Privacy Policy

1. Who We Are

ADMINFACE ("we", "us", "our") is a subscription-funded web-based HR and office management platform, available to any organisation on a Free Forever plan or one flat annual plan. Our mission is to give every organisation complete HR tools without a high upfront cost, so teams of every size can operate efficiently, focus on work that matters, and grow without per-seat penalties.

Your data is not our product. This Privacy Policy applies equally on the Free Forever plan, during the free trial, on the Annual plan, and on the legacy Free Plan (see our Terms of Service). No plan ever means paying with your data.

How we are funded: Core HR is available on our Free Forever plan at ₹0 for teams of up to 2 employees. Organisations that want every module or more employees subscribe to our Annual plan at ₹19,999 per organisation per year (excluding applicable taxes), starting with a 30-day free trial. Advertising is not part of Free Forever, the trial, or the Annual plan; it is shown only to organisations still on the legacy Free Plan until their notice cutoff date (see Section 6).

This Privacy Policy explains how we collect, use, store, and protect information about you and your organisation when you use ADMINFACE. By registering or using ADMINFACE, you agree to the practices described in this policy.

2. Data We Collect

ADMINFACE collects only the data you voluntarily enter to operate the system. This includes:

Organisation & Account Data

• Organisation name, subdomain, and registration details
• Administrator name, email address, and hashed password
• Company settings (name, address, financial year, logo)
• Billing contact and payment reference — Annual plan subscribers and WhatsApp wallet top-ups only (see Section 7 for payment data details)

Employee & HR Data

• Employee profiles: name, email, phone, designation, department, join date, address, photo
• Organization hierarchy data: optional Sub Organization, Business Unit, Region, Branch/Location, and Team assignments per employee, where your organisation chooses to configure them
• Branch/location records: branch name, office address, working hours, timezone, geo-coordinates, contact details, and assigned branch manager, where configured
• Attendance records: daily clock-in / clock-out times, status, biometric punch logs
• Leave records: applications, types, dates, approval status, balance
• Comp-off credit records: holiday date, credit date, source (auto/manual), awarded/revoked status
• Leave encashment records: leave type, days requested, per-day value, status, remarks
• Payroll data: basic salary, allowances, deductions (PF, ESI, TDS), net salary, payslips
• Expense claims: amount, category, receipts, approval history
• WFH requests: dates, reasons, approval status
• Assets: assigned equipment, serial numbers, condition
• Documents: files uploaded by HR or employees
• Notices: internal announcements created by your team
• Audit logs: records of who changed what within your account
• Chat messages: messages within organisation, group, and direct conversations
• WhatsApp Bulk Messaging data: contact names and phone numbers, message template content, campaign delivery/read status, and inbound opt-out replies — only collected if your organisation enables and configures this optional module with its own Meta WhatsApp Business API credentials (see Section 5 for third-party sharing details)
• Chat Support data: only if your organisation enables this optional module — the name, and the email address or phone number if asked for, that a website visitor types into your organisation's chat box; the address and title of the page they started the chat on (never its query string); the messages and files exchanged with your staff; and, for WhatsApp chats, the customer's WhatsApp name and number. Shared files are deleted automatically after 90 days. Visitor limits use a keyed one-way code, never the stored IP address
• QR Contacts data: only if your organisation enables this optional module — the contact details, photos, cover images, gallery pictures, documents, links, opening hours and videos your organisation chooses to publish on each card's public contact page, which anyone with the card's QR code or link can see. Scan statistics count views and contact saves per day; to count unique visitors we keep a short code that changes every day and cannot be turned back into an IP address or device — no IP address or browser details are stored
• Daily notes / work logs: daily work entries and important notes created by employees
• Biometric device data: device IP, attendance punch timestamps — raw biometric templates never reach us
• GPS location data: real-time coordinates shared voluntarily by field employees while tracking is active
• Performance data: review records, self-assessments, manager ratings, goals
• Internal email content: messages in the platform's internal email system
• Tasks & projects: tasks, assignments, milestones, and project records
• Shift records: shift definitions, assignments, and swap requests
• Recruitment data: job posts and candidate applications submitted via your portal
• LMS records: enrolled courses, completion status, and assessment results
• Certificates: certificates issued to employees — type, date, personal message, issue date, and view/download status
• Exit management: resignation, clearance, and exit interview records
• OKR / Goals data: objectives, key results, check-in notes, and progress records
• 360° Feedback data: review cycle responses, star ratings, strengths, improvement notes — anonymous responses contain no identity fields
• HR Helpdesk tickets: ticket content, replies, internal HR notes, priority and status
• Recognition records: badges given, recognition messages, points — public feed visible to all employees in the organisation
• Survey responses: answers to organisation surveys; anonymous surveys store no respondent identity
• Org chart data: manager–employee reporting relationships derived from employee profiles
• Offer letter data: candidate name, role, letter content, secure acceptance token, response status
• Benefit enrolment records: benefit plan assignments, enrolment dates, contribution figures per employee
• Family member data: names, relationships (Spouse / Child / Parent / Sibling / Other), dates of birth, contact phone numbers, and insurance nomination status voluntarily entered by employees or HR for insurance and emergency contact purposes

Technical & Usage Data

• Login timestamps and IP addresses (for security audit logs)
• Browser type and device information (for technical support)
• Session data stored in cookies necessary for authentication
• Push notification tokens (FCM): device-level Firebase Cloud Messaging tokens, stored with your explicit permission to deliver real-time alerts (new messages, email notifications, and important updates). Tokens are deleted when you revoke notification permission or log out.

3. Hospital Category — Patient Health Data

Organisations that enable the Hospital category use ADMINFACE to manage outpatient (OPD) and inpatient (IPD) care, in addition to the standard employee/HR features described in Section 2. Doing so involves collecting health-related information about the organisation's patients — a different category of person from the organisation's employees, and one that many organisations and regulators treat as sensitive.

Patient & Medical Data Collected

• Patient identity & demographic details: name, date of birth, gender, phone number, blood group, known allergies, and a unique hospital ID (UHID) assigned by your organisation
• Consultation records: vital signs recorded at each visit (blood pressure, pulse, temperature, weight, height, oxygen saturation), diagnosis notes, prescriptions, and the doctor's advice
• Case history files: medical reports, scans, and other documents uploaded against a patient's case history, stored in an access-gated directory on our servers
• Admission (IPD) records: ward and bed assignment, admission and discharge dates, and discharge summaries
• Billing records: invoices and payment records raised by your organisation for consultations, admissions, and other services provided to the patient (see Billing & Payments below)

This data is entered by the organisation's doctors, front-desk, and billing staff — or by patients themselves through the Patient Portal described below — solely to operate the OPD/IPD features the organisation uses. As with all other data on ADMINFACE (Section 4), we do not read, analyse, profile, or otherwise use this clinical data for any purpose beyond storing and displaying it for the organisation.

Same Data Isolation Guarantee as Employee Data

Patient and medical data is held to exactly the same isolation guarantee described in Section 9: it lives exclusively inside your organisation's own separate database, alongside your employee/HR data. Staff of one organisation — including its doctors and administrators — cannot see, query, or access patient data belonging to any other organisation, ever.

Patient Portal — A Separate Login for Patients

Hospital-category organisations may offer their patients a self-service Patient Portal. This is a distinct login, kept in its own session, entirely separate from staff/employee accounts — a patient signing in can only ever view their own appointments, case history, and bills, never another patient's or an employee's data.

Patients are not ADMINFACE customers and do not have a direct account relationship with us — the hospital organisation that treats them is the data controller for their information, in the same way it is the controller of its employees' HR data. Mirroring Section 12 (Your Rights) for employee data, a patient who wants to access, correct, export, or delete their personal data should contact the hospital organisation directly; the organisation can view, edit, export, or delete patient records using the tools ADMINFACE provides, and may request our help in doing so at privacy@adminface.com.

Billing & Payments

Patient invoices and payments are currently recorded manually within the application by hospital staff — for example, marking an invoice as paid after receiving payment, or showing the patient a static QR code to pay against. ADMINFACE does not itself process, transmit, or route live payment transactions for patient billing. Where an organisation configures payment gateway credentials for its own use, those credentials are encrypted before storage and are never shared outside that organisation's isolated database.

4. How We Use Your Data

All data you enter is used exclusively to operate ADMINFACE features for your organisation:

• To display, manage, and report on your HR records within your dashboard
• To send system-generated emails (password reset, notifications you configure)
• To maintain audit trails and login activity logs for your security
• To process attendance sync from biometric devices you configure
• To generate payslips, expense reports, and attendance reports
• To process your Annual plan and WhatsApp wallet payments through Razorpay and activate what you paid for
• To review and respond to organisation ad requests submitted via the Advertising Programme
• To send WhatsApp template messages to your contacts via Meta's WhatsApp Business Platform, using your organisation's own connected API credentials, only when you enable and use the WhatsApp Bulk Messaging module

5. Data Sharing — Never Sold, Never Our Product

We do not sell, rent, or trade your organisation's data, and we never share it with advertisers, data brokers, or analytics companies. Your data is not our product.

• Your payroll, HR, attendance, and patient records are never shared with anyone for their own purposes
• No government or regulatory body receives your data unless compelled by a legally binding court order, in which case we will notify you to the extent permitted by law
• Biometric punch data stays within your organisation's isolated database

Service providers that help us run ADMINFACE

Like any online service, ADMINFACE relies on a small number of providers to operate. Each one handles only the data needed for its specific job, on our behalf, and may not use it for anything else:

• Hosting provider: the servers and databases that store and serve your data
• Email delivery: our outgoing mail server delivers system emails (invitations, password resets, notifications) — recipient address, subject, and message content
• Google Firebase Cloud Messaging: delivers push notifications to devices that have allowed them — the device token plus the notification title and short text
• Razorpay: processes Annual plan and WhatsApp wallet payments — see Section 7
• OpenStreetMap: map tiles on the GPS and vehicle-tracking pages are loaded from OpenStreetMap's servers, which see your browser's IP address and the map area being viewed — not employee names or tracking history
• Google AdSense: only for organisations still on the legacy Free Plan, until their notice cutoff date — standard browser signals, never HR data (see Section 6)

• Opt-in — WhatsApp Bulk Messaging and Chat Support on WhatsApp: if your organisation enables these modules and connects WhatsApp, the contact names, phone numbers, and message content you send and receive on WhatsApp are transmitted to Meta Platforms, Inc. via the WhatsApp Business Platform, using your organisation's own connected API credentials, so that the messages can actually be delivered. This only happens if you switch these modules on. Website chat in Chat Support does not use Meta: those messages stay on our servers. See Section 14 for details.
• Opt-in — videos and maps on QR contact pages: if your organisation adds a YouTube or Vimeo video or a map to a QR contact page, it is loaded from YouTube (in its privacy-enhanced youtube-nocookie.com mode), Vimeo or Google Maps when someone opens that page, and that provider sees the visitor's IP address and browser details under its own privacy policy. Pages without a video or map load nothing from these providers.

6. Advertising, How ADMINFACE Is Funded & the Annual Plan

Ad Priority (Three-Tier System)

For organisations still on the legacy Free Plan, ads are displayed in the following priority order:

Legacy Free Plan — Google AdSense Ads

• Ad content: Served by Google AdSense when no custom or organisation ad is active. These ads may use cookies based on general browsing context — not your HR data.
• No HR data to Google: Google AdSense receives only standard browser signals (IP address, browser type, general location). It never receives employee names, salaries, attendance records, or any organisational HR information.
• Cookie consent: Google may place advertising cookies on your device. You can manage these through your browser settings or opt out via Google Ad Settings.
• We use Google AdSense publisher account ca-pub-4072905345026114. Ad slots are served from Google's CDN.

Free Forever, Free Trial & Annual Plan — ₹19,999/year (excl. taxes)

• No display advertisements are shown in the application interface on the Free Forever plan, during the free trial, or on the Annual plan
• No third-party advertising cookies are set on Free Forever, during the trial, or under the Annual plan
• Subscriptions are paid annually through Razorpay (see Section 7) and are never auto-renewed. If the trial or plan ends without payment, your organisation moves to the Free Forever plan; data in modules outside Free Forever is retained (hidden, not deleted) and returns when you subscribe
• Free Forever's limits (up to 2 active employees, 12 months of visible history, exports for the current and previous month, 100 MB of storage) never delete or deactivate your data: older records are kept and reappear when you subscribe, and a full export of your data on request remains available on every plan
• The Annual plan is active for 12 months from the date Razorpay confirms the payment, or from your current end date if you renew early
• We never see or store card numbers, UPI PINs, or banking credentials

7. Payment Data

Annual plan subscriptions and WhatsApp wallet top-ups are paid through Razorpay, a PCI-DSS compliant payment gateway. You enter your payment details on Razorpay's checkout, not on ADMINFACE, and Razorpay processes them under its own privacy policy.

What ADMINFACE keeps:

• Annual plan: the Razorpay payment and order reference, amount, and date, stored in our master database for accounting and tax records
• WhatsApp wallet: each top-up (amount, Razorpay payment reference, date, who made it) and each message deduction, stored in your organisation's own isolated database so you can see the full history

• We never receive or store your card number, CVV, UPI PIN, bank account login, or any banking credentials
• Payment references are shared only with Razorpay, and only to process and verify the payment
• Payment records are retained for legally required accounting periods

8. Organisation Ad Request Data

When your organisation submits an ad request via the portal's Advertising Programme, we collect:

• Contact details: name, email address, and optional phone number of the person submitting the request
• Ad creative: the banner image you upload (stored in our server)
• Click URL: the destination URL where ad clicks will be sent
• Alt text and description: accessibility label and notes you provide
• Preferred duration: the duration you request for the campaign

How this data is used:

• Contact details are used only to communicate about your ad request (approval, rejection, pricing discussions)
• Your contact details are never shared with other organisations, third parties, or used for marketing
• If your ad is approved, the banner image and click URL are displayed to users of portals that still show ads (legacy Free Plan organisations) during the approved date range — the image and URL are visible to all portal visitors by design
• Ad request records are retained while your organisation account is active and for a reasonable period after for record-keeping
• You may request removal of your ad creative image at any time by contacting ads@adminface.com

9. Data Isolation Between Organisations

Each organisation registered on ADMINFACE receives its own completely separate database. Administrators from Organisation A cannot see, query, or influence any data belonging to Organisation B — ever.

The only data stored in our shared master database is: your organisation's name, subdomain, registration status, plan level, and (for Annual plan subscribers) payment references. All HR data — employees, attendance, payroll, documents — lives exclusively in your isolated tenant database. For organisations that have enabled the Hospital category, this includes patient records, consultations, case history files, admissions, and patient billing data (see Section 3) — none of it is stored in, or accessible from, our shared master database or any other organisation's tenant database.

10. Data Security

• Passwords are hashed using bcrypt — we never store plaintext passwords
• All forms are CSRF-protected with per-session tokens
• Database credentials are isolated per organisation
• All admin and HR actions are written to a tamper-evident audit log
• Login activity (IP, timestamp, device) is recorded for your security review
• Biometric device communications are authenticated via unique per-device tokens
• Ad request images are stored in non-public server directories, not accessible via direct URL
• Payments are taken on Razorpay's PCI-DSS compliant checkout, so card and banking details never reach our servers

While we implement strong security practices, no system is 100% immune to breaches. We will notify affected organisations promptly in the event of a security incident.

11. Data Retention & Deletion

• Your data is retained for as long as your organisation account is active
• You can delete individual employees, records, and documents at any time from within the application
• To delete your entire organisation and all associated data, contact us at the email below — we will process the deletion within 30 days
• Audit logs are retained for 2 years for security purposes
• Annual plan and WhatsApp wallet payment records (including Razorpay payment references) are retained for the legally required period for accounting purposes
• Organisation ad request records are retained while the account is active; contact ads@adminface.com to request removal of ad creatives

12. Your Rights

• Access: Export attendance, payroll, and employee data via the built-in CSV export tools at any time
• Correct: Edit any employee record, attendance entry, or document directly in the application
• Delete: Remove any individual record, or request full account deletion
• Portability: Export your data in CSV format from Reports, Attendance, and Payroll modules
• Patients (Hospital category): the same access, correction, deletion, and export rights apply to patient records — administered by the hospital organisation, since ADMINFACE does not have a direct account relationship with patients (see Section 3)
• Opt out of personalised ads: Manage via browser settings or Google Ad Settings (legacy Free Plan)
• No ads on Free Forever or the Annual plan: Neither the Free Forever plan nor the Annual plan (₹19,999/year + taxes) shows ads; ads appear only for legacy Free Plan organisations until their cutoff date
• Ad creative removal: Request removal of any ad image you submitted by contacting ads@adminface.com

13. Cookies

• Essential cookies: Session cookies required for login and CSRF protection. These cannot be disabled without breaking the application.
• Advertising cookies (legacy Free Plan only — Google AdSense): Set by Google when AdSense ads are displayed. You can disable these in your browser or via Google Ad Settings.
• No advertising cookies for custom/organisation ads: Static banner ads (custom platform ad and approved organisation ads) do not set any third-party cookies — they are simple image links with no tracking code.
• No advertising cookies on Free Forever, during the free trial, or on the Annual plan: Free Forever, trial, and Annual plan organisations are not subject to any advertising cookies.
• Chat Support website chat: the chat box on your organisation's website sets no cookies. It keeps one random code in that website's local storage so a visitor finds their chat again when they move to another page; clearing site data removes it.
• QR contact pages: public contact pages set no cookies and store nothing in the visitor's browser.

No analytics inside your portal: we do not use Google Analytics or any other analytics tracking on the logged-in application. Our public marketing pages (homepage, feature pages, free tools) use Google Analytics to count visits; those pages contain no organisation or employee data.

14. WhatsApp Bulk Messaging & Meta Platforms

The WhatsApp Bulk Messaging module is optional and off by default. If your organisation enables it and connects its own Meta WhatsApp Business API credentials, the following data is sent to Meta Platforms, Inc. in order to deliver messages:

• Recipient phone numbers and names, and the content of the message templates you send
• Delivery, read, and failure status is received back from Meta and stored against each recipient so your organisation can see campaign results
• Inbound replies (used only to detect opt-out keywords such as "STOP") are received from Meta via webhook and processed to update that contact's subscription status

Meta processes this data under its own privacy policy and WhatsApp Business Terms of Service as an independent data processor/controller for the messaging service — ADMINFACE does not control how Meta uses data once it leaves our servers. Your organisation's access token and optional app secret are stored encrypted and are used solely to authenticate API calls made on your organisation's behalf. You are responsible for having recipients' consent before sending — see Section 17 of our Terms of Service.

15. Children's Privacy

ADMINFACE is a professional business application for organisations and their adult employees. We do not knowingly collect data from individuals under 16 years of age.

16. Changes to This Policy

If we make material changes to this Privacy Policy, we will post a notice within the application at least 14 days before the changes take effect. Continued use of ADMINFACE after the effective date constitutes acceptance of the revised policy.

17. Contact Us

For privacy questions, data deletion requests, Annual plan enquiries, or any concerns: