All data is encrypted in transit (TLS 1.2+) and at rest.
• Passwords are hashed by our authentication provider (bcrypt).
• Row-level security policies enforce that users can only access their own data and data within their organization.
• Biometric authentication is used as a local device gate. Your biometric data never leaves your device and is never sent to our servers.

8. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us.

9. International Data Transfers

Your data may be processed in the region where your Supabase instance is hosted. If you are in the EU/UK, your data is processed under Standard Contractual Clauses or an adequacy decision.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app or email. Continued use after changes constitutes acceptance.

11. Contact

For privacy questions or requests, contact admin@kosdllp.com.