Current product behaviour
Roster accounts are created and managed by customer administrators; the audited web and mobile applications do not let a user create an account directly. No self-service account-deletion or complete privacy-request workflow was found.
Request route
Employees should first ask their organisation administrator to correct or remove employer-controlled information and to disable their access when appropriate.
A request to the Roster operator may be sent to Kanwaljit Singh Jolly, Administrator, at admin@infinitysolutions.app or by post at 311, Sector 32-A, Chandigarh 160030, India. The request-handling workflow and response procedure must still be operationally tested.
What a complete request must address
- The authentication account and active sessions.
- Tenant membership and employee-profile linkage.
- Attendance, leave, encashment, schedule, document, resignation, audit, and related records.
- Uploaded objects, exports, browser caches, mobile sessions, logs, backups, and vendor-held email records.
- Records retained by the customer organisation or operator for a documented legal, security, fraud, dispute, or employment purpose.
Verification and timing
For an active account, the requester must sign in and enter a one-time code sent to the registered email. An organisation-wide export also requires approval by an authorised administrator. The customer and operator must coordinate where each controls different records. If a requester cannot sign in, the approved fallback is a code sent to the registered email plus an account, tenant, order, or invoice reference and manual approval by the privacy contact. If the registered email is inaccessible, no data is released until the privacy contact verifies authority using at least two independent records already held by the operator or customer; government identity documents must not be collected unless strictly necessary. This fallback is a policy target and is not yet implemented.
A terminated customer has 30 days after the effective cancellation or termination date to request and download an available customer-data export.
The approved export target is a ZIP archive containing CSV files for structured customer data and copies of uploaded documents in their original or otherwise available formats. An active-account requester must sign in and enter a one-time code sent to the registered email; an organisation-wide export also requires approval by an authorised administrator. After verification, the ZIP must be delivered through a one-time download link that expires seven days after issue and must not be sent as an email attachment. The fallback for a requester who cannot sign in, export generator, verification workflow, and one-time-link delivery have not been implemented by this policy update.
Under the approved rule, unless a documented legal hold or law requires retention, active production customer data must be permanently deleted within 30 days after the export window ends and no later than 60 days after effective cancellation or termination.
The approved target allows deleted customer data to remain in encrypted, access-restricted disaster-recovery backups for no more than 90 days after production deletion. Backups must expire automatically, must not be used for normal service access, and any restored deletion must be reapplied. Current provider settings, encryption, expiry, and restore controls have not been verified or configured by this policy update.
The approved default schedule retains active customer workforce data only for the service term and exit process; unsuccessful sales or account applications for 12 months after closure; support, privacy-request, cancellation, refund, and deletion-proof records for three years after closure; and security and ICT logs for a rolling 180 days where the CERT-In direction applies. Contracts, invoices, tax records, books of account, and supporting vouchers are retained for eight financial years, or longer where a proceeding, investigation, legal hold, or applicable law requires it. A legal hold pauses only the affected deletion and must record its owner, basis, scope, start, review date, and release. Browser attendance caches must clear on logout and tenant change and expire within 30 days; mobile sessions remain only until logout, revocation, or token expiry. These schedules are approved policy targets, but the required automated jobs, case register, legal-hold register, cache expiry, and deletion evidence are not yet implemented.
The monitored intake is admin@infinitysolutions.app and the Administrator owns request decisions, legal-hold approvals, completion records, confirmations, and appeals. The intake case register, runbook, automated deletion, vendor instruction, backup expiry, and evidence workflow remain unimplemented.
App-store disclosure
Google Play and Apple require account-deletion capabilities when an app supports account creation. Because Roster currently uses administrator-provisioned accounts, exact applicability depends on the submitted store flow and listing. This page still requires a functioning request channel before it can be supplied as a privacy-choice or deletion URL.