The short version
In plain words: your employer decides to use Atpin and controls your work data. We run the service for them. We collect what attendance, leave and payroll need, location only around your punches and while you are punched in, and computer activity only if you agree. We do not sell your data or show you ads.
- Sign in is with Google. We do not see your Google password.
- Location is used at punch in and out. Background location runs only while you are punched in, only if you agree, and stops when you punch out.
- Selfies are optional unless your company requires them.
- Only the last 4 digits of Aadhaar are kept. Bank account numbers are encrypted.
- Managers never see salary, bank details or identity documents.
- Computer monitoring needs your consent, shows a visible indicator and announces live view on screen.
Who we are and our role
Atpin (the Atpin mobile app for Android and iPhone, the Atpin admin console at officeadmin.imazyn.com, Atpin Desktop for Windows and Mac, and this website) is provided by Inultimate Ventures Private Limited, [[PLACEHOLDER: registered address]] (“Atpin”, “we”, “us”).
Atpin is used by companies to manage their employees. Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”):
- Your employer is the Data Fiduciary for the personal data of its employees. It decides why and how that data is processed, which features are turned on (for example selfies, salary visibility or computer monitoring) and how long records are kept.
- Atpin is a Data Processor that processes that data on your employer’s behalf and under a contract with it.
- Atpin is the Data Fiduciary only for data about company customers and their admins that we need to run our business (accounts, billing, support) and for this website.
If you have a question about how your employer uses your data, ask your HR or company admin first. You can also contact us and we will pass your request to your employer.
What we collect
| Category | What exactly | Source |
|---|---|---|
| Google account | Name, email address, profile photo and your Google account ID, received when you sign in with Google. We never receive your Google password. | Google Sign-In |
| Work record | Company, role (employee, manager or admin), manager, assigned offices, shift, work-from-home setting, membership status and last working day. | Your employer |
| Location at punch | Precise GPS position, accuracy and whether the phone reported a mock location, captured when you punch in and when you punch out, and which office geofence matched. | Your phone |
| Location while punched in (optional) | If you agree, a position every 5 minutes while you are punched in, used to count time away from your office. It stops when you punch out, sign out, or at the end of the day. Not collected for work-from-home staff. | Your phone, in the background |
| Arrival and leaving reminders (optional) | Your assigned offices are registered as geofences on your phone so it can remind you to punch in or out. This check runs on the phone; nothing is sent to us before you punch in. | Your phone |
| Selfies and photos | A selfie at punch in or out when you add one or your company requires it. Photos or PDFs you attach to a request or upload as a document. | Your camera or files |
| Attendance and requests | Punch times, worked minutes, late marks, early outs, overtime, away time, leave requests and balances, corrections (regularisations), approvals and notes. | You, your manager, your employer |
| Salary and payroll | Monthly salary and revisions, deductions, earned-so-far estimates and payslips. Visible to you and your company admins only, and only if your company shows pay to employees. | Your employer |
| Identity and bank details | PAN (shown masked), the last 4 digits of Aadhaar only, bank account number (encrypted at rest; the last 4 digits are shown), IFSC, bank name, addresses, emergency contact, optional date of birth, and the document files you upload. | You or your employer |
| Device and notifications | A Firebase Cloud Messaging token and platform so we can send push notifications, your notification preferences and in-app notifications. | Your phone |
| App lock | If you set an Atpin PIN, it is stored as a salted hash only on your phone. Fingerprint and face unlock are handled by your phone; we never receive biometric data. | Your phone only |
| Computer monitoring (only with consent) | If your employer turns on Atpin Desktop and you consent: active and idle time, the app in front and its window title (if enabled), screenshots at the interval your employer sets (clear or blurred on the computer before upload), computer name, operating system and app version, your consent record, and an audit of who viewed your data. Live view frames are relayed and not stored. | Atpin Desktop on your computer |
| Company and billing | For company admins: company name, legal name, GSTIN, PAN, address, logo, plan, invoices and payment references. | Company admin |
| Technical logs | IP address, time and request details in server logs, used for security, rate limiting and troubleshooting. | Automatic |
| Support | What you tell us when you contact support. | You |
We do not use advertising SDKs, analytics SDKs or third-party crash reporting in the mobile app, and we do not track you across other companies’ apps or websites.
Location, in detail
Prominent disclosure. Atpin collects location data to enable geofenced punch in and punch out, and, if you agree, to count time away from your office every 5 minutes while you are punched in, even when the app is closed or not in use. Location is not collected when you are not punched in.
- At punch in and out the app reads your position once to confirm you are inside one of your assigned offices. Mock locations are rejected or flagged.
- While punched in (optional). Before first use the app asks for your consent in plain language. On Android this runs as a foreground service with a persistent notification that says Atpin is checking your location while you are punched in. On iPhone it uses background location. If you decline, punching in still works and these checks stay off. You can turn them on or off in Profile, Location, and in your phone’s settings.
- Arrival and leaving reminders (optional) are worked out on your phone using the operating system’s geofencing. Nothing is sent to us before you punch in.
- Work-from-home staff can punch in from anywhere. Their position is still recorded with the punch, but no checks run while they are punched in.
- Who sees it: you, your managers and your company admins. Other employees on the team board never see anyone’s location.
- Time away is for information only. It never changes your attendance, leave or pay by itself.
Why we use it and the legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Signing you in and keeping your account secure | Google account, device, technical logs | Employment-related legitimate use for your employer; contract with your employer |
| Geofenced punch in and out, attendance records | Location at punch, selfies, attendance | Employment-related legitimate use (DPDP Act s. 7(i)) |
| Counting time away from the office while punched in | Location while punched in | Your consent, which you can withdraw in Profile |
| Leave, corrections, overtime, timesheets and approvals | Attendance and requests, work record | Employment-related legitimate use |
| Salary estimates, payroll and payslips | Salary and payroll, attendance | Employment-related legitimate use |
| HR records and documents | Identity and bank details | Employment-related legitimate use; legal obligations of your employer |
| Push notifications and reminders | Device and notifications | Your consent through the phone's notification permission |
| Computer monitoring | Computer monitoring data | Your consent, recorded per policy version; you can withdraw it |
| Billing and GST invoices | Company and billing | Contract with the company; legal obligations |
| Security, abuse prevention and fixing problems | Technical logs | Legitimate use and legal obligations |
Under section 7(i) of the DPDP Act, employers may process personal data for purposes of employment without separate consent. Where a feature depends on consent, the app asks for it before the feature starts, and you can withdraw it at any time with the same ease. Withdrawing consent does not affect processing that happened before.
How long we keep it
| Data | Kept for |
|---|---|
| Location pings while punched in | Raw points: 90 days, then deleted. Daily away totals stay with the attendance record. |
| Monitoring activity and screenshots | The period your employer sets within its plan limit (30 days by default), then deleted automatically. Live view frames are never stored. |
| Attendance, leave, pay, payslips, documents | While your employer uses Atpin, for as long as your employer decides, subject to the law that applies to it. |
| After you leave a company | You keep read-only access to your own payslips, attendance and documents for 90 days after your last working day. After that they are hidden from you; your former employer keeps its records. |
| If a company stops using Atpin | The company account becomes read only and is then cancelled. Data is kept until the company asks for deletion or 12 months after cancellation, whichever comes first. |
| Encrypted backups | Daily backups for 7 days, weekly for 4 weeks and monthly for 6 months. Deleted data leaves the backups as they rotate out. |
| Push tokens | Until you sign out, uninstall the app or the token is replaced. |
| Server logs | Up to 30 days. |
How we protect it
- All traffic uses HTTPS. Each request is checked against your company and your role, so one company can never read another’s records.
- Bank account numbers are encrypted with AES-256-GCM. An admin can reveal a full number only through an action that is written to an audit log.
- Selfies, documents and screenshots are stored privately and opened only through signed links that expire within an hour (screenshots within 5 minutes).
- My pay and Documents can be locked behind your phone’s lock or an Atpin PIN, and re-lock after 5 minutes.
- Company backups are encrypted. Views of screenshots, live view sessions and support access to a company are audited.
- Rate limits protect sign-in and uploads. Screenshot uploads are checked against the consented policy on the server.
No system is perfectly secure. If a personal data breach affects you, we will inform your employer and the Data Protection Board of India as the DPDP Act requires, so that you can be told.
Your rights
Under the DPDP Act you can:
- Access a summary of your personal data and how it is processed. Most of it is already visible to you in the app.
- Correct or complete your data. Use a correction request for attendance, or update your details in Profile, Documents and details.
- Erase data that is no longer needed, subject to the records your employer must keep by law. See Delete your account.
- Withdraw consent for optional features: location while punched in (Profile, Location), notifications (phone settings) and computer monitoring (Profile, Computer monitoring).
- Nominate someone to exercise your rights if you die or become unable to.
- Complain to our grievance officer, and then to the Data Protection Board of India.
Because your employer is the Data Fiduciary for work data, we send requests about that data to your employer and help it respond. Write to imazynecom@gmail.com.
Children
Atpin is a workplace tool for adults. It is not meant for anyone under 18, and we do not knowingly process children’s data. If you think a child’s data has been added, contact us and we will work with the employer to delete it.
App Store and Google Play notes
- No tracking. Atpin does not track you across apps or websites owned by other companies and does not use data for advertising.
- Data linked to you. The data in “What we collect” is linked to your work identity, because attendance and payroll need it.
- Permissions. Location (when in use, and in the background only while punched in), camera (selfies and documents), photos (attachments), notifications, Face ID or fingerprint (app lock, handled by your phone).
- Deletion. See Delete your account for how to request deletion and what your employer keeps.
This website
This website does not use cookies, analytics or advertising. It loads fonts from Google Fonts and, on large screens, a 3D graphics library from cdnjs (Cloudflare); those providers receive your IP address as part of delivering the files.
Changes to this policy
We will update this page when our practices change and change the date at the top. For important changes we will tell company admins in the console and show a notice in the app. If a change widens what computer monitoring captures, Atpin Desktop asks for consent again before it applies.
Grievance officer and contact
Grievance officer: Paras
Email: imazynecom@gmail.com
Phone: +91 86577 83996
Address: [[PLACEHOLDER: registered address]]
General privacy questions: imazynecom@gmail.com. We acknowledge grievances promptly and resolve them within the time the DPDP Act and its rules require.