Privacy Policy

Last updated: 4 September 2026

This Privacy Policy explains how Ezaris ("Ezaris", "we", "us") collects, uses, stores, and protects personal data when you use our websites and applications. We are committed to handling your data lawfully and transparently, including under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Who is responsible for your data

Ezaris is a product of Vital Systems, a proprietorship registered in India (the "Data Fiduciary" / "we").

When your employer uses Ezaris to manage attendance and expenses, your employer decides what data is collected and why, and Ezaris processes that data on their behalf as a Data Processor. For questions about your own attendance or expense records, please contact your employer first. For questions about the platform itself, contact us at support@ezaris.co.

2. What we collect

• Account details — your name, email address, phone number, and role, as added by you or your employer.
• Attendance data — punch in/out times, the branch or site, and shift details.
• Face data — a face template created from an enrolment photo, and a selfie captured at each punch (see §3).
• Location data — the GPS location recorded at the moment of a punch, to confirm where attendance was marked.
• Expense data — claim amounts, categories, and receipt images you upload.
• Technical data — device and app information and log data needed to keep the service secure and working.

3. Face data and location

Face verification is the core of Ezaris attendance. We want to be precise about it:

• Enrolment. When you join, one photo is used to create a mathematical face template. This template is used only to confirm it is really you when you punch.
• Punch selfies. Each time you punch, the app captures a selfie and matches it to your enrolled template. These punch selfies let an administrator verify a specific punch, and are automatically deleted after 30 days.
• Enrolled template retention. Your enrolled face template is kept for as long as you are an active member of your team, so matching keeps working. It is deleted when you are removed from the team or when your employer's account is closed (see §5).
• Location. GPS is captured only at the moment of a punch. Ezaris does not track your location in the background or at any other time.

4. How we use data

• To verify identity and record attendance.
• To process, approve, and settle expense claims.
• To provide dashboards and reports to your employer.
• To secure the service, prevent fraud and buddy-punching, and meet legal obligations.

We do not use your face data for advertising, profiling, or any purpose other than attendance verification, and we never sell personal data.

5. How long we keep data

• Punch selfies: deleted automatically after 30 days.
• Enrolled face template: kept while you are an active team member; deleted when you are removed or the account is closed.
• Attendance & expense records: retained for the period your employer needs for payroll, audit, and legal compliance.
• Account closure: when an employer closes their Ezaris account, personal data is deleted or irreversibly anonymised within a reasonable period, except where law requires us to keep it.

6. Who we share data with

We share data only where necessary to run the service:

• Your employer, who controls the account.
• Sub-processors that power specific features — for example Amazon Web Services (Amazon Rekognition for face matching, and cloud hosting) and Google Maps for location. These providers process data only on our instructions.
• Authorities, where required by law.

We do not sell or rent personal data to anyone.

7. Your rights under the DPDP Act

Subject to your employer's role as the primary decision-maker for workplace data, you may:

• Access a summary of the personal data we process about you.
• Request correction, completion, or updating of your data.
• Request erasure of your data where it is no longer required.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Raise a grievance with us (see §9) and, if unresolved, with the Data Protection Board of India.

8. Security

We protect data with encryption in transit, access controls, tenant isolation so one company can never see another's data, and reputable cloud infrastructure. No system is perfectly secure, but we take reasonable technical and organisational measures to safeguard your information.

9. Contact & grievances

For any privacy question or to exercise your rights, contact our grievance point:

We will respond to privacy requests within the timelines required by applicable law.

This policy may be updated from time to time. Material changes will be posted on this page with a revised "Last updated" date.