Privacy Policy

2. Face data (facial recognition / biometric identifiers)

The App includes features that use your face for workplace attendance. This section describes collection, all intended uses and disclosures of face data, face data sharing and retention policies, face data deletion policies (including how users can revoke consent for collection or use of face data and how users can delete their face data), and confirmation that third parties with whom face data is shared provide the same or equal protection of face data as stated in this Privacy Policy.

2.1 What face data we collect

• Enrollment selfie(s). When you (or your HR administrator, with your consent) enroll face recognition, the App or web portal captures one or more photographs of your face.
• Face template / biometric identifier. From those images we create a mathematical face template (face ID) stored in a company-scoped face collection used only for matching you during attendance check-in/out. We do not sell face templates.
• Attendance verification frames. When you clock in or out with face verification, the App briefly captures camera frames (including a short live-person / liveness check such as a head turn) and sends them to our servers to compare against your enrolled template. These punch frames are processed for verification; they are not kept as a long-term photo gallery of every punch. Verification outcomes (for example match confidence and related attendance records) may be stored with your time punches for audit and payroll accuracy.
• Consent record. Enrollment records whether consent was given and when.

2.2 Intended uses of face data

Face data is used only for:

• Enrolling an authorized employee for mobile attendance;
• Verifying that the person clocking in or out is the enrolled employee (anti buddy-punching);
• Confirming a live person is present during verification (liveness checks);
• Supporting related workplace attendance integrity, security investigations, and employer HR/audit needs within the employer's FilWeb Asia Inc. HRIS account;
• Operating, securing, troubleshooting, and improving these features.

We do not use face data for advertising, marketing profiling, social scoring, or sale to data brokers.

2.3 Face data sharing and disclosures

Face data is accessible to:

• Your employer's authorized HR/admin users on that company's FilWeb Asia Inc. HRIS account (for enrollment management and attendance administration);
• FilWeb Asia Inc. operators who maintain the platform, only as needed for support, security, and service operations under confidentiality obligations;
• Service providers (processors) that host or process face-related data on our instructions, currently including:
  • Amazon Web Services (AWS Rekognition) — to index enrollment images into a face collection and to search/match verification images and support liveness-related face analysis;
  • Supabase (storage)— to store enrollment selfie image files in secured object storage for your employer's account.

We may also disclose face data if required by law, regulation, legal process, or to protect the rights, safety, or security of users, employers, or FilWeb Asia Inc.

Third-party protection. When we share face data with third-party processors such as AWS and Supabase, we require that those processors provide the same or equal protection of the face data as stated in this Privacy Policy, through contractual and/or organizational measures appropriate to their role as service providers processing data on our instructions (and not for their own unrelated commercial purposes).

2.4 Face data retention

• Enrollment selfies and face templates are retained while face enrollment remains active for your employee record, or until deleted as described below.
• When an enrollment is deleted, we remove the stored enrollment selfie (if any), delete the corresponding face template from the face recognition collection, and delete the enrollment database record.
• Attendance records that note that a face match occurred (for example confidence scores associated with a punch) may be retained with ordinary timekeeping / payroll records according to your employer's retention practices and applicable law, even after a face enrollment is removed.
• Backup copies may persist for a limited period until rotated out of routine backups.

2.5 Consent, revocation, and deletion of face data

Face enrollment requires affirmative consent at enrollment time (self-enroll in the employee portal / profile, or HR-assisted enrollment where your employer obtains consent).

You can revoke consent for our collection or use of face data, and delete face data, by:

• Deleting your face enrollment(s) from My Profile in the FilWeb Asia Inc. HRIS employee web portal (where your employer has enabled self-service), or
• Asking your company HR / administrator to delete your face enrollment in FilWeb Asia Inc. HRIS (employee Access / face enrollment controls).

After deletion, face-verified mobile clock-in/out will not work until you enroll again (with fresh consent). Revoking face consent does not delete your entire HR employment record; it removes face enrollment data as described above.

If you cannot access self-service deletion, contact your employer's HR team or email us using the contact details below and we will help route the request to the correct account administrators.

3. Other information we collect

• Account and identity data (name, employee number, work email, role, company membership);
• Attendance and location data when enabled (GPS coordinates / geofence checks for on-site verification);
• Device identifiers used for mobile session and device registration;
• HR/payroll and related workplace data your employer enters or generates in FilWeb Asia Inc. HRIS (schedules, leave, overtime, payslips, and similar);
• Technical logs (IP address, timestamps, app diagnostics) for security and reliability.

4. How we use information

We use personal information to provide FilWeb Asia Inc. HRIS features your employer enables (timekeeping, scheduling, leave, payroll inputs, notifications, and account security), to prevent fraud and abuse, to comply with law, and to communicate service-related messages. Location, device ID, user ID, and email are used for workplace attendance and account security inside FilWeb Asia Inc. HRIS — not to track you across other companies' apps or websites for advertising.

5. Sharing (non–face-data overview)

Beyond face data processors described above, we use infrastructure and communications providers (for example hosting, databases, email delivery) as processors. Your employer controls which of its staff can see employee HR data inside the product. We do not sell personal information.

6. Retention (general)

We retain personal information for as long as needed to provide the service to your employer, meet legal/payroll/audit obligations, resolve disputes, and enforce agreements. Face-specific retention is described in section 2.4.

7. Your choices and requests

Depending on applicable law and your employer's policies, you may request access, correction, or deletion of personal information. Face enrollment deletion is available as described in section 2.5. Other HR record changes are usually handled by your employer's administrators inside FilWeb Asia Inc. HRIS.

8. No cross-app / cross-website tracking (App Tracking Transparency)

Under Apple's App Tracking Transparency rules, “tracking” means linking data collected about you from our App with data from other companies' apps, websites, or offline properties for targeted advertising or advertising measurement, or sharing data with data brokers.

FilWeb Asia Inc. HRIS does not track users in that sense. Precise location, device identifiers, user IDs, and email addresses are collected only to operate workplace attendance, device binding, geofencing, account authentication, and related HR features for your employer. We do not use these data types to track you across third-party apps or websites, and we do not use App Tracking Transparency because the App does not engage in that form of tracking.

9. Security

We use administrative, technical, and organizational measures designed to protect personal information, including access controls, encrypted transport (HTTPS), and scoped storage for enrollment images. No method of transmission or storage is 100% secure.

10. Children

FilWeb Asia Inc. HRIS is a workplace tool for authorized adult workers. It is not directed to children, and we do not knowingly collect face data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes affecting face data practices will be reflected in this public page, which is also the policy URL referenced for the mobile App.

12. Contact

For privacy questions, face-data deletion help, or App Store / mobile privacy inquiries about FilWeb Asia Inc. HRIS:

• Email: hris@filwebasia.com
• Or contact your employer's HR administrator who manages your FilWeb Asia Inc. HRIS account.