Privacy Policy

We collect the following categories of information:

Account & profile information

When an account is created for you (by you or your employer), we collect your name, email address, phone number, password (stored in hashed form by our authentication provider), role (worker, manager, or admin), and an optional profile photo. If you sign in with Google or Apple, we receive your name and email address from that provider (and, from Google, your profile image). If you use Sign in with Apple and choose to hide your email, Apple provides us with a private relay email address instead of your real one.

Employer & organization information

Company name and details, branch and department assignments, shift schedules, work zones, job role, and the team or manager you report to.

Location data

With your permission, we collect your device’s precise GPS location at the moments you clock in, clock out, and start or end a break, and — where your employer has enabled live attendance features — during an active shift. Location is used to verify that attendance events occur within an assigned work zone (geofencing) and, for authorized managers and admins, to show clocked-in team members on a live map. See the “Location Data” section below for details and how to turn this off.

Attendance & work data

Clock-in / clock-out times, break records, total working hours, leave and time-off requests, tasks assigned to or created by you and their status and progress, and payroll-related information such as hours worked and compensation figures your employer records in the app.

Messages

Content of chat messages you send to and receive from colleagues through the in-app messaging feature.

Device & push-notification data

Device model and operating system, app version, language preference, network connection status, and a push-notification token (via Firebase Cloud Messaging) so we can deliver notifications to your device.

Usage & log data

Basic technical logs about how the Service is accessed and used, which help us keep the app secure and reliable.

We use the information described above to:

• Provide time and attendance tracking, including clock-in / clock-out and break management.
• Verify that attendance events happen within assigned work zones and prevent inaccurate or fraudulent records.
• Enable task assignment, tracking, and team collaboration.
• Operate in-app messaging between members of your organization.
• Manage leave requests, working-hours reporting, and payroll information for your employer.
• Provide managers and admins with attendance analytics, reports, and a live view of on-duty team members.
• Send you notifications relevant to your work (e.g. shift reminders, task updates, approvals).
• Authenticate you, secure your account, and provide customer support.
• Manage your organization's subscription and comply with our legal obligations.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases: performance of a contract (to provide the Service to you and your employer); legitimate interests (to secure, maintain, and improve the Service); consent (for precise location access and push notifications, which you can withdraw at any time in your device settings); and legal obligation (where the law requires us to retain or disclose data). Where OrkaWork acts as a processor for your employer, the employer is responsible for the legal basis of its processing.

Location is central to attendance verification, so we want to be clear about it:

• We only access location after you grant the permission through your device's operating system.
• Precise location is captured at attendance events (clock-in, clock-out, break start/end) and, where your employer enables live attendance, while you are on an active shift.
• Location is used to confirm you are within an assigned work zone and to display on-duty staff to authorized managers on a live map — it is not used for advertising and is never sold.
• You can disable location access at any time in your device settings. Doing so may prevent you from clocking in or using location-dependent features, and your employer may require it as a condition of attendance tracking.

We do not sell your personal data. We share it only as follows:

With your employer / organization

OrkaWork is a team product. Your attendance records, working hours, location at attendance events, tasks, leave requests, payroll data, and messages are visible to authorized administrators and managers within your organization, according to their role and permissions.

With service providers

We use trusted infrastructure providers to run the Service. They process data only on our instructions:

• Amazon Web Services (AWS) — cloud hosting, authentication (Amazon Cognito), database, file storage (Amazon S3), and email delivery. Data is stored on AWS infrastructure.
• Google Firebase Cloud Messaging — delivery of push notifications to your device.
• Google Sign-In and Sign in with Apple — optional authentication if you choose to sign in with Google or Apple.

For legal reasons

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, and property of OrkaWork, our users, or the public.

Business transfers

If OrkaWork is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal data.

We retain personal data for as long as your account is active and as needed to provide the Service to your organization. Attendance, payroll, and working-hours records may be retained longer where your employer or applicable law requires it. When data is no longer needed, we delete or anonymize it. Because your employer controls its account data, retention of your work records is primarily determined by your employer’s policies.

We use technical and organizational measures to protect your data, including encryption in transit, access controls, and managed cloud infrastructure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to address vulnerabilities promptly.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Because your employer typically controls your work data, please direct these requests to your organization first; you may also contact us at info@orkawork.com and we will help route or fulfil your request. You have the right to lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA)

We do not sell or share your personal information for cross-context behavioral advertising. California residents may request access to or deletion of their personal information and will not be discriminated against for exercising these rights.

You can request deletion of your account and associated personal data by contacting us at info@orkawork.com or by asking your organization’s administrator. Some records may be retained where required for legal, payroll, or legitimate business purposes.

Your information may be processed and stored in countries other than your own, including on infrastructure operated by our service providers. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

The Service is intended for use by employees and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you within the app. Your continued use of the Service after changes take effect means you accept the updated policy.

If you have questions about this Privacy Policy or how your data is handled, contact us at: