Privacy policy

Data from the business account (the person who signs up and the administrators) is handled by Zeprub to provide the service.

Employee data is controlled by the business that employs them: the business is responsible for it and Zeprub processes it on the business's behalf and following its instructions. If you are an employee, your first point of contact is your employer; you can also write to us and we will help.

From the business account: business name, country, email, administrators' names and phone numbers, and acceptance of these documents (version, date and IP address).

From employees: name, code, ID document, contact details, profile photo if uploaded, location, department, position, schedule and supervisor.

From each punch: date and time, type of punch, the location at that moment, the selfie if the business requires it and details of the device used.

Technical data: IP address, browser type and a record of important actions inside the system, for security.

From the contact form: the details you leave so we can reply.

Zeprub asks for location only at the moment of clocking in, to check whether the person is inside their location's zone. We don't track location during the day or outside working hours.

The location is saved with the punch, along with the distance to the location. If someone clocks in outside the zone, the punch is flagged for the business to review.

If the business requires it, each punch saves a photo taken at that moment as proof of who clocked in. Only authorized people at the business can see it.

Selfies are deleted automatically when the period set by the business ends (90 days unless it changes it). We don't use selfies for face recognition or for any other purpose.

Fingerprints and faces never leave the phone. When an employee clocks in with fingerprint or face, the phone itself checks them, just like when it is unlocked.

When a device is registered, the phone creates its own passkey for Zeprub. We store only the public part of that key, which is used to confirm the punch comes from that device and cannot be used to rebuild the fingerprint or face.

Employees can see and remove their registered devices at any time from the portal.

To provide the service: record punches, calculate attendance, late arrivals, absences and hours, and generate reports and exports.

To manage the account: notices about the trial, the subscription and payments; support; and security, such as preventing unauthorized access and fake punches.

To meet legal obligations where applicable.

We don't sell data, we don't use it for advertising and we don't share it with advertisers.

With the providers we need to operate, who may only use it for that: Microsoft Azure, where the information is stored, and the email delivery service.

With the Zeprub support team, only if the business administrator authorizes it: access is read-only, expires after 2 hours and is logged on both sides.

With authorities, only when a law or a valid order requires it.

Information is stored on Microsoft Azure servers, with daily backups. It travels encrypted between your device and our servers.

Each business can only see its own data. Access to information is logged and passwords are stored in a way nobody can read.

While the business account is active, we keep its data to provide the service. Selfies are deleted earlier, according to the period set by the business.

If the subscription ends, the account switches to read-only and the data is kept for 180 days. We notify by email 30 and 7 days before, and when the period ends we permanently delete it and provide a deletion certificate.

Backups are replaced automatically in their normal cycle. Contact form messages are kept as long as needed to help you.

You can ask to see your data, correct it, delete it, get a copy, object to or restrict a use of it, and withdraw your consent when processing depends on it.

The business administrator can download all of the company's data from the system. If you are an employee, you can ask your employer or write to us and we will coordinate with them.

We reply within the time limits set by the law that applies to you. If you are not satisfied, you can contact the data protection authority in your country.

Zeprub is built for businesses. It is not aimed at minors and we don't knowingly handle their data, except what a business uploads about its own employees under the law of its country.

If we change this policy in an important way, we will let you know by email or inside the system before it applies. Each version has a date.