Privacy Policy

Welcome to Ankastra, an attendance and workforce management platform developed and operated by Ajinkya Technologies, a business unit of Kadle Global Private Limited ("Ankastra", "Company", "we", "our", or "us").

Ankastra is a multi-tenant Software-as-a-Service (SaaS) workforce management platform that is publicly available to businesses, organizations, institutions, and other entities that subscribe to our services. Any eligible organization may become a customer by subscribing to the Ankastra platform, after which it can independently create and manage its own administrators, employees, and workforce data.

We are committed to protecting the confidentiality, integrity, and security of the personal information entrusted to us by our customers, their employees, contractors, visitors, and other authorized users.

This Privacy Policy describes how we collect, use, process, store, disclose, transfer, and safeguard personal information when you:

Visit our website; Download or use the Ankastra mobile application (iOS or Android); Access or use our web platform or cloud services; Register for or are provisioned an account by your organization; Contact our support team; Participate in demonstrations, training sessions, or related activities; Use any current or future Ankastra product, service, or module described in Section 2.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, you should discontinue use of the Services.

This Privacy Policy applies to the following Ankastra products and services:

Ankastra Employee (mobile and web) Ankastra HR Ankastra Attendance Ankastra Payroll Ankastra Visitor Management Ankastra Asset Management Ankastra Mobile Applications (iOS and Android) Ankastra Web Portal APIs and Integrations Customer Support Services Official Website (www.ankastra.in)

Certain applications or modules may collect different categories of information depending on the functionality enabled by the subscribing organization. Where a feature is optional, associated information is collected only when that feature has been enabled by the organization or voluntarily used by the user.

"Account" means a registered profile used to access one or more Ankastra services. "Administrator" means an individual authorized by an organization to configure, manage, and administer Ankastra on behalf of that organization. "Company" means Ajinkya Technologies, a business unit of Kadle Global Private Limited. "Customer" means any organization, business, institution, or entity that subscribes to Ankastra services. "Employee" means an individual whose employer has subscribed to Ankastra and who accesses the platform using employer-provided credentials. "Personal Information" means any information that identifies, relates to, describes, or can reasonably be associated with an identified or identifiable individual. "Sensitive Personal Information" means biometric data, facial verification data, precise location information, authentication credentials, government-issued identifiers (where applicable), and other information classified as sensitive under applicable law. "Services" means all Ankastra products, software, applications, websites, APIs, and integrations described in Section 2. "User / You / Your" means any person who accesses or uses the Services.

The categories of information we collect depend on the services you use, your organization's configuration, your device permissions, and your interactions with the platform.

4.1 Information You Provide Directly

Personal Identification Information: Full name, email address, mobile number, employee code, employee ID, date of birth (where applicable), gender (optional, where permitted), profile photograph, signature (where applicable).

Employment Information: Organization name, department, designation, reporting manager, employment status, work location, shift assignment, attendance configuration, leave balances, payroll references, employment start/end date.

Business Information (for customer administrators): Company name, GST number (where applicable), business address, billing address, tax identification numbers, subscription details, authorized contact information.

Account Credentials: Username, email address, employee code, authentication credentials, encrypted password, security questions (where enabled), multi-factor authentication information (if enabled), session tokens. Passwords are never stored in plain text.

Communication Information: Support requests, service communications, chat messages, feedback, survey responses.

Payment Information: Billing contact details, invoice information, transaction identifiers. Payment card information is processed by authorized third-party payment providers and is not stored directly by Ankastra.

4.2 Information Collected Automatically

Device Information: Manufacturer, model, name, operating system and version, screen resolution, language and time zone settings, browser type/version, installed application version.

Network Information: IP address, network type, device identifiers, push notification token, session identifier.

Usage Information: Login/logout history, session duration, features accessed, error logs, crash reports, performance metrics, audit and security logs.

Cookies and Similar Technologies: Used on our website and web application to maintain secure sessions, remember preferences, measure performance, and support analytics where consent has been obtained. See Section 15.

4.3 Information Received from Third Parties

Your employer or subscribing organization and its authorized administrators. Identity verification providers. Cloud infrastructure and hosting providers. Customer support partners. Third-party integrations authorized by your organization (e.g. SSO providers).

All such information is processed only for legitimate business purposes and in accordance with applicable laws.

The Ankastra mobile application requests only the device permissions necessary to deliver attendance, identity-verification, and workforce-management functionality enabled by your organization. Each permission below corresponds to the runtime permission prompt (Android) or purpose string (iOS Info.plist usage description) shown to you before the feature is used.

Camera Requested for: employee attendance verification (face capture), profile photograph capture, visitor registration, QR/barcode scanning for attendance check-in, and document uploads for leave/expense claims. The camera is activated only when you perform an action that requires it and is never accessed in the background.

Photo Library / Media (iOS: Photos; Android: Media/Storage) Requested only when you choose to upload a profile photograph or attach a supporting document. The application accesses only the specific file you select and does not browse or collect other media on your device.

Location Services Requested only where your organization has enabled attendance geofencing or field-visit verification. Location is used exclusively for: attendance check-in/check-out verification, geofence confirmation, and site-visit confirmation. Ankastra does not use location for advertising, behavioral profiling, or unrelated tracking. Where background location is required for a specific enabled feature, this is disclosed separately and requires your explicit "Always Allow" permission grant, which you may revoke at any time in your device settings.

Notifications Used to deliver attendance reminders, leave approvals, shift schedules, payroll notifications, and security alerts. You may manage notification preferences through your device settings.

NFC / Bluetooth (where enabled) Used only where your organization has enabled NFC- or Bluetooth-based attendance check-in (e.g. tap-in readers). Not used for advertising beacons or unrelated device discovery.

Apple App Tracking Transparency (ATT): Ankastra does not track users across third-party apps or websites for advertising purposes, and the application does not use the iOS Identifier for Advertisers (IDFA). Accordingly, the App Tracking Transparency prompt is not triggered by Ankastra. If this changes in a future release, we will update this policy and request permission via the ATT framework before any such tracking occurs.

Google Play Data Safety: The data types, collection purposes, and sharing practices described in this policy correspond to the Data Safety section published on Ankastra's Google Play Store listing. In the event of any inconsistency, this Privacy Policy governs.

Certain Ankastra applications include facial verification for attendance where enabled by the subscribing organization. We treat facial information as Sensitive Personal Information and apply additional safeguards described below.

What We Collect A facial photograph captured through the device camera at the moment of check-in/check-out. A mathematical facial-verification template generated from that photograph, used solely to confirm identity. Verification result, timestamp, and (where enabled) associated device and location information.

On-Device vs. Server Processing Where technically supported, facial matching is performed on-device and only the verification result (match/no-match) is transmitted to Ankastra's servers. Where an organization has enabled cloud-based verification, the facial template is transmitted using encrypted channels and stored under the safeguards described in this section. Ankastra's use of device biometric sensors (e.g. Face ID/Touch ID-class hardware) is limited strictly to the attendance-verification purpose described here and is never used for advertising, profiling, or any purpose outside identity verification.

Alternative to Facial Verification Where an organization enables facial verification as a mode of attendance, it is responsible for providing employees with a non-biometric alternative (e.g. PIN, card, or manager-marked attendance) where required by applicable law. Employees who wish to use an alternative method should contact their organization's administrator.

Purpose of Collection Employee identity verification and attendance recording. Prevention of proxy (buddy) attendance. Workplace access and security management. Fraud prevention and compliance with organizational attendance policy.

Face-related information is never used for advertising, behavioral profiling, marketing, or any commercial purpose unrelated to attendance and workforce management.

Storage, Retention and Deletion Facial templates and images are encrypted in transit and, where implemented, at rest, and are subject to role-based access controls. Facial data is retained for the duration of the employee's active enrollment plus 90 days, or for the period required by the subscribing organization's applicable record-keeping obligations, whichever is longer, after which it is securely deleted or irreversibly anonymized. See Section 13 for full retention details.

Employees wishing to request correction or deletion of face-related information should contact their organization's administrator, or Ankastra directly at hello@ajinkyatechnologies.in where the organization has authorized direct employee requests.

Sharing We do not sell, rent, trade, or disclose face-related information to advertisers or unrelated third parties. It may only be shared with the subscribing organization, authorized Ankastra support personnel, infrastructure providers acting on our behalf under contract, or where required by law.

Where enabled by the subscribing organization, location information (GPS coordinates, geofence status, check-in location, field-visit location) is collected solely to support attendance verification and field-workforce confirmation. Location data is collected only when required by an enabled feature, permitted by your device settings, and consistent with applicable law. It is not used for unrelated tracking or commercial profiling, and is not shared with advertisers.

Certain Ankastra applications use QR codes, barcodes, or NFC tags to support attendance check-in, visitor management, and organization-issued asset identification. Information read through these technologies is processed solely for the operational purpose for which it was scanned and is not used for unrelated tracking.

Certain Ankastra services use AI, machine learning, or automated processing to support: attendance verification, document processing, workflow automation, report generation, fraud detection, and workforce insights.

Unless otherwise expressly disclosed to you, Ankastra does not make decisions that produce significant legal or employment effects (e.g. termination, disciplinary action) solely through automated processing without meaningful human review. Where required by applicable law, you may request information about automated processing affecting you by contacting hello@ajinkyatechnologies.in.

Provide and maintain the Services and authenticate users. Create and manage user accounts. Verify employee identity and record attendance. Manage payroll-related workflows and leave requests. Enable visitor management and asset allocation. Deliver notifications and respond to support requests. Improve application performance, security, and reliability. Detect fraud, maintain audit trails, and protect system security. Meet legal, regulatory, and contractual obligations.

Where required by applicable law, we rely on an appropriate legal basis such as your consent, performance of a contract, compliance with a legal obligation, or our legitimate business interests.

We do not sell, rent, trade, or otherwise disclose your personal information to third parties for their own independent marketing or commercial purposes. We may share personal information only as follows.

11.1 Within the Ankastra Group Shared internally among authorized personnel within Kadle Global Private Limited and its affiliated business units for customer support, product development, billing, compliance, and security monitoring, governed by confidentiality obligations.

11.2 Service Providers We engage third-party service providers for cloud hosting, data storage, email/SMS/push delivery, authentication, analytics, crash/error reporting, and payment processing. These providers are contractually bound to process personal information only on our instructions and to maintain appropriate security.

11.3 Customer Organizations Where Ankastra is provided through your employer, certain information (attendance, leave, employee profile, payroll workflow, organizational hierarchy) is made available to that organization's authorized administrators. The subscribing organization acts as the controller of this data; Ankastra acts as its service provider/processor.

11.4 Legal and Regulatory Requirements We may disclose personal information to comply with law, respond to lawful government or court requests, enforce our legal rights, investigate fraud or security incidents, or protect user safety.

11.5 Business Transactions Personal information may be transferred as part of a merger, acquisition, restructuring, or sale of assets, subject to confidentiality and legal obligations.

11.6 With Your Consent We may share personal information with third parties where you have provided explicit consent or instructed us to do so.

11.7 CCPA / CPRA — "Do Not Sell or Share" Ankastra does not sell or share personal information (as those terms are defined under the CCPA/CPRA) for cross-context behavioral advertising. Where a California resident's browser sends a Global Privacy Control (GPC) signal, we honor that signal as a valid opt-out request on our website. California residents may also submit requests to hello@ajinkyatechnologies.in.

We implement administrative, technical, physical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or loss, including:

Encryption of sensitive information in transit, and at rest where implemented. Secure authentication, role-based access controls, and multi-factor authentication where available. Security event logging, continuous monitoring, and intrusion detection. Secure API communications and regular vulnerability assessments. Secure software development lifecycle practices. Backup and disaster recovery procedures. Employee security training and confidentiality agreements.

No method of electronic transmission or storage is completely secure. You are responsible for safeguarding your login credentials and should promptly report any suspected unauthorized access.

We retain personal information only for as long as reasonably necessary to fulfil the purposes described in this Policy, comply with legal obligations, and support legitimate business operations. Except where a longer period is required by law or contract, the following default periods apply:

Account credentials — Duration of account + 30 days after deletion Attendance records (non-biometric) — Duration of employment + 7 years, or per applicable labor/tax law Facial verification data — Duration of active enrollment + 90 days Location logs (attendance-related) — 180 days, unless a longer period is set by the organization Payroll-related information — Duration of employment + 7 years, or per applicable tax law Visitor records — 12 months Support/communication records — 24 months Device, crash and security logs — 12 months

When personal information is no longer required, it is securely deleted, anonymized, or otherwise disposed of using methods designed to prevent unauthorized recovery.

Ankastra provides cloud-based services that may involve processing or storing personal information in jurisdictions outside your country of residence. Where personal information is transferred internationally, we implement appropriate safeguards, which may include standard contractual clauses, data processing agreements, and technical access controls.

Our website and web application use cookies to maintain secure sessions, remember preferences, measure performance, and support analytics where consent has been obtained.

Essential cookies — authentication, session management, security, fraud prevention (cannot be disabled). Functional cookies — language, interface, and theme preferences. Analytics cookies — used only with consent where required, to understand aggregate usage. Marketing cookies — not currently used; if introduced, will require prior consent and an updated notice.

You may manage cookie preferences through our cookie consent banner or your browser settings. Disabling certain cookies may affect website functionality.

16.1 Permission-to-Purpose Mapping Every runtime permission requested by the Ankastra mobile application is tied to a specific, enabled feature described in Sections 5–8 of this Policy, and is requested at the time that feature is first used, not at install time. No permission is requested for a purpose unrelated to attendance, workforce, or visitor management.

16.2 Minimum Age The Ankastra application is intended for use by individuals aged 18 years and older who are accessing the Services in a workplace or organizational capacity. It is not directed at children and is not listed in either platform's Kids category.

16.3 Third-Party SDKs Where the mobile application incorporates third-party SDKs for crash reporting, push notifications, or analytics, those SDKs are listed, together with their data-handling practices, in the app's Google Play Data Safety section and, where applicable, its Apple App Privacy "Nutrition Label." Those disclosures are incorporated into this Policy by reference and are kept current with each app update.

16.4 In-App Support and Deletion Access The mobile application provides an in-app path (Settings → Help & Support) to contact Ankastra support and to initiate an account or data-deletion request, in addition to the web-based mechanism described in Section 20.

Our Services may link to third-party websites or integrations not operated by Ankastra. We are not responsible for the privacy practices of those third parties. Where an integration is enabled by the subscribing organization, information exchanged through it is governed by that provider's own privacy policy.

Subject to applicable law and the nature of your relationship with us, you may have some or all of the following rights:

Right to Access — confirmation of whether we process your data, and a copy of it. Right to Rectification — correction of inaccurate or outdated data. Right to Erasure — deletion where no longer necessary, consent is withdrawn, or processing is unlawful. Right to Restrict Processing — during verification of a correction, objection, or legal claim. Right to Object — to processing based on our legitimate interests, where permitted. Right to Withdraw Consent — at any time, without affecting prior lawful processing. Right to Data Portability — a structured, machine-readable copy of your data, where applicable. Right to Lodge a Complaint — with us or your local supervisory authority.

Where your personal information is maintained by your employer, correction or deletion requests may need to be routed through your organization's administrator.

Depending on your location, you may have additional rights under:

India's Digital Personal Data Protection Act, 2023 (DPDP Act) EU General Data Protection Regulation (GDPR) UK General Data Protection Regulation (UK GDPR) California Consumer Privacy Act, as amended by the CPRA Singapore Personal Data Protection Act (PDPA) Other applicable national or regional privacy laws

Where required, we provide appropriate mechanisms for you to exercise these statutory rights, including the deletion mechanism described in Section 20.

Employee accounts are managed by their subscribing organization. Employees who wish to request deletion or correction of their personal information should contact their organization's administrator. Organizations may submit a company-level deletion request through the Company Deletion Request Form. Once verified, the organization's account and associated data will be deleted or anonymized within 30 days, except where retention is required by law.

Ankastra is designed for business, workplace, and organizational use and is not directed at children. The Services are not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children without appropriate authorization. If we become aware that a child's information has been collected in violation of applicable law, we will take reasonable steps to delete it promptly. A parent or guardian who believes a child has provided us information may contact hello@ajinkyatechnologies.in.

Certain features use automated technologies to assist with attendance verification, analytics, and reporting. Unless expressly disclosed, Ankastra does not make decisions producing significant legal or employment effects solely through automated processing without human involvement. Where required by law, you may request further information about automated processing affecting you.

Ankastra maintains appropriate backup and disaster recovery procedures to preserve the reliability, availability, and integrity of the Services. Backup data is protected with the same security controls described in Section 12 and retained only as long as reasonably necessary.

We may update this Privacy Policy to reflect changes in law, new products or services, security enhancements, or changes in our data practices. When we make material changes, we will publish the updated Policy, update the "Last Updated" date, and, where required by law, provide additional notice or obtain your consent before the change takes effect.

Where an organization terminates its subscription, personal information will continue to be processed only for purposes permitted under applicable law and contractual obligations, until applicable retention periods expire, after which it is securely deleted or anonymized.

Subscribing organizations are responsible for configuring and using the Services lawfully, including informing employees about Ankastra's use, obtaining legally required notices or consents (including biometric consent where applicable), configuring permissions appropriately, and responding to employee privacy requests where applicable.

Users are responsible for maintaining the confidentiality of their login credentials and using the Services in accordance with applicable laws and organizational policy. Users agree not to share credentials, attempt unauthorized access, misuse attendance or biometric features, or interfere with the security of the Services, and to promptly report suspected unauthorized access.

We rely on information provided by users and subscribing organizations. Users and organizations are encouraged to keep personal information accurate, complete, and up to date, and to correct inaccuracies promptly.

We strive to provide reliable, uninterrupted Services but do not guarantee availability at all times. Maintenance, upgrades, network failures, or events beyond our reasonable control may occasionally affect availability.

We collect only the personal information reasonably necessary to provide the Services, comply with legal obligations, maintain security, and improve our products. Where information is optional, users may choose whether to provide it unless required for a specific feature.

Privacy and security considerations are incorporated into the design, development, testing, deployment, and maintenance of the Ankastra platform, and are reviewed on an ongoing basis.

Ankastra maintains procedures to detect, investigate, respond to, and mitigate security incidents. Where required by law, affected organizations and relevant authorities will be notified of reportable incidents within applicable legal timeframes.

If ownership of Ankastra, Ajinkya Technologies, or Kadle Global Private Limited changes due to merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. Any successor will remain subject to obligations substantially consistent with this Policy unless users are otherwise notified as required by law.

This Privacy Policy is governed by and interpreted in accordance with the laws of the Republic of India. Nothing in this Policy limits any mandatory rights you may have under applicable local law.

If any provision of this Policy is found unlawful, invalid, or unenforceable, the remaining provisions continue in full force and effect.

Failure to enforce any provision of this Policy does not constitute a waiver of that or any other provision.

This Privacy Policy constitutes the complete privacy statement governing personal information collected in connection with the Ankastra Services described in Section 2, unless supplemented by a separate notice applicable to a specific service or jurisdiction (see Section 2 note regarding Manufacturing, Warehouse, and Inventory modules).

By accessing or using the Ankastra website, mobile applications, web application, or APIs, you acknowledge that you have read, understood, and agreed to this Privacy Policy. Where required by law, we will obtain your consent before processing personal information on that basis. If you do not agree, you should discontinue use of the Services.

If you have questions, concerns, requests, or complaints regarding this Privacy Policy or our privacy practices, please contact us:

Entity: Ankastra — Ajinkya Technologies, a Business Unit of Kadle Global Private Limited Registered Office: #429-B/1, Congress Road, Tilakwadi, Belagavi, Karnataka – 590006, India General Email: hello@ajinkyatechnologies.in Support Email: support@ankastra.in Privacy Requests: hello@ajinkyatechnologies.in Account Deletion: https://ankastra.in/privacy/delete-account Phone: +91 73494 16661 Website: https://ankastra.in

We will make reasonable efforts to acknowledge and respond to verified privacy-related requests within thirty (30) days, or within the period required by applicable law. We may ask you to verify your identity before processing a request to protect your personal information.