Privacy Policy

1. Who We Are

HireHub WorkTime ("the App," "we," "our") is operated by Ctrl Code Company, registered in the Republic of Uzbekistan. The App is used by employees to record workplace attendance through face verification and location check-in.

Your employer (the company that invited you to WorkTime) is an independent data controller for the attendance records it accesses, and decides who uses WorkTime in its organisation, which work locations and shifts apply, and how attendance records are used for HR and payroll. This policy covers how Ctrl Code Company, as the platform operator, processes your data.

2. Data We Collect

We do not collect your contacts, calendar, browsing history, microphone audio, or your bank-account or payment-card details. The App contains no advertising or analytics SDKs. If your phone reports a fake (mock) location, the check-in is rejected, your coordinates are not saved, and your employer is alerted.

3. How We Use Your Data

• Attendance verification — matching your live selfie against your enrolled face to confirm your identity, with an anti-spoofing check that tries to reject photos and screens.
• Geofence check-in — comparing your GPS coordinates to the workplace boundaries your employer has defined.
• Fraud detection — flagging punches made from a different phone than the one you enrolled with, from an impossible distance, outside the allowed area, or with a fake location, so that your employer's HR can review them.
• HR and payroll — producing timestamped attendance records, timesheets, lateness and overtime figures, and payslips for you and your employer's HR team.
• Notifications — sending reminders (for example a missed check-in) and alerts to your phone.
• Colleague and engagement features — the colleagues list, leaderboard, points and rewards described in Section 4.
• Invitations and joining a workspace — delivering invitations and handling join requests.
• Security, support and legal obligations — keeping the service secure, investigating problems, and complying with the law.

We do not use your face photos, face embedding or location for advertising, for identifying you among other people, or for any purpose not listed above. We do not sell or rent your personal data.

4. Who Sees Your Data

• Your employer's HR team and managers — see your attendance records and the timesheet, lateness and pay information for your workspace. For punches that need review they also see the verification status, whether you were inside the allowed area, your distance from the workplace, the reasons for the flag, and the face-match and liveness scores. They can approve, reject or correct flagged punches (corrections are added as new records). Alerts about a flagged punch can include the random identifier of the phone it came from. The employer dashboard does not show your raw GPS coordinates, IP address or face embedding, and it shows face images only to HR administrators, as described next.
• Your employer's HR administrators — people with the HR-admin role in the WorkTime employer dashboard (not managers and not colleagues) can, to verify attendance, view in the dashboard the selfie taken at a check-in or check-out that was flagged for review — pending verification, rejected, or flagged by a fraud check (for example outside the allowed area, from a different phone, or an uncertain face match) — and your current face reference photo, while your face enrolment is active. These are shown side by side, together with the face-match and liveness scores, your distance from the workplace and the reasons for the flag. Selfies from check-ins and check-outs that passed every check with no flag are not shown. Every view is logged (Section 5).
• Your colleagues in the same company — can see your name, photo, position, department and branch, whether you are currently working, on a break, out or absent, the time of your first check-in today, and your leaderboard rank, points and achievements.
• Ctrl Code Company engineers — the engineers who operate and troubleshoot the service can technically reach the data stored on our servers, including stored selfies and face embeddings, and can use internal administration tools (for example to reset a member's face enrolment or device). No screen in the App displays stored selfies or embeddings; the employer dashboard displays face images only to HR administrators, as described above, and never displays face embeddings.
• Service providers — the infrastructure and messaging providers listed in Section 7, which handle data on our behalf for the purposes described there.
• Authorities — where we are required to disclose data by law.

We do not sell, rent, or trade your personal data to any third party.

5. Biometric Data Safeguards

Because face photos and face embeddings are sensitive biometric data, we apply the following protections:

• The App asks for your consent to face verification and to location before you can enrol or check in, and our servers refuse enrolment and check-in without both recorded consents.
• Face matching is one-to-one: a check-in selfie is compared only against your own enrolment.
• Data travels between the App and our servers over encrypted HTTPS (TLS).
• The face-recognition service runs on its own server, reachable only over a private encrypted network (WireGuard) from our application server, not from the public internet.
• Stored selfies are kept in private object storage that is not publicly accessible, on servers located in Tashkent, Uzbekistan.
• Our routine database backups do not include stored selfies or the face embedding store.
• Selfies and face embeddings are not shown in the App, and are not sent to any push, SMS or messaging provider. Face embeddings are never shown to anyone. In the employer dashboard, only your employer's HR administrators can view face images: the selfies from flagged check-ins and check-outs, and your current reference photo while your face enrolment is active (Section 4).
• Each face image an HR administrator views is delivered through a private link that expires after 60 seconds; the storage itself stays private. Every view is logged — which HR administrator viewed it, whose photo, which check-in, and when — and the number of views per HR administrator is rate-limited.
• Selfies, coordinates and phone numbers are excluded from our application logs by design.
• The face check includes an anti-spoofing test intended to reject photos, screens and recordings, at enrolment and at check-in.

Matching is automated and can make mistakes. An uncertain match is not a final decision: it is flagged for your employer's HR to review.

6. How Long We Keep Your Data

Check-in and check-out selfies are deleted automatically 90 days after they are taken (see below). Apart from that, WorkTime does not delete personal data automatically. There is no scheduled purge of reference photos, face embeddings or attendance records for people who never delete their account. Unless a row below says otherwise, data is kept until you delete your account in the App or a verified request by email is processed (Section 9). Deleting your account in the App removes the data marked below straight away, with no waiting period.

7. Where Your Data Is Stored and Who Processes It

WorkTime data is stored on virtual servers operated by Airnet.uz in Tashkent, Uzbekistan. One server runs the API, the databases and the selfie storage; a separate server runs the face-recognition service. The two are connected by a private encrypted network. Selfies, face embeddings and GPS coordinates are processed and stored on these servers.

Push-notification and messaging providers may process the limited data shown above outside Uzbekistan as part of delivering messages. Selfies, face embeddings and coordinates are not sent to them.

8. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy (by email).
• Correct inaccurate data. Corrections to attendance records are made by your employer's HR as new entries.
• Delete your account, face photos and face embedding yourself in the App (Settings → Delete account), or ask us by email to delete only your face data, subject to what we must or may keep (Sections 6 and 9).
• Withdraw consent to face verification at any time in the App (Settings → Withdraw face-verification consent), and to location at any time by email; there is no button in the App for withdrawing location consent. Deleting your account also records your consent as withdrawn. Both consents are required to record attendance, so after you withdraw, check-ins are refused until you consent again and re-enrol.
• Object to or restrict processing in certain circumstances.
• Portability — receive a copy of your attendance records in a machine-readable format.
• Complain to the competent data-protection authority in Uzbekistan if you believe your rights have been breached.

You can delete your account and withdraw your face-verification consent in the App (Section 9). Deleting only your face data, withdrawing location consent without deleting your account, copies of your data, and review of the records we keep are handled as manual requests by email; there is no button in the App for these (Section 9). Requests about attendance records and how long your employer keeps them may also need to go to your employer, who is an independent controller of those records. We aim to respond within 30 days.

9. Requesting Deletion or Withdrawing Consent

You can delete your account and withdraw your face-verification consent yourself in the App. Some requests can still only be made by email, and we process those manually after verifying your identity.

Delete your account in the App:

1. Open Settings and choose Delete account (in the "Your data" group).
2. Read the confirmation, which lists what is deleted and what is kept, and continue.
3. We send a 5-digit one-time code to the phone number on your account, by Telegram or SMS. Enter it in the App. The code is valid for 5 minutes, you can ask for a new one after 60 seconds, and after 5 wrong codes you must ask for a new one.
4. When the code is accepted, your account is deleted straight away. There is no waiting period and no manual step.

When the deletion completes, at once:

• your face embedding is deleted from the face-recognition service (securely wiped);
• your reference photos and all your check-in selfies are deleted from our private storage;
• your push-notification tokens, notification inbox, and browser-push subscriptions and preferences are deleted;
• your face enrolments are revoked and your consent is recorded as withdrawn (the consent records themselves are kept as proof of what you agreed to);
• your workforce membership is marked as terminated, so you stop counting as an active member of your employer's workspace;
• your HireHub account and profile (phone number, name and profile photo) are deleted. Your WorkTime sign-in is a HireHub account, so this also ends access to other HireHub apps that use the same account.

This is the same for every company you belong to. If the deletion of your face and attendance-system data cannot be completed, nothing is deleted: the App shows an error and you can try again with the same code while it is still valid.

Withdraw face-verification consent in the App: open Settings and choose Withdraw face-verification consent. It takes effect immediately: your consent is recorded as withdrawn, your face enrolment is switched off (it is no longer used for matching, and HR administrators can no longer view your reference photo), no new selfies are taken or stored, and check-ins and check-outs are refused until you give consent again and re-enrol your face. Selfies already stored keep following the 90-day automatic deletion (Section 6), and until then your employer's HR administrators can still view those from flagged check-ins. Withdrawing consent does not by itself erase your stored reference photos or face embedding; deleting your account in the App, or a face-data request by email, does.

By email, for what the App cannot do. There is no button in the App for deleting only your face data or for withdrawing your location consent without deleting your account. Email us for any of these:

• deleting only your face data and keeping your account;
• withdrawing your location consent without deleting your account;
• a copy of your data;
• deleting your account if you cannot use the App or your account has no phone number (the App cannot send a code without one);
• a review of the records we keep (see below).

1. Email privacy@hirehubgroup.uz with the subject "Privacy Request — HireHub WorkTime". Give the phone number you sign in with, if your account has one (if it has none, tell us who your employer is), and say what you want. For a face-data request, mark the email "BIOMETRIC DELETION REQUEST".
2. We verify that the request is really from you before deleting anything, for example with a one-time code sent to the phone number on the account, or by confirming with your employer.
3. Face-data request: we deactivate your face enrolment, record your withdrawal of consent, and delete your stored reference photos, check-in selfies and face embedding from our servers. You will not be able to check in until you consent and enrol again, so let your employer know.
4. Account deletion by email (only if you cannot delete in the App): we delete the same data as the in-app deletion above.
5. We confirm by email when the request has been processed.

What we do not delete: attendance records (including the GPS coordinates, IP address and device identifier stored with them), timesheets and payslips, the points and rewards ledger, consent records, and invitation, join-request and Telegram-link records. They are kept as described in Section 6 under an internal member ID, and your employer can still link them to you. The references in your attendance records to your deleted face enrolment point at nothing. Encrypted database backups age out on a short rolling period and contain database records only (Section 6). If you believe the law entitles you to have any of these records erased, email us and we will assess it and reply with our reasons. See also the account deletion page.

10. Children

HireHub WorkTime is an employment tool intended for adults (18+). We do not knowingly collect data from persons under 18. If you believe a minor's data has been processed in error, contact us immediately.

11. Contact & Privacy Requests

For face-data deletion or consent withdrawal, mark your email "BIOMETRIC DELETION REQUEST". See Section 9 for what happens next.

12. Changes to This Policy

We will publish any changes on this page and update the "Last updated" date at the top. If we make material changes to how we process biometric data, we will ask for your consent again where the law requires it.