Privacy Policy
Last updated: July 24, 2026. This policy describes how ClockAll (“we”) handles personal information. Please have it reviewed by your own counsel for your jurisdiction before relying on it.
What we collect
- Account & employee data — names, email, role, location, pay rate, and work schedule you enter to run your workforce.
- Time & location data — clock-in/out times and, where you enable it, GPS coordinates at punch time for geofencing.
- Biometric data — when face verification is enabled, we store an encrypted mathematical face embedding, never a raw photo or image of your face.
- Usage & device data — basic logs needed to operate and secure the service.
How we use it
We use this data solely to provide workforce management — recording time, scheduling, payroll export, and compliance — and to secure and support the service. We do not sell personal information.
Biometric privacy (BIPA / CCPA)
Face verification is optional and is enabled per-employer; an employee may always decline and clock in with a PIN or at a kiosk instead. Where it is used, we collect a biometric identifier — an encrypted mathematical face embedding, never a raw photo or image of your face — only after clear written notice and the employee’s affirmative written consent, and we use it solely to verify the employee’s identity at clock-in and clock-out.
We never sell, lease, trade, or otherwise profit from biometric data, and we never disclose it to any other company or third party except as required by law or with the individual’s consent. Under our written retention and destruction policy, a face embedding is permanently destroyed within 30 days after the employment relationship ends, or within 3 years of the individual’s last interaction with the service, whichever occurs first — and sooner on request. An employee may withdraw consent and have their faceprint deleted at any time.
Sharing
We share data only with sub-processors needed to run the service (hosting, payments) under contract, and when required by law. Payroll exports go only where your administrator directs them.
Your rights
Depending on your location, you may have rights to access, correct, or delete your personal information, and to withdraw consent. Contact privacy@clockall.com.
Security & retention
Data is encrypted in transit and at rest, access is role-restricted, and sensitive actions are audit-logged. We retain records only as long as needed to provide the service and meet legal obligations.