Privacy policy — AtlasRoster

1. Who we are

AtlasRoster is operated by Teckam Software Private Limited, a company in India, with its registered office at Ray Purwa, Garg Road, Kanpur, Uttar Pradesh 208003, India ("Teckam", "we", "us"). This policy covers the AtlasRoster web app (app.atlasroster.com), the AtlasRoster apps for iPhone and Android, and this website (atlasroster.com).

Businesses and their staff

A business (our customer) signs up and invites its staff. For information about staff that the business manages in AtlasRoster, such as schedules, hours, clock-ins and requests, the business decides how it is used and is the data controller (in India, the "data fiduciary"). We process it on the business's behalf and under its instructions. For the account information we need to run the service, such as sign-in details, and for business owners' billing information, we are the controller. If you are a staff member, you can also contact your employer about your information.

2. What we collect

Information you or your business give us

Account details: name, email address, phone number if given, a profile photo if you add one, and your password, which we store only as a secure one-way hash.
Business details: business name, country, time zone, locations (addresses and geofence settings), positions and settings such as overtime rules.
Work information: role, positions and locations, hourly rate and maximum hours if your business adds them, shifts, availability, time off requests (including the type, such as sick or vacation, and any note), swap, drop and open-shift requests, and timesheet changes with their reasons.
Invitations: when a business invites someone, the name, email address or phone number it enters for them.
Billing details (owners): billing name, address, state, PIN or ZIP code, GSTIN if given, invoice email, plan and number of users. Razorpay collects the card or UPI details on its own payment page.

Information collected when you use the apps

Clock-in and clock-out: the time, and the device's location at that moment, compared with the location's geofence. Depending on the business's geofence rule, we store the location, flag a clock-in made outside the geofence, or refuse it. Staff can add a note to a flagged clock-in. The phone asks for your permission first, and only while the app is in use.
Device and notification data: if you allow notifications, a push token or browser push subscription, your device platform and model, and when the device was last active.
Notification history: the in-app list of notifications you received, and your notification settings.
Technical logs: our servers keep basic logs (such as IP address, request time and errors) to keep the service running and secure.
Visits to this website, only if you accept analytics cookies: the pages you view, the site or campaign that sent you, your approximate location (country or city), and your device and browser type, collected by Google Analytics.

What we don't collect

We don't track location in the background or between clock-ins. We don't read your contacts, and the app doesn't use your camera or microphone; photos are only uploaded when you choose a file. We don't collect full card or bank details. The AtlasRoster apps don't use advertising, analytics or tracking tools.

3. How we use it

Running AtlasRoster: schedules, clock-ins, timesheets, overtime, requests and reminders. Basis: performing our contract with the business, and the business's legitimate interests in managing its workforce.
Account emails and notifications: verification, password resets, invitations, shift reminders, published schedules, request updates and a daily summary for managers. You can turn each type off in your notification settings in My account, or turn push notifications off on your phone or browser. Security emails can't be turned off.
Billing: charging for paid plans through Razorpay, sending payment reminders and issuing invoices, including GST invoices in India. Basis: contract and legal obligation.
Support: answering your questions. Our support staff can see account and business details only to help you or to keep the service secure.
Safety and reliability: preventing abuse, fixing bugs and keeping the service secure. Basis: our legitimate interests.
Understanding how people use this website: if you accept analytics cookies, counting visits, where visitors come from and which pages they use, so we can improve atlasroster.com. Basis: your consent, which you can withdraw at any time.
Legal requirements: meeting tax and other legal obligations and responding to lawful requests. Basis: legal obligation.

The "basis" notes are the legal grounds that some laws, such as GDPR, ask us to state. We don't sell personal data, use it for advertising, or make automated decisions about anyone that have legal or similar effects. A flagged clock-in is reviewed by a person at the business.

4. Who can see your information

Owners and managers of your business see the team's schedules, availability, requests, clock-ins (including flagged ones and where they were made) and timesheets.
Staff see their own shifts, hours and requests, open shifts, the published schedule, and the names of teammates involved in a swap.
People outside your business can't see your business's information. Each business's data is kept separate.
If a manager exports a CSV file (timesheets or the team list), what happens to the file after that is up to the business.

5. Service providers

We use a small number of providers to run AtlasRoster. They process data only on our instructions, only to provide their service, and under contracts that require them to protect it:

Microsoft Azure: hosting, database, file storage (profile photos), push notification delivery and server logs (United States).
Resend: sends account and notification emails (United States).
Apple, Google (including Firebase) and browser push services: deliver notifications to phones and browsers.
Google Maps: shows maps and searches addresses when a manager sets up a location. Google receives your device's IP address when a map loads.
Google Fonts: serves the font the web app uses, and receives your device's IP address when it loads.
Google Analytics: on this website only, and only if you accept analytics cookies. It tells us how many people visit, where they come from and which pages they use. We've turned off Google's advertising features and data sharing for advertising.
Razorpay: takes payments for paid plans (cards, and UPI AutoPay in India), and stores the payment details itself.

We'll give you the current list of providers on request.

Notifications can include short details such as a shift's time, a location's name or a teammate's name. Apple, Google and browser makers carry that text to your device.

We may also disclose information if required by law, to protect people's safety or our rights, or as part of a merger or sale of the business. In a sale, this policy would continue to apply to your data.

6. Where your data is stored

Teckam is based in India, and our servers are in the United States (Microsoft Azure, East US 2). Your information may therefore be processed outside the country where you live. Where the law requires it, for example for transfers from the EU or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses offered by our providers.

7. How long we keep it

While a business's account is open, we keep its information so the service works. Timesheets and clock-in records stay for as long as the business keeps its account, so it can meet its own record-keeping duties.
When you delete your account (My account › Delete account), it is closed straight away: you're signed out on every device, can no longer sign in, and are removed from every business.
- 30 days later, we permanently delete your profile, photo, notification settings, devices and notification history. Until then you can email us to restore your account.
- The businesses you worked for keep your name on the shifts, timesheets and approvals you were part of, so their records stay correct, but it is no longer linked to an account.
When a business closes its account (the owner asks us at support@atlasroster.com), we delete the business's information within 90 days. The owner can export it or ask us for a copy first.
Invoices and billing records are kept for as long as tax and accounting law requires, even after an account is closed.
Copies in database backups are removed within 7 days after deletion.
Notification history and finished notification jobs are deleted after 30 days. Server logs are kept for 30 days, then deleted.

8. Your rights and choices

Depending on where you live, you may have the right to:

Access the personal data we hold about you and get a copy of it.
Correct it. You can change your name, phone number and photo in My account; for anything else, contact us or your employer.
Delete it. Use My account › Delete account, or email us. Owners first transfer ownership to a manager, or ask us to close the business.
Object to or restrict certain uses, and withdraw consent, for example by turning off notifications or location permission. Without location, the business may not let you clock in.
Complain to your local data protection authority.

For staff information held for your employer, we may pass your request to the business, which decides on it.

To make a request, email support@atlasroster.com from the address on your account. We'll respond within 30 days, and may need to confirm your identity first. We won't treat you differently for exercising your rights.

9. Security

We protect your data with:

encrypted connections (HTTPS)
password hashing with bcrypt, and sign-out on every device when you change your password
separation of each business's data from every other business's
encryption of stored data by our hosting provider
access controls that limit who at Teckam can reach production systems

No system is perfectly secure, so please use a strong, unique password. If we learn of a breach affecting your data, we'll notify the affected businesses, you and the authorities as the law requires.

10. Cookies and local storage

This website. When you first visit, we ask whether you accept analytics cookies. If you accept, Google Analytics sets the cookies _ga and _ga_*, which last up to 13 months, to count visits and tell new visitors from returning ones. If you decline, no analytics cookies are set and Google Analytics isn't loaded. Your choice is kept in your browser's local storage for a year, and you can change it at any time with Cookie settings at the bottom of every page. The website also remembers your $ / ₹ choice on the pricing page in local storage.

The apps. The AtlasRoster apps (the web app at app.atlasroster.com and the apps for iPhone and Android) use no analytics or advertising cookies. They store a few things on your device so they work smoothly: your sign-in tokens (in the phone's secure storage on iPhone and Android), a copy of your basic profile, and your theme choice. Signing out or uninstalling the app removes them. If you choose to save your password, your phone's or browser's password manager stores it; we never see it.

11. Age limits

AtlasRoster is for businesses and people old enough to work. It is not for anyone under 16. If a business adds staff under 18, the business is responsible for getting any consent from a parent or guardian that its local law requires (in India, anyone under 18 is a child under the Digital Personal Data Protection Act, 2023). If we learn that we hold data from someone under 16, or from a child without the required consent, we'll delete it. Parents can contact us at support@atlasroster.com.

12. Regional information

India

We process personal data in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. You can withdraw consent, request correction or erasure, and nominate another person to exercise your rights. For any grievance, contact our Grievance Officer:

Grievance Officer, Teckam Software Private Limited
Ray Purwa, Garg Road, Kanpur, Uttar Pradesh 208003, India
support@atlasroster.com

If you're not satisfied with our response, you can complain to the Data Protection Board of India.

European Economic Area and United Kingdom

For account and billing information, Teckam is the controller; for staff information, the business is. The legal bases we rely on are listed in section 3. You have the rights in section 8, including data portability and the right to complain to your supervisory authority.

California and other US states

We collect the categories of information described in section 2 for the purposes in section 3. We do not sell or "share" personal information for cross-context behavioural advertising. We use precise location only to check clock-ins against the business's geofence, not to infer characteristics about you. You may request to know, correct or delete your information as described in section 8.

13. Changes and contact

If we make meaningful changes to this policy, we'll update the date at the top and tell business owners by email, or in the app, before they take effect.

Questions or requests: support@atlasroster.com · Teckam Software Private Limited, Ray Purwa, Garg Road, Kanpur, Uttar Pradesh 208003, India