Privacy Policy

Last updated: 14 July 2026  ·  Effective immediately

1. Who We Are

ZARSys ("we", "us", "our") operates the ZARSys mobile app and platform available at zarsys.io. ZARSys is a B2B SaaS platform — access is granted exclusively through an organisation invitation.

Contact: support@zarsys.io

2. What Data We Collect

We collect the following categories of information:

• Account data: Full name, work email address, role, department, job title — provided by your organisation administrator when provisioning your account.
• Authentication data: Encrypted password hash (bcrypt). We never store plain-text passwords.
• Attendance & status data: Check-in/check-out timestamps, work status (online, offline, break), working hours — used to power attendance reports.
• Task & project data: Tasks you create, assign, complete, or comment on within projects your organisation manages.
• Communications: Messages sent within the Team Orbit in-app messaging system. Messages are stored on our server and visible to members of your organisation.
• Device & push notification tokens: Expo push notification tokens to deliver alerts from your organisation (task assignments, broadcasts, reminders). We do not track your device for advertising.
• Profile photo: If you choose to upload one, stored on our secure server.
• Usage logs: Server-side request logs (IP address, endpoint, timestamp) for security and abuse prevention. Retained for 30 days.

3. What We Do NOT Collect

• We do not use advertising identifiers (IDFA / GAID).
• We do not track your location.
• We do not access your contacts, call logs, or SMS.
• We do not sell, rent, or trade your data to any third party.
• We do not use third-party analytics SDKs (no Firebase Analytics, no Mixpanel).

4. How We Use Your Data

• Authenticating your identity and maintaining your session.
• Displaying your profile, tasks, attendance records, and reports within your organisation's workspace.
• Delivering push notifications you or your organisation has configured.
• Generating workforce analytics and reports visible only to authorised administrators in your organisation.
• Securing the platform against unauthorised access (IP whitelisting, audit logs).

5. Data Storage & Security

All data is stored on a dedicated, private Virtual Private Server (VPS) hosted via Hostinger in a secure data centre. Data is:

• Transmitted exclusively over HTTPS/TLS 1.2+ (SSL certificate via Let's Encrypt).
• Stored in a PostgreSQL database accessible only from within the server environment.
• Protected by UFW firewall rules and IP whitelisting.
• Passwords are hashed using bcrypt with salt — unrecoverable even by us.

6. Data Retention

• Your account data is retained while your organisation's subscription is active.
• When an account is deleted, data is permanently removed within 30 days.
• Server logs are purged after 30 days.
• Organisations may request full data deletion by emailing support@zarsys.io.

7. Sharing & Disclosure

We do not share personal data with third parties except:

• Expo (Expo.dev): Push notification delivery infrastructure. Expo receives push tokens to route notifications. No personal profile data is shared. See Expo Privacy Policy.
• Nodemailer / Hostinger SMTP: Email delivery for invitation and reset emails. Only your email address and name are passed for this purpose.
• Legal requirement: If required by applicable law or valid legal process.

8. Your Rights (GDPR)

If you are in the UK or EEA, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (via your profile settings or by contacting us).
• Delete your data (right to erasure) — contact your organisation administrator or email us.
• Object to processing or request restriction.
• Portability — request an export of your data.

To exercise any of these rights, contact us at support@zarsys.io. We will respond within 30 days.

9. Children's Privacy

ZARSys is an enterprise B2B platform intended exclusively for adults in a professional workplace context. We do not knowingly collect data from anyone under the age of 16. If we become aware of such data, we will delete it immediately.

10. Camera & Photos

The ZARSys app requests access to your camera and photo library only when you choose to upload or change your profile picture. Images are uploaded to our server and displayed within your organisation's workspace. We do not access your camera or photos for any other purpose.

11. Push Notifications

We use Expo push notifications to deliver alerts including task assignments, team broadcasts, and reminders. You can disable notifications at any time in your device settings. Disabling notifications does not affect your ability to use the app.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify organisation administrators of material changes via the platform or email. Continued use of ZARSys after changes constitutes acceptance of the updated policy.

13. Contact Us

For any privacy questions or requests:

• Email: support@zarsys.io
• Web: https://zarsys.io