Privacy
Last updated 6 September 2026.
This explains what Hudoori collects about an employee, what it deliberately does not collect, where it is processed and for how long. It is written for the person whose attendance is being recorded as much as for the company recording it.
Who is responsible for what
The employing company is the controller. It decides that attendance is recorded, which workplaces exist, which verification methods are used and who can see the result.
Hudoori is the processor. We hold and process the data on that company's instruction and for no other purpose. We do not sell it, we do not share it with anyone outside the sub-processors listed below, and we do not use it to train machine-learning models.
If you are an employee and want your record corrected or erased, the request goes to your employer, who is the controller. We will help them act on it.
What is collected
At the moment an employee taps check in or check out, and only at that moment:
- the GPS coordinates their phone reports, and the accuracy figure that comes with them
- the public IP address the request arrived from
- the workplace code they scanned, where the company uses one
- which device sent it, from the identity bound to that employee
- the timestamp the phone claims, kept only so a skewed clock can be flagged
The time the day is actually recorded at is our server's clock, never the phone's.
Held for the account generally:
- the employee's name, phone number, employee code and workplace
- their Telegram account identifier and username, so the bot knows who is writing
- for managers and HR, an email address and a password we store only as a hash
- every request, approval and correction, with who made it and when
What is not collected
There is no continuous location. Nothing about an employee's whereabouts is read, stored or transmitted between the moments they tap. There is no background collection, no tracking while they work, and nothing that runs when the app is closed.
This is not a promise in a document. It is how the product is built: the location call happens inside the action the employee takes, and there is no code anywhere that asks for a position at any other time.
Why, and on what basis
The attendance record is processed on the basis of contractual necessity — it is how the employing company records the days it pays for.
The verification signals — location, network, workplace code — are processed on the basis of the employing company's legitimate interest in an attendance record that can be relied on. That basis requires the controller to hold a written assessment weighing that interest against the employee's rights. We provide the material for it; keeping it is the company's obligation.
Where it is processed
Hudoori runs on Amazon Web Services in Frankfurt, Germany (eu-central-1). Personal data of employees in Egypt is therefore processed outside Egypt.
Egypt's Personal Data Protection Law 151/2020 governs that transfer. Hudoori commits to the safeguards it can give directly: the data is encrypted in transit and at rest, access is limited to the operators who run the service, every access is logged, and no data is transferred to any party other than the sub-processors below. Companies with specific requirements about where their data sits should raise them before subscribing, and we will tell them plainly what we can and cannot offer today.
Sub-processors
| Who | What they process | Where |
|---|---|---|
| Amazon Web Services | all application data and backups | Frankfurt, Germany |
| Telegram | the employee's Telegram identity, and the text of bot messages | Telegram's own infrastructure |
| Our email provider | the address and content of emails we send you | as stated by that provider |
About Telegram specifically: employees check in through a Telegram Mini App, so their Telegram account identity and the messages the bot sends and receives pass through Telegram's systems and are subject to Telegram's own privacy terms, which we do not control. Attendance data itself — the events, the evidence, the scores — is never sent to Telegram. What passes through it is the message, not the record.
We will tell you before we add a sub-processor.
How long it is kept
Attendance events are append-only and are kept for as long as the employing company's account exists.
A check-in that did not go through keeps its record, not its location. After 90 days its coordinates, accuracy, network and connection details are removed. What stays is that a check-in was attempted, when, and that it was refused — it supports no attendance claim, so there is no reason to keep where the phone was.
When that account is closed, the company has 90 days to export its record. After that window, everything held for that company — attendance events, derived days, devices, employee records — is erased automatically. The erasure is recorded and it is not reversible.
This is enforced by a job that runs on a schedule, not by somebody remembering to run it.
The employee's rights
An employee can see their own attendance record in the product at any time, including every event recorded about them and the evidence behind each one. That is deliberate: a record used to decide what somebody is paid should be visible to them without their having to ask.
Rights of access, correction, objection and erasure are exercised against the employing company, which is the controller. We support the company in answering them.
A correction never deletes anything. It is a new entry that names who made it and supersedes the old one, and both stay on the record. An employee asking for a day to be corrected gets a corrected record, not a rewritten one — which protects them as much as it protects the company.
Security
- Everything travels over HTTPS; the database is not reachable from the internet.
- Each company's data is isolated at the database level, enforced by the database itself rather than by application code remembering to filter.
- Passwords are stored as hashes and are checked against known breached passwords.
- A device is bound to one employee, and a check-in from an unbound or mismatched device is refused.
- Backups run nightly and restoring from them has been tested rather than assumed.
- Every state change is recorded with who made it, when, from which device, and why.
If something goes wrong
If personal data is exposed, we will tell the affected company without undue delay and tell them what was exposed — not that "an incident occurred". The company, as controller, decides what its employees are told and notifies the authority where the law requires it.
Reaching us
Contact details for privacy requests are published on the site and kept current there.