Privacy Policy

Alfahr is a product of Alfa Systems LLC (“Alfa Systems”, “Alfahr”, “we”, “us”), registered at 30 N Gould St. Suite B, Sheridan, WY 82801, USA. Alfahr provides location-verified time and attendance software for employers and their crews. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It applies to:

• The Alfahr web application and admin portal, including this website.
• The Alfahr employee mobile app for iOS and Android (the “App”).
• The Alfahr API and any related support services.

Together these are the “Service”. By using the Service you acknowledge the practices described here.

Alfahr is a workplace tool. In most cases your employer (or the organization that invited you) creates the workspace, decides which locations and schedules to configure, and controls the timecard data collected about its workers. For that data your employer is the data controller and Alfahr is a data processor / service provider acting on its instructions.

If you are a worker and have questions about why your employer collects certain information, how long it is retained, or want to exercise rights over it, please contact your employer first. We will assist them in responding.

For information we collect directly for our own purposes — such as account sign-up details for workspace owners, billing, website analytics, and support correspondence — Alfahr is the controller.

Information you or your employer provide

• Account and profile details — name, email address, phone number, profile photo, employee number, job role, department, groups and tags, and your preferred time zone.
• Workspace details — organization name, work locations (addresses and geofence radii), work schedules, and organization settings.
• Time and attendance records — punches (clock in, clock out, breaks), timecards, edit and correction requests, time-off requests, approvals, and notes attached to any of these.
• Communications — messages you send us for support, and in-app notifications generated by the Service.

Location information

The core purpose of Alfahr is to verify where a punch happened. When you clock in, clock out, or start or end a break in the App, we capture a single GPS fix at that moment — latitude, longitude, and horizontal accuracy — and attach it to that punch. Your employer can see this location alongside the punch, including whether it fell inside a configured geofence and, for workers currently on the clock, a map of recent punch positions.

We do not track your location in the background or between punches. The App requests “while using” location permission only, and location is read solely at the moment you take a punch action. If you deny location permission you may still be able to punch, but your employer will see that the punch has no location evidence and may reject it according to their own policies.

Information collected automatically

• Device and app information — device model, operating system version, app version, and language, used for compatibility and troubleshooting.
• Log and usage data — IP address, request timestamps, pages or screens viewed, and error reports generated when something goes wrong.
• Cookies and similar technologies — in the web app we use strictly necessary cookies to keep you signed in and to secure your session. On our public website and sign-up pages we also use analytics and advertising cookies. Non-essential cookies are set only with your consent:
  • Product analytics (PostHog). Records which pages and screens you view, the buttons you use, the steps you complete during sign-up, your approximate location from your IP address (country and city), and your device and browser type.
  • Advertising measurement (Meta Pixel). Records that you visited our website or created an account after seeing or clicking one of our adverts on Facebook or Instagram, so that we can measure and improve our advertising.
  You can decline analytics and advertising cookies in the cookie banner, and you can change your choice at any time.
• Campaign information — if you arrive from an advert or a link, we record the campaign details carried in that link, such as the source, campaign name, advert identifier and click identifier, together with the page you landed on and the page that referred you. If you then create an account, we link this to your account so that we know which campaign brought you to us.

API usage

Workspace administrators may create API keys to integrate Alfahr with payroll or other systems. We record API key metadata (name, creation date, last-used time) and request logs (endpoint, timestamp, status) for security and rate limiting. We store only a hashed version of the key itself.

We use personal information to:

• Provide, operate, and maintain the Service.
• Record punches, verify them against configured locations, and compute timecards and hour totals across time zones.
• Let authorized administrators review, approve, correct, and export time and attendance data.
• Send transactional notifications such as invitations, approvals, and password resets.
• Authenticate users and protect against fraud, abuse, and unauthorized access.
• Provide customer support and respond to requests.
• Monitor performance, diagnose errors, and improve the Service.
• Measure how people find and sign up for Alfahr, and improve our website and advertising.
• Comply with legal obligations and enforce our terms.

We do not sell personal information. We never use punch locations, timecards or other workspace data for advertising or to build marketing profiles. Advertising measurement is limited to visits to our public website and the creation of an account.

Legal bases

Where the law requires a legal basis for processing, we rely on the following.

• Performance of a contract: to create accounts and workspaces, record and verify punches, build timecards, and provide support.
• Legitimate interests: to keep the Service secure, prevent fraud and abuse, diagnose errors, and improve the Service.
• Consent: for analytics and advertising cookies, and for marketing messages where consent is required. You can withdraw consent at any time.
• Legal obligation: to keep records and respond to lawful requests.

For worker data in a workspace, the employer decides the legal basis as the data controller.

We share personal information only in the following circumstances:

• With your employer / workspace. Timecards, punch locations, schedules, and profile details are visible to the administrators of the workspace you belong to. Workers can see their own records.
• With service providers that process data on our behalf under contract, including cloud hosting and database infrastructure, authentication, email delivery, mapping and geocoding services, product analytics (PostHog), and advertising measurement (Meta Platforms). Meta acts as an independent controller for some of the information its pixel collects and may combine it with other information it holds about you. Meta’s own privacy policy explains how it uses that information.
• Within Alfa Systems. Alfa Systems LLC has teams in more than one country. Staff may access personal information where they need it to provide support or operate the Service, under confidentiality obligations.
• Through integrations you enable. If a workspace administrator exports data or connects a third-party system via the API, that data is shared with the destination they choose.
• For legal reasons — to comply with applicable law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Alfahr, our users, or the public.
• In a business transfer such as a merger, acquisition, or sale of assets, in which case we will notify affected customers before their data becomes subject to a different privacy policy.

We keep personal information for as long as your workspace is active and as needed to provide the Service. Time and attendance records are typically retained for the duration of the customer relationship because employers are often required by wage-and-hour laws to keep them for several years.

When an employer deactivates a worker, the worker’s records remain in the workspace for the employer’s recordkeeping. When a workspace is deleted, or a customer requests deletion, we delete or anonymize its data within 90 days, except where we must retain it to comply with legal obligations, resolve disputes, or enforce agreements. Backups are purged on a rolling schedule.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, row-level access controls that scope every query to your workspace, hashed API keys and passwords, and least-privilege access for our staff. No system is perfectly secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at privacy@alfasystemscv.com.

Location permission

You can change the App’s location permission at any time in your device settings. On iOS, go to Settings → Privacy & Security → Location Services → Alfahr. On Android, go to Settings → Apps → Alfahr → Permissions. Disabling location will prevent location evidence from being attached to future punches.

Access, correction, and deletion

You can view and update your profile in the App or web app. Workers can request corrections to timecards through the built-in request flow, which routes to their employer for approval. To request access to, correction of, or deletion of other personal information, contact your employer (for workspace data) or us at privacy@alfasystemscv.com. We respond to requests within 30 days.

Account deletion

Workspace owners can delete their workspace from the admin portal or by contacting us. Anyone can request deletion of their own account and associated personal data — without signing in — from our account deletion page. Workers may also ask their employer to remove them from a workspace.

Regional rights

Depending on where you live you may have additional rights, such as the right to know what personal information we hold, to obtain a portable copy, to object to or restrict certain processing, to withdraw consent, or to lodge a complaint with a supervisory authority. Residents of California and other US states with comprehensive privacy laws may exercise their rights by emailing privacy@alfasystemscv.com or calling +1 307 222 1996. We will not discriminate against you for exercising these rights.

Kenya. If you are in Kenya, the Data Protection Act, 2019 gives you rights over your personal data, including the right to be informed of how it is used, to access it, to object to its processing, to have inaccurate data corrected, and to have data deleted where it is no longer needed. To exercise these rights over workspace data, contact your employer first. For data we hold for our own purposes, email privacy@alfasystemscv.com. You also have the right to complain to the Office of the Data Protection Commissioner.

The Service is intended for use in the workplace and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Alfa Systems LLC is a United States company. Our service providers store and process Alfahr data in the United States. If you use the Service from another country, including Kenya, your information will be transferred to and processed in that region, which may have different data protection laws from your own. Where the law requires it, we rely on appropriate safeguards, such as contractual commitments with our providers. Copies of these safeguards are available on request.

We may update this Privacy Policy from time to time. When we make material changes we will update the effective date above and notify workspace administrators by email or through the Service at least 30 days before the change takes effect. Continued use of the Service after changes take effect means you accept the revised policy.

Questions, requests, or concerns about this policy or our privacy practices can be sent to:

Alfa Systems LLC
Attn: Privacy
30 N Gould St. Suite B, Sheridan, WY 82801, USA
privacy@alfasystemscv.com
+1 307 222 1996