Privacy Policy

1. Scope and responsibilities

This Privacy Policy explains how TogglFace ("TogglFace," "we," "us," or "our") handles information through the TogglFace website, Android application, iOS application, kiosk experience, and related workforce-management services (collectively, the "Service").

Organizations use TogglFace to manage their workforce. Your employer or organization generally decides why employee information is collected and how it is used. TogglFace processes that information to provide the Service. Questions about an employer's workplace policies should first be directed to that employer or organization administrator.

2. Information we collect

The information collected depends on the features enabled by your organization and how you use the Service.

• Account and profile information, such as name, email address, phone number, address, time zone, profile photograph, authentication details, and organization membership.
• Employment and workforce information, such as department, supervisor, assigned projects, schedule, attendance, timesheets, leave, tasks, approvals, pay-rate information, and related notes or files.
• Face and biometric information, when enabled, including enrollment photographs, check-in or check-out photographs, facial feature templates (embeddings), matching results, liveness or anti-spoofing results, and biometric-consent records.
• Location information, when enabled and permitted, including precise or approximate coordinates used during a user-initiated attendance action to identify nearby projects, apply geofence rules, or document an attendance decision.
• Device, network, and usage information, such as IP address, browser or device type, operating system, app version, session and security events, error details, timestamps, and diagnostic logs.
• Information submitted to support, account administration, billing, or other Service features.

3. Camera, face verification, and location

TogglFace requests camera access when a user starts a feature that requires a face image, such as enrollment or attendance verification. The Service does not continuously record the camera. Images and derived face templates may be sent securely to the Service for identity matching, attendance records, fraud prevention, and audit review when those features are enabled.

On Android, TogglFace requests foreground location access when a location-dependent feature is used. Location is used for nearby-project selection, geofence validation, and attendance records. The Android app does not request background location permission and does not use location for advertising.

You may deny or revoke camera or location permission in device settings. Features that require the denied permission may then be unavailable.

4. How we use information

• Provide, operate, maintain, and improve the Service.
• Authenticate users and protect accounts and organizations.
• Verify identity and record check-ins, check-outs, travel, breaks, and other attendance activity.
• Apply project, scheduling, geofence, liveness, anti-spoofing, approval, payroll, and workforce rules selected by an organization.
• Provide reports, timesheets, audit history, alerts, support, and troubleshooting.
• Detect misuse, investigate disputes or security incidents, comply with law, and enforce agreements.
• Communicate about the Service, account security, and administrative requests.

5. How information is shared

We do not sell personal information, face data, or precise location data, and we do not use them for third-party advertising.

• With the organization using TogglFace and its authorized administrators, supervisors, payroll personnel, or other permitted users.
• With vendors that help provide infrastructure, hosting, storage, communications, payment processing, security, diagnostics, or customer support, subject to appropriate contractual and confidentiality controls.
• When required by law or a valid legal process, or when reasonably necessary to protect users, the Service, legal rights, safety, or security.
• As part of a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law and appropriate protection of the information.
• With another party when the organization or individual has directed or authorized the disclosure.

6. Retention and deletion

Information is retained only for as long as reasonably needed to provide the Service, satisfy an organization's configured retention settings and documented instructions, meet legal or accounting obligations, resolve disputes, and protect the Service. Retention periods can differ by data category and organization.

Biometric templates, verification photographs, attendance captures, and related records are deleted or de-identified according to organization settings, contractual requirements, and applicable law when they are no longer required for the disclosed purpose. Backup copies may remain for a limited period before being overwritten through normal backup processes.

To request access, correction, export, or deletion, employees should contact their employer or organization administrator. You may also contact privacy@togglface.com. We may need to verify the request and coordinate with the organization responsible for the account. Some records may be retained where legally required or necessary to establish, exercise, or defend legal claims.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. These measures include access controls, authentication protections, secure transport, tenant separation, logging, and restricted access to sensitive information. No method of transmission or storage is completely secure, so absolute security cannot be guaranteed.

8. Cookies and local storage

The website and mobile web experience use cookies and similar local-storage technologies that are necessary for authentication, session security, preferences, and core functionality. TogglFace does not use face or precise location information for cross-context behavioral advertising.

9. Your choices and privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or obtain a copy of personal information, or to object to certain processing. You may also withdraw a permission through your device settings. Withdrawing permission does not affect processing that occurred before withdrawal and may prevent a required feature from working.

Workforce records are usually controlled by your employer or organization, so submitting a request to that organization is often the fastest path. We will support verified requests as required by applicable law.

10. Children's privacy

TogglFace is a workforce service and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided information improperly, contact us so the matter can be reviewed.

11. International processing

Information may be processed in countries other than the country where it was collected. Where required, we use appropriate safeguards for international transfers and handle information in accordance with applicable data-protection law.

12. Changes to this policy

We may update this Privacy Policy as the Service, laws, or data practices change. The revised policy will be posted on this page with a new effective date. Material changes may also be communicated through the Service or to organization administrators when appropriate.