App and workspace privacy policy

1. Who can use the app

The app can be downloaded by anyone but shows nothing without credentials. You sign in with an email code or a Google account that your employer has added, or you create a workspace yourself and become its Founder account. When you create a workspace, a separate and optional box (never ticked for you) asks: “Yes, send me product news, offers and updates from Stemzo by email, phone or WhatsApp. I can withdraw this any time.” It is not part of agreeing to the Terms and this policy, which is required; you can create the workspace without ticking it. We record your answer, the wording, the time and the policy version. The Founder or an administrator can switch it on or off at any time in My settings > Privacy > Marketing messages, or by emailing customer@stemzo.ai with the subject “Unsubscribe”; we stop within 7 days. We never use employees’ data, or any KYC, payroll or attendance data, for marketing. The app is for adults at work and is not for anyone under 18 (see “Children” below). If you are a Founder or administrator, you are responsible for telling your staff what you record about them and for adding only people you may lawfully add; see the Terms.

2. What the app can hold about you, and why

What is actually recorded depends on which features your employer switched on. This is the full list of what the app can hold about an employee, and why:

On what ground. Your employer uses the employment ground in section 7(i) of the Digital Personal Data Protection Act, 2023 for payroll, attendance, leave, onboarding, work records and activity logs; your sign-in details are used because you need them to use the service. If an employer adds anything optional, it must ask for your consent first and you can withdraw it as easily as you gave it. Today the app has no optional item that needs a separate consent: out-of-office clock-in is part of attendance, and you can switch it off at any time in My settings > Privacy. Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, a password is sensitive personal data. We hold sign-in credentials only to let you in, and we record, with the time and the notice version, when you confirm that you have read this notice; that confirmation is your written (electronic) consent for them. You may decline to give information, but then the employer or we may be unable to give you a login.

We do not use this data for advertising, we do not sell it, and Stemzo does not use it to train AI models. The AI services listed in “Who receives your data” process data only to do the task they were asked to do.

3. Aadhaar and other ID photos

When you join, the app asks for a photo of one identity document: your Aadhaar card or your Voter ID (or another ID document). Aadhaar is optional: you can give your Voter ID instead. The joining and KYC screens say this in plain words, in English and Hindi, and accept either one; if you send both, both are kept. We collect the photo so that your employer can check who you are. We do not use it for anything else, and we never type or store your Aadhaar number as a separate field. Under the Aadhaar Act, 2016 the use of Aadhaar is voluntary, and a private employer may not insist on authentication; the app does not authenticate anyone with UIDAI.

• Please cover the first 8 digits. If you send an Aadhaar photo, the screen shows a short instruction and a drawn example, asks you to cover the first 8 digits of the Aadhaar number (so only the last 4 show) before you take the photo, and asks you to tick “I have covered the first 8 digits” before you send it. The tick is asked only when you send an Aadhaar photo, it is never ticked for you, and we record it; the reviewer sees whether it was ticked. We do not check the picture itself, so the tick is your word, and a reviewer can ask you to send the photo again. The first-8-digits cover is the standard UIDAI sets for stored copies.
• Who can see the photo. Only the named reviewer roles of your employer: the Founder, the GM and the Partner role. The photo is not shown on shared screens, in notifications, or to colleagues, and nothing is published.
• How long. By default 365 days after you are made inactive, by the automatic clean-up if your employer’s Founder has switched it on; your employer can set a different period (see section 7).
• If you do not want to give your Aadhaar card. Give your Voter ID or another ID photo instead; the screens accept that without any Aadhaar photo. If anyone still insists on Aadhaar, tell the Privacy and Grievance Desk.
• Older files in Google Drive. Before these screens existed, some staff Aadhaar and Voter ID files were uploaded to Google Drive, and their links sit in the staff sheet. When the retention period for ID documents ends (if the automatic clean-up is on) and when an erasure is carried out, those Drive files are moved to the Drive bin and the links are cleared. This applies to the workspace whose staff lists are kept in Google Sheets.
• Withdrawing. You can ask for the photo to be deleted under “Your rights”. We delete it unless the law requires your employer to keep it, and we tell you what is kept.

4. Who can see what

Access is by role, enforced on our servers:

• You can see your own attendance, payslips, requests and KYC status.
• Founder and GM can see payroll and salary data, KYC documents, the out-of-office report and company settings. The Partner role can review onboarding. Admin and MIS roles can manage people and attendance; managers see what they need to run routes and approvals.
• Company-wide setting. A security setting that the Founder controls decides whether ordinary employees can also read colleagues’ attendance, leave and expense requests and route records directly. The stricter setting, in which they cannot, is not yet on by default for any company; the Founder can switch it on under Settings, Security, and it will start on for new workspaces once the updated Android app is on all phones. Where it is not switched on for your company, that wider access can exist. Ask your employer which applies to you.
• Stemzo staff can reach workspace data only as needed to run, secure and support the service, and only on the company’s instructions.

5. Who receives your data (sub-processors)

Stemzo uses the companies below to run the service. Full detail, including where each is located as far as we know, is on the sub-processors page. We do not share your data with anyone for their own purposes. We disclose it to a government agency or a court only where the law or a lawful order requires it, and we do not publish it.

• Google: Firebase (database, sign-in, Cloud Functions), Cloud Storage (photos and documents), Cloud Run, Google Workspace (Sheets, Drive, Apps Script, Gmail), and Google Fonts (the web dashboard loads its typefaces from Google, so Google sees your browser’s address when you open the dashboard).
• Expo: push notifications to the Android app.
• Plivo and Google Gemini: the Founder’s voice assistant; Gemini also reads a team description if an owner types one.
• Razorpay: billing.
• Gmail and Google Mail services: sign-in codes and notifications.
• Cloudflare: a secure link between a company’s Tally accounting software and Stemzo, only for companies that connect Tally.
• The employer that issued your login.

6. Where your data is stored, and transfers outside India

At the time of writing, Stemzo’s Cloud Functions and the Cloud Storage bucket that holds photos and documents are in Google’s us-central1 (Iowa, United States) region, and Firebase Authentication processes data in the United States. Google Sheets, Drive, Apps Script and Gmail are Google-managed services whose location we cannot choose. Some other services are run by their providers outside India. We do not claim that your data stays in India. Data is sent abroad only to the providers listed above and only to run the service you or your employer asked for. As we read the law, Indian law currently permits transfers abroad except to countries the Government restricts; none is restricted at the time of writing, and we will follow any restriction that is notified. The Firestore database location and the voice service’s region are still to be confirmed and are marked so on the sub-processors page.

7. How long we keep it

The employer decides how long each kind of data is kept, using a retention schedule that is set for each company. The Founder can see and change it in the app: on the web dashboard under Settings > Privacy and retention (the tab next to Security), and on the phone under More > Privacy and retention. The GM can see it but not change it. The same screen has the switch for the automatic clean-up, a button that shows what the next clean-up would remove, and a list of the last runs. Where the law sets a minimum, we keep the records for at least that long. Most periods can be set from 30 days to 10 years; a few have a higher minimum (the periods for bills, payroll and attendance cannot be set below 8 years, and logs and privacy records not below one year). Stemzo’s starting values, which the employer can change, are:

When the deletions run. Clock-in selfies and route-stop proof photos are deleted automatically, once a day (03:30 India time), when their period ends, whether or not the clean-up is on. Every other deletion in this table is done by an automatic clean-up that runs once a day (04:00 India time) only for a company whose Founder has switched it on (feedback follows the switch of Stemzo’s own workspace); it is switched off until then, and while it is off it only counts what it would delete and writes that down. Ask your employer whether it is on. Each run looks at a limited number of items and carries on the next day. These periods are at least one year for personal data and logs of processing, which is the minimum the Digital Personal Data Protection Rules, 2025 (Rule 8) ask a fiduciary to keep, and your employer can lengthen them.

Records the law requires to be kept. These are not deleted early, even if you ask. They are kept at least as long as the law says:

In the app, a person’s salary and payroll records, PAN, UAN and ESI details, leave and expense request records and attendance times (the dates and times, not the location) are kept for at least 8 years after the person leaves (the default; the company can set longer), which is at least as long as every period above. The automatic clean-up never deletes them. After that period, on an erasure request, they are erased, or the person’s name is replaced so that the records still add up.

Not deleted by any automatic job today: tasks themselves and their comments, route and delivery records (the stops and times; their coordinates and photos follow the table above), delivery photos stored earlier in Google Drive, customer names and addresses, change logs, the Founder voice assistant’s feed and call log, the record of which privacy notice version you read, and rows in Google Sheets. The employer decides when to remove these. A change to these periods is announced here with a new version.

What an erasure request does. After employment has ended, the Founder can carry out an erasure from a plan that shows what will be erased and what kept. It signs the person out everywhere; removes phone notification addresses and settings; deletes the ID photos and the onboarding and KYC details; deletes selfies and visit photos; removes the location coordinates from attendance and route records; deletes personal tasks and removes the name from shared tasks; moves old Aadhaar and Voter ID files in Google Drive to the bin and clears their links; clears the PIN, name and email in the Google Sheet staff lists; and deletes a saved nominee. Records the company must retain (payroll, PAN, UAN and ESI details, accounting and attendance times) are kept for their period. On the staff record the name and email are replaced with “Former employee” and a short code; the employee ID stays in the records the company must retain, so they still add up. The person is told what is kept and until when.

When a company stops using Stemzo, we return its data (CSV or JSON, with the original files) if it asks, and we delete it, within 30 days after the end date, except records the law requires to be kept. Copies in backups are deleted in their normal cycle and in any case within 90 days after that. We keep logs of the processing for one year, then erase them. We confirm deletion in writing on request.

8. Security

What we actually do today:

• Role-based access, checked on our servers, and each company’s data is kept apart from other companies’ data.
• Sign-in with a one-time email code or Google sign-in. Codes expire after 10 minutes and the number of attempts is limited.
• Encryption in transit (HTTPS) between your device and our servers and between our servers and Google.
• Token-based links for some photos and files. Anyone who has such a link can open the file, so do not share them. We plan to replace these with links that expire.
• No cookies, analytics or advertising tools in the apps or the dashboard (see “Browser storage” below).
• Encryption at rest: Google encrypts data stored in Firebase and Cloud Storage by default. We do not claim any additional encryption beyond what Google provides.
• Logs of important changes (for example role changes and salary exports).
• Written practices. We keep written security runbooks, a register of what we hold and why, and a register of our vendors, and we review them at least once a year.

No system is perfectly secure. If you see something wrong, write to the Privacy and Grievance Desk.

9. Cookies and browser storage

The apps and the dashboard set no cookies and use no analytics, advertising or tracking tools. (The stemzo.ai and stemzo.in websites are different: they run Google Analytics only if you press “Accept analytics”; see the website privacy policy.) The web dashboard keeps these small items in your browser, and the Android app keeps matching settings on the phone, only to work as you expect:

10. Personal data breaches

If we become aware of a breach of personal data in a workspace, we will tell the employer (the company that is the Data Fiduciary) without undue delay and within 24 hours of becoming aware, and give it what it needs to meet its own duties, including reporting to the Data Protection Board of India and informing the people affected. What the people affected are told is: what happened, how far it reached and when; what it could mean for them; what has been done to limit it; what they can do to protect themselves; and a contact who can answer. We also report cyber incidents to CERT-In within 6 hours of noticing them, as the law requires. For our own data (account holders, enquiries), we will tell you and the authorities without delay as the law requires. A person, not an automatic system, sends these notices.

11. Your rights

You can ask to see a summary of your personal data and who it was shared with, to correct, complete or update it, to have it erased, to withdraw consent, and to nominate someone to act for you if you die or cannot act. In the app: My settings > My privacy, where you can download a copy of your records, ask for a correction, ask for erasure (which can be carried out only after your employment has ended, and which removes what no rule requires keeping and keeps the rest until its period ends, with your name replaced and your employee ID kept in those records; see section 7), nominate someone and raise a grievance. Those requests go to your employer’s Founder and GM, who must answer them; who your data is shared with is listed in section 5 and on the sub-processors page. By email: customer@stemzo.ai. The identifier we need is your name, the email registered in the workspace and the company name. More detail and timelines are on the rights page. Some records (payroll, tax, statutory attendance) must be kept by law even if you ask for erasure; we or your employer will tell you if that applies. To withdraw a consent, use the same screen or email: it is as easy as giving it. For marketing messages, Founders and administrators use My settings > Privacy > Marketing messages, or email Unsubscribe to customer@stemzo.ai; we stop within 7 days.

12. Grievance Officer, and complaints

We confirm every request within 2 working days and aim to reply within 15 days. We will resolve a complaint about how your data was handled within one month of receiving it, and we will answer every request within 90 days at most. Each reply will include these contact details.

If you are not satisfied. Please first use the Privacy and Grievance Desk, so that we or your employer can try to put things right. If you are still not satisfied with the answer, you may complain to the Data Protection Board of India once it is operating, as the Digital Personal Data Protection Act, 2023 provides. The Board is a digital office; please use the channel it publishes. We will add its contact details to the rights page when the Government announces them.

13. Children

The app is for adults at work. In law, anyone under 18 is a child. The app is not intended for anyone under 18, and people under 18 are not onboarded: new employees (when they join), people who create a workspace, and employees who joined earlier (once, the next time they open the app) are asked to confirm that they are 18 or over. If someone cannot confirm, the app tells them to contact the Grievance Officer or their company, and the company’s Founders are notified. We do not knowingly process children’s data and we claim no lawful ground to do so. Employers must not add anyone under 18 to a workspace. If a child’s data has been added, tell the Privacy and Grievance Desk and access is switched off and the data is erased within 15 days, unless the law requires otherwise.

14. Changes to this policy

This is version 3.4, effective 11 October 2026, last reviewed on 11 October 2026. It replaces version 3.3 of 6 October 2026. Version 3.4 changes only the number: the text of this page is unchanged, and the version moves so that the whole set of stemzo.ai pages stays on one number (the website privacy notice and the sub-processors page changed). Version 3.3, effective 6 October 2026, replaced version 3.2 of 6 October 2026. Version 3.3 brings the text in line with what the automatic clean-up deletes: the retention table now lists daily screen counts (400 days), report PDFs in Google Drive (30 days) and feedback (3 years after it is closed, or 24 months after it was written if never closed), the list of what we collect now describes screen counts and feedback, and the text no longer says that report files in Google Drive are not deleted automatically. Version 3.2 replaced version 3.1 of 5 October 2026 and added the optional marketing box at sign-up and the Marketing messages switch in My settings, with how to withdraw and the 7-day promise; the stemzo.ai website now offers Google Analytics only after consent (see the website privacy policy; the apps and the dashboard still use no analytics). Version 3.1 replaced version 2.0 of 4 October 2026, and before that the version of 12 September 2026, which said location was used only at clock-in and not stored, did not list selfies, KYC documents, Aadhaar and Voter ID photos, stored location, device tokens or most of the companies above, said staff see only their own records, promised deletion within 90 days of the end of a contract, and said only Google receives data. Version 3.0 added the statutory retention periods, the Aadhaar section, the browser storage table, the one-month grievance response and the company details. Version 3.1 brings the text in line with the app as released: Aadhaar is optional and the screens explain how to cover the first 8 digits, the Founder’s Privacy and retention screen exists, the list of what the automatic clean-up deletes and when is complete, old ID files in Google Drive are binned, employees who joined earlier are asked once to confirm they are 18 or over, a company ticks “I agree to the Terms of Service and the Privacy Policy” when it signs up, and the company’s Corporate Identity Number is printed with its registered office. If we change this policy we change the version and date, and we tell company administrators of material changes. Earlier versions are available on request.

15. Company details

Stemzo India Private Limited, Siliguri, West Bengal. Telephone +91-7797100055. Email customer@stemzo.ai. Website stemzo.ai.