Privacy Policy

1. Who is responsible for your data

Under the DPDP Act, the "Data Fiduciary" - the entity that decides why and how your personal data is processed - is:

Businesses that hire you through Cloxy are independent data fiduciaries for the records they keep about your work with them (for example, their own attendance registers). This policy covers what Cloxy does; the Business Terms require businesses to handle any worker data they receive lawfully.

2. What this policy covers

• Cloxy Talent - the mobile app for workers.
• Cloxy Business - the mobile app for businesses that post shifts.
• cloxy.co - this website, including the early-access and contact forms.
• Support conversations and grievances you raise with us through any channel.

It does not cover third-party websites or services we link to, or the internal record-keeping of businesses you work for.

3. Information you provide to us

3A. Worker (talent) accounts

3B. Business accounts

3C. Identity and verification documents

To keep the marketplace verified, we ask workers (and, where required, businesses) to upload government-issued identity documents. For each document type our verification team has configured, we collect the front image, the back image where the document has one, the document number, and the expiry date where the document has one. See the Verification Policy for how review works.

Document images are treated as sensitive: they are stored in private cloud storage in India, are never publicly accessible, and are permanently deleted from storage when your account is deleted.

3D. Payment and payout details

If and when you set up payments or payouts on Cloxy (see the Payment Policy for the current status of platform payments):

• Workers provide payout details: PAN, bank account holder name, bank account number and IFSC code, or a UPI ID. We share these with our payment provider, Razorpay, to create your payout account. Your full bank account number is held by us only temporarily during setup and is replaced with a masked version once Razorpay setup succeeds.
• Businesses register a payment method through Razorpay: a card or a UPI AutoPay mandate. We store only tokenized references - for cards, the last four digits, network, issuer, and expiry month/year; for UPI, the UPI ID and mandate details. We never store full card numbers.

3E. Content you create on the platform

• Chat - messages and images you send through in-app chat between workers and businesses.
• Ratings and reviews - the Yes/Maybe/No ratings and optional comments that businesses, workers, and co-workers leave after shifts.
• Shift activity - applications, offers, hires, cancellations with reasons, and any violation records connected to your account (see the Cancellation & No-Show Policy).
• Support - pay disputes, feedback, and grievance messages you send us.

3F. Website forms

If you join the early-access waitlist or use the contact form on cloxy.co, we collect the details you enter - typically your name, phone number, email, city or PIN code, and your message or preferences.

4. Information collected automatically

5. Location data

Location is central to a shift marketplace, so we want to be precise about what we do and do not collect:

• At clock-in and clock-out, the Talent app takes a single GPS reading to verify you are at the shift location (within a 100-metre radius for GPS shifts). This happens only while you are using the app, at the moment you clock in or out.
• Your saved addresses (worker home address, business address) are stored with their geographic coordinates for distance and matching features.
• QR clock-ins verify attendance by scanning the business's rotating QR code. If your device also supplies a GPS reading during a QR clock-in, we store it as part of the attendance record.

6. Attendance and clock records

Every clock attempt - successful or failed - creates a record containing: the timestamp, clock method (GPS or QR), your coordinates and distance from the venue where provided, the reason a failed attempt failed, the scanned QR token for QR clock-ins, and basic device information. These records exist to make attendance and pay disputes resolvable with evidence.

Cloxy staff can correct clock times (for example, when a device fails at the venue) or record a clock event on a worker's behalf at a business's request. Every such staff action is logged with who performed it, and both the worker and the business are notified in the app.

7. How we use your information

• Operate the marketplace: create accounts, show shifts near workers, process applications, offers, and hires.
• Verify identity and keep the platform trusted (account approval and document review).
• Verify attendance and calculate hours worked and pay.
• Process payments and payouts through our payment provider, when platform payments are enabled.
• Enable in-app chat, ratings, and notifications.
• Detect and prevent fraud, spam, location spoofing, and abuse.
• Provide support, resolve pay disputes, and handle grievances.
• Understand how the product is used and fix crashes and errors.
• Send service messages, and - with your consent - marketing communications.
• Comply with law, including tax, accounting, and lawful government requests.

8. Legal bases under the DPDP Act

We process personal data on the basis of your consent, given when you create an account and accept this policy, and for the legitimate uses recognised by Section 7 of the DPDP Act - including processing you have voluntarily initiated (such as applying to a shift), compliance with law and court orders, and responding to medical emergencies. You may withdraw consent at any time (Section 15 of this policy); the apps will then no longer be able to provide services that depend on that data.

9. Automated processing, AI, and profiling

We believe you should know exactly which decisions on Cloxy are automated. Today, Cloxy uses no machine-learning models, no AI scoring, and no behavioural profiling. The automation that does exist is simple, deterministic rules:

• No-show detection - if a hired worker never clocks in and the shift has ended, the system automatically marks the shift as a no-show and records a violation.
• Offer expiry - pending offers and applications that are not acted on in time expire automatically.
• Document expiry - verification documents past their expiry date are automatically flagged for re-verification.
• Auto-offer - on shifts where a business enabled auto-fill, a worker the business has marked as a favourite is automatically offered the shift when they apply.
• Pro badge - computed from your record: 50 or more completed shifts with at least 80% positive ratings.
• Payment automation - when platform payments are enabled, charging the business and transferring the worker's pay after clock-out happens automatically.

Decisions with significant effect - approving or rejecting verification, and suspending or terminating accounts - are made by trained Cloxy staff, not by automation, and are logged. If we ever introduce AI-assisted processing that affects you, we will update this policy first and tell you what changed.

10. Who we share data with

10A. With other users of the marketplace

• When a worker applies to a shift, the business sees the worker's profile: name, photo, ratings, completed shift count, relevant experience, and approximate distance.
• When a worker is hired, the business sees the worker's attendance for that shift, and the worker sees the business's name, venue address, and shift contact details.
• Ratings and review comments are visible to the other party and inform future matching.

10B. With service providers (data processors)

These providers process data on our instructions, under contract, and only for the purposes listed:

10C. For legal reasons

We disclose data when required by law: to law-enforcement agencies and courts on valid legal process, to government authorities exercising statutory powers, or where disclosure is necessary to prevent harm, fraud, or threats to safety. Section 17 of this policy explains how we handle government requests.

11. Where your data lives (cross-border processing)

Our primary databases and file storage run in India (the AWS Asia Pacific - Mumbai region). Some of our processors listed in Section 10B - such as Microsoft Clarity, Sentry, AppsFlyer, and Google Firebase - process data on infrastructure that may be located outside India.

The DPDP Act permits transferring personal data outside India except to countries restricted by the Central Government. We transfer data only to processors bound by contractual safeguards, and we will comply with any government restriction or data-localisation requirement notified in the future. If such a requirement affects how we operate, we will update this policy.

12. Cookies, local storage, and tracking technologies

Our website uses strictly necessary storage (like your cookie-consent choice) and, only with your consent, Microsoft Clarity analytics. The Cookie Policy lists every cookie with its purpose and lifetime, and you can change your choice anytime via "Manage cookie preferences" in the footer.

The mobile apps do not use cookies but use equivalent technologies: device identifiers for push notifications and attribution (Firebase, AppsFlyer) and locally stored session tokens, which are kept in encrypted storage on your device.

13. Device permissions

Every permission is optional at the operating-system level, but some features cannot work without them - for example, you cannot clock in to a GPS shift without granting location while using the app.

14. Notifications and marketing

• Service messages - OTPs by SMS, and push notifications about your shifts, applications, payments, and account. These are part of operating the service.
• Marketing - we send marketing communications only where permitted and with an opt-out. You can turn off push notifications in your device settings at any time; service-critical information remains visible inside the app.

15. How we protect your data

• Encryption in transit - all traffic between the apps, the website, and our servers uses HTTPS/TLS. Data is encrypted at rest by our cloud infrastructure providers.
• Authentication - OTP-based login with rate limiting, short-lived access tokens with refresh-token rotation, and server-side token revocation on logout and account deletion.
• Attendance integrity - QR clock-in codes rotate every 30 seconds and repeated failed scans are rate-limited.
• Storage controls - identity documents and photos live in private buckets; files are served only through signed, expiring URLs.
• Access controls - Cloxy staff access is role-based, limited to what their job requires, and sensitive admin actions are recorded in an audit log.
• Device protection - session tokens in the apps are kept in the operating system's encrypted storage.

No system is perfectly secure. We ask you to protect your account too: keep your phone number current, never share OTPs, and contact us immediately if you suspect unauthorised access.

16. Vendor management and incident response

Before we add a service provider that touches personal data, we review what data it needs, where it processes that data, and its security posture, and we bind it contractually to process data only on our instructions. The processor list in Section 10B is kept current - adding a provider means updating this policy.

If a personal data breach occurs, we will follow our incident-response process: contain the incident, assess impact, and notify the Data Protection Board of India and each affected user in the form and timelines required by the DPDP Act and its rules. We keep records of incidents and remediation.

17. How long we keep data

We keep personal data while your account is active and for defined periods afterwards, based on legal obligations and the limitation periods for claims. The full schedule - category by category, with the reasons - is in the Data Retention Policy. In brief:

• Account and profile data: life of the account; an archived snapshot is kept up to 3 years after deletion for fraud prevention and legal claims, then purged.
• Payment and payout records: 8 years, as required by Indian company and tax law.
• Attendance and clock records: up to 24 months, or as long as needed to substantiate pay.
• Identity document files: deleted from storage when your account is deleted.
• Chat messages: up to 6 months after account deletion.

18. Your rights

As a Data Principal under the DPDP Act, you have the right to:

• Access - obtain a summary of the personal data we hold about you and the processing activities and processors involved.
• Correction and completion - have inaccurate or incomplete data corrected. Most profile fields can be edited directly in the apps.
• Erasure - delete your account and personal data. Account deletion is available in the app settings (Section 19 explains the process); we retain only what law requires, per the retention schedule.
• Grievance redressal - a readily available way to complain, described in Section 19.
• Nominate - name a person who may exercise your rights if you die or are incapacitated.
• Withdraw consent - as easily as you gave it. Withdrawing consent for processing that the service needs means we can no longer provide that part of the service.

To exercise access, correction, nomination, or consent-withdrawal requests that the apps do not yet support directly, email cloxysupport@gmail.com from your registered email or phone. We verify identity before acting on requests and respond within the timelines in Section 19.

19. Deleting your account, and complaints

19A. Account deletion

You can delete your account from the app settings; deletion is confirmed with an OTP. On deletion we immediately anonymise your live profile, withdraw your pending applications, cancel your upcoming shifts, and permanently remove your photos and identity document files from storage. Deletion is blocked only while you are clocked in to a running shift. The Data Retention Policy describes what is archived, for how long, and why.

19B. Grievance Officer and complaints

If you are not satisfied with our response, you may escalate a personal-data grievance to the Data Protection Board of India under the DPDP Act. Consumer disputes may also be raised with the consumer commissions under the Consumer Protection Act, 2019.

20. Government and law-enforcement requests

We review every government or law-enforcement request for user data for legal validity, scope, and proper authority before responding, and we disclose only the data the request lawfully covers. Where the law allows, we will notify you of a request concerning your data. We may be legally prohibited from notifying you in some cases.

21. If Cloxy is reorganised or acquired

If we are involved in a merger, acquisition, financing, corporate restructuring, or sale of assets, personal data may be transferred as part of that transaction. Any successor must honour this policy or give you notice and a choice before using your data differently. We will inform you of such a transfer through the apps or website.

22. Children

Cloxy is for adults. You must be at least 18 years old to create an account, and we do not knowingly process the personal data of anyone under 18. If you believe a minor has created an account, tell us and we will delete it.

23. Users outside India

Cloxy is built for shift work in India and this policy is written under Indian law. If you access our website from outside India, your data will be processed in India as described here. The apps and marketplace are available only for work performed in India.

24. Changes to this policy

When we change this policy, we update the version number, the "last updated" date, and the version history on this page. For material changes - new data categories, new processors, or new purposes - we notify you in the apps and, where the change needs it, ask you to accept the updated policy before continuing. The apps record which policy version you accepted.