Privacy Policy

How we collect, use, and protect your data at PunchInn.

Last updated: April 9, 2026

1. Introduction

PunchInn ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our HR and Payroll Management System. By using PunchInn, you consent to the practices described in this policy.

2. Data We Collect

We collect the following categories of data to provide and improve the Service:

Category Data Types Purpose
Identity Name, employee ID, CNIC, date of birth, gender, profile picture Employee identification and records
Contact Email, phone number, address, emergency contacts Communication and emergency situations
Employment Department, designation, date of joining, salary, position HR management and payroll processing
Financial Bank account details, IBAN, salary information, tax records Payroll processing and payslip generation
Attendance Clock-in/out times, GPS coordinates, biometric identifiers, IP addresses Attendance tracking and shift management
Device Device ID, platform, app version, push notification tokens Mobile app functionality and notifications
Usage Login timestamps, feature usage, session data Service improvement and security

3. How We Use Your Data

  • Service delivery — Processing payroll, tracking attendance, managing leave requests, generating payslips, and handling offboarding.
  • Communication — Sending notifications about attendance, leave approvals, payslip availability, and system announcements.
  • Security — Verifying identity, preventing unauthorized access, and maintaining audit trails.
  • Improvement — Analyzing usage patterns to improve features and user experience (aggregated, non-identifiable data only).
  • Legal compliance — Meeting tax reporting, labor law, and regulatory obligations.

4. GPS & Location Data

When employees use the mobile app to clock in or clock out, we may collect GPS coordinates to verify the check-in location. This data is:

  • Collected only at the moment of clock-in and clock-out (not continuously tracked).
  • Stored securely alongside the attendance record.
  • Visible only to authorized administrators for attendance verification.
  • Optional — the mobile app requests location permission, which users can decline.

5. Biometric Data

If your organization uses ZKTeco biometric devices, fingerprint or face recognition data is processed directly on the biometric device. PunchInn receives only punch event data (timestamp, employee ID, punch type) — we do not store raw biometric templates on our servers.

6. Data Sharing

We do not sell your personal data. We may share data only in these circumstances:

  • With your employer — Administrators within your organization access employee data as needed for HR operations.
  • Service providers — We use third-party services (email delivery, push notifications, hosting) that process data on our behalf under strict data processing agreements.
  • Legal requirements — If required by law, regulation, or valid legal process.

7. Data Security

  • All data is encrypted in transit using TLS/SSL.
  • Passwords are hashed using bcrypt — we never store plain-text passwords.
  • Database access is restricted to authorized personnel only.
  • Regular security audits and vulnerability assessments are conducted.
  • JWT tokens are used for API authentication with expiration and blacklist mechanisms.

8. Data Retention

  • Active employee data is retained for the duration of the subscription.
  • Upon subscription termination, data is retained for 30 days and then permanently deleted.
  • Payroll and tax records may be retained longer as required by applicable tax and labor laws.
  • You may request data export or deletion at any time by contacting support.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access — Request a copy of the personal data we hold about you.
  • Correction — Request correction of inaccurate or incomplete data.
  • Deletion — Request deletion of your data (subject to legal retention requirements).
  • Portability — Request your data in a machine-readable format.
  • Objection — Object to certain processing activities.

To exercise these rights, contact us at support@punchinn.com.

10. Cookies & Tracking

PunchInn uses session cookies for authentication and CSRF protection. We do not use third-party tracking cookies or advertising pixels. The chat widget may store a session identifier to maintain conversation continuity.

11. Children's Privacy

PunchInn is a workplace tool and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Service. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact

For privacy-related questions or requests, contact us at: