BLOCKED — MATERIAL FACTS UNKNOWN

Privacy Policy

How Roster handles workforce, account, application, and technical information.

Version
0.1 draft
Last updated
14 July 2026
Effective date
Not yet effective
Scope
Roster web and mobile

Status and operator

This draft describes the Roster web application and employee mobile application as observed in the source reviewed on 13 July 2026. It must not be treated as an effective privacy notice until the missing facts below are confirmed.

Roster is operated by INFINITY COURSEMATE PRIVATE LIMITED, a private limited company with its address at 311, Sector 32-A, Chandigarh 160030, India. The privacy contact is Kanwaljit Singh Jolly, Administrator, at admin@infinitysolutions.app or by post at 311, Sector 32-A, Chandigarh 160030, India.

Who this policy covers

Roster is a workforce scheduling, attendance, leave, employee-record, document, and resignation service used by customer organisations and their authorised administrators, managers, section masters, reporting managers, and employees.

Roster is intended to be offered worldwide to business customers and individual consumers. Privacy rights and operator obligations may differ by location; country-specific requirements and launch controls remain under review.

A customer organisation generally decides why employee information is entered into Roster and who may use it. The contractual allocation of controller, processor, Data Fiduciary, and Data Processor responsibilities must be confirmed in the customer agreement and data processing addendum.

Information handled

  • Account and authentication information, including email address, user ID, role, tenant membership, session information, and password-reset status.
  • Business application information, including organisation name and type, address, locations, contact details, employee count, current system, requested plan, and special requirements.
  • Employee identity and contact information, including employee code, name, email, phone, address, date of birth, gender, marital status, and religion where entered by an authorised customer user.
  • Employment and organisational information, including employer, store, section, designation, manager relationships, joining and exit dates, status, pay scale, and shift assignments.
  • Government, statutory, and financial identifiers, including Aadhaar, PAN, UAN, ESI, PF, bank account, and IFSC details where entered. These fields require strict access controls and minimisation.
  • Attendance and leave information, including clock times, work duration, status, attendance exceptions, late or early events, overtime, leave requests, balances, decisions, encashment, and policy transactions.
  • Employee documents and workflow content, including appointment letters, investment declarations or proofs, filenames, notes, resignation reasons, handover details, and decision notes.
  • Security and audit information, including audit events, old and new record values, user IDs, timestamps, IP address, and user agent where recorded.
  • Device-side information needed for the service, including browser storage and mobile authentication-session data. The audited mobile code did not implement GPS collection, despite a GPS attendance marketing claim.

Sources

Information may come from the individual, the customer organisation and its authorised users, attendance spreadsheets or workbooks uploaded by an administrator, documents uploaded by a user, and service-generated audit or calculation records.

Some employees may not provide their information directly because an employer or authorised administrator creates their profile and account.

Purposes

  • Provide and administer tenant accounts, role-based access, employee profiles, rosters, shifts, attendance, leave, encashment, documents, and resignation workflows.
  • Import, validate, calculate, display, and export workforce records and reports.
  • Send transactional messages about applications, credentials, leave, and related service events.
  • Maintain audit trails, investigate misuse, troubleshoot, protect the service, and comply with applicable legal requests.
  • Manage customer enquiries, plan applications, provisioning, support, and the customer relationship.

Rules-based processing and human review

Roster performs rules-based calculations for attendance, leave allocation, balances, overtime, and related reports. No artificial-intelligence or advertising profile system was found in the audited application. Roster calculations are decision-support outputs only. They must not be the sole basis for pay, discipline, dismissal, hiring, benefits, or a statutory filing. An authorised person must verify source records, applicable employment rules, calculation settings, and the proposed outcome before acting or filing.

Access and service providers

Information is made available to authorised users of the relevant customer organisation according to application roles and database rules. The audit found role-scope weaknesses that must be corrected before this statement can be considered a reliable description of least-privilege access.

The application uses Supabase for authentication, database, storage, and server functions in Mumbai, India, and Resend to deliver transactional email through an Amazon SES sending region in Tokyo, Japan. Hosting and deployment use GitHub Actions, GitHub Container Registry, Docker, nginx, and a Contabo VPS on a network registered in Germany. Contractual entities, data-processing terms, subprocessors, backup locations, and some operational retention settings still require procurement confirmation.

Resend states that account data, including email metadata, logs, and API records, is stored in the United States. Email content, recipient details, and delivery metadata may therefore be processed in Japan, the United States, and other documented subprocessor locations. Contract acceptance and tracking settings remain unverified.

Cookies and local storage

Roster uses authentication cookies required to maintain Supabase sessions. The web application also stores some attendance-upload rows, exceptions, allocation metadata, and report state in the browser's local storage. The mobile app stores authentication sessions in device storage. See the Cookies & Local Storage Notice for details and remediation items.

No advertising or analytics SDK was found in the audited current web or mobile application. Operational practices and deployed network behaviour still require confirmation.

Retention, deletion, and backups

The application contains soft-delete fields and some manual deletion functions, but no complete retention or privacy-request workflow was found. The approved default schedule retains active customer workforce data only for the service term and exit process; unsuccessful sales or account applications for 12 months after closure; support, privacy-request, cancellation, refund, and deletion-proof records for three years after closure; and security and ICT logs for a rolling 180 days where the CERT-In direction applies. Contracts, invoices, tax records, books of account, and supporting vouchers are retained for eight financial years, or longer where a proceeding, investigation, legal hold, or applicable law requires it. A legal hold pauses only the affected deletion and must record its owner, basis, scope, start, review date, and release. Browser attendance caches must clear on logout and tenant change and expire within 30 days; mobile sessions remain only until logout, revocation, or token expiry. These schedules are approved policy targets, but the required automated jobs, case register, legal-hold register, cache expiry, and deletion evidence are not yet implemented. Under the approved rule, unless a documented legal hold or law requires retention, active production customer data must be permanently deleted within 30 days after the export window ends and no later than 60 days after effective cancellation or termination. The approved target allows deleted customer data to remain in encrypted, access-restricted disaster-recovery backups for no more than 90 days after production deletion. Backups must expire automatically, must not be used for normal service access, and any restored deletion must be reapplied. Current provider settings, encryption, expiry, and restore controls have not been verified or configured by this policy update.

Deleting an account may not immediately remove records that a customer must retain for employment, security, dispute, tax, or other legal purposes. The responsible organisation must identify the applicable rule and communicate the retained categories and duration.

Individual requests

Depending on applicable law and the customer relationship, an individual may ask to access, correct, update, erase, or receive information, withdraw a consent where processing relies on consent, or raise a grievance. Employees should first contact their organisation administrator for employer-controlled records.

Requests to the Roster operator must be sent through Kanwaljit Singh Jolly, Administrator, at admin@infinitysolutions.app or by post at 311, Sector 32-A, Chandigarh 160030, India. Identity and authority are verified before information is released or deleted. If a requester cannot sign in, the approved fallback is a code sent to the registered email plus an account, tenant, order, or invoice reference and manual approval by the privacy contact. If the registered email is inaccessible, no data is released until the privacy contact verifies authority using at least two independent records already held by the operator or customer; government identity documents must not be collected unless strictly necessary. This fallback is a policy target and is not yet implemented. The operator records the request, decision, completion, any retained categories, and an escalation or appeal to the same privacy contact.

Security and incidents

Roster uses hosted authentication, private document storage, signed document URLs, and role-based database controls in parts of the application. The audit also identified critical authorisation and service-function defects, broad mobile permissions, browser retention of attendance data, and other weaknesses. These must be remediated; this draft does not claim that the service meets a certification or security standard.

Where an incident affects customer or employee information, the operator and customer will need to follow the incident-response, notification, and cooperation duties that apply to their roles. The responsible contacts and procedure are not yet confirmed.

Children

Roster is designed for workforce administration, not for use by children as a consumer service. A person must be at least 18 to open, purchase, or independently administer a Roster account. Until a written minor-worker workflow, lawful-basis review, required guardian process, and country-specific safeguards are implemented, customers must not create Roster records for workers under 18.

Changes and contact

Material changes should be dated, versioned, and communicated through an approved notice process. Historical policy versions and acceptance evidence are not currently implemented.

Questions or grievances: Kanwaljit Singh Jolly, Administrator, at admin@infinitysolutions.app or by post at 311, Sector 32-A, Chandigarh 160030, India. Postal contact: INFINITY COURSEMATE PRIVATE LIMITED, a private limited company with its address at 311, Sector 32-A, Chandigarh 160030, India.