Privacy Policy

At Cloxy, your privacy matters. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have. This policy applies to all users of the Cloxy platform, including our mobile applications and website.

By using the Platform, you consent to the collection, use, and processing of your data as described in this policy, in accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023 (“DPDPA”). We have proactively adopted DPDPA compliance ahead of its full enforcement timeline.

1. Information We Collect

A. Information You Provide

B. Information Collected Automatically

C. Location Data

We collect precise geolocation data only in the following specific scenarios, and only with your explicit permission:

• GPS Clock-In/Out: When you clock in or out of a shift using the GPS method, we verify your location against the shift location. This is a point-in-time check. We do not track your location continuously.
• Shift Distance: To show you how far a shift is from your current location, we use your location at the time of browsing. This data is not stored.

We do not track your location in the background, outside of the app, or at any time other than the specific actions described above. You can revoke location permission at any time through your device settings.

D. QR Clock-In Data

When you clock in using the QR method, the Platform generates a time-based one-time password (TOTP) that is valid for 30 seconds. We record the timestamp and verification status of the clock-in attempt. No biometric data is collected during this process.

E. Waitlist Data

If you sign up for early access before the Platform launches, we collect your name, phone number, city, and optional preferences (work interests, availability, experience). This data is used solely to notify you when the Platform launches in your area and to understand demand. If you do not create an account after launch, your waitlist data will be deleted within 12 months.

2. How We Use Your Information

We use your personal data to:

• Create and manage your account, verify your identity via OTP.
• Match Talent Users with relevant shifts based on location, preferences, and availability.
• Enable Business Users to post shifts, review applicants, and manage their workforce.
• Verify attendance through QR or GPS clock-in methods.
• Facilitate the ratings and reviews system (business reviews, talent reviews, peer reviews).
• Enable in-app chat between Business Users and Talent Users.
• Send push notifications about shift updates, offers, messages, and Platform activity.
• Detect and prevent fraud, abuse, and violations of our Terms of Service.
• Detect no-shows and manage the violation system.
• Analyse Platform usage to improve features, performance, and user experience.
• Respond to your feedback, support requests, and inquiries.
• Comply with applicable legal obligations.

3. Information We Share

We do not sell your personal data to anyone. We share your information only in the following circumstances:

With Other Users

• Talent Users can see Business User profiles (business name, location, ratings) when browsing shifts.
• Business Users can see Talent User profiles (name, photo, completed shifts, ratings, work experience) when reviewing applicants.
• Ratings and reviews are visible to the relevant parties to build trust.

With Service Providers

We share data with trusted third-party services that help us operate the Platform:

• Cloud Infrastructure: For hosting and data storage (servers located in secure data centres).
• Push Notifications: Firebase Cloud Messaging for delivering notifications to your device.
• Analytics: Microsoft Clarity and Firebase Analytics for understanding usage patterns (anonymised/aggregated where possible).
• Error Tracking: Firebase Crashlytics for detecting and fixing app crashes.
• File Storage: For profile photos and attachments.

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

For Legal Reasons

We may disclose your information if required by law, court order, or government authority, or if we believe in good faith that disclosure is necessary to protect the rights, safety, or property of Cloxy, our Users, or the public.

4. Data Security

We implement industry-standard security measures to protect your data:

• All data is transmitted over HTTPS (encrypted in transit).
• Authentication uses JWT tokens with automatic rotation.
• OTP codes expire after use and have rate limiting to prevent brute-force attacks.
• QR codes for clock-in use TOTP (time-based one-time passwords) that rotate every 30 seconds.
• Database access is restricted and monitored.
• We use soft deletion, so your data is not permanently destroyed immediately, allowing recovery in case of accidental deletion.

While we take reasonable measures to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

5. Data Retention

• Active accounts: Your data is retained for as long as your account is active.
• Deleted accounts: Upon account deletion, we retain your data for up to 90 days for fraud prevention and dispute resolution, after which it is permanently deleted.
• Ratings and reviews: Anonymised ratings may be retained indefinitely for Platform integrity.
• Clock-in records: Attendance records are retained for the duration of your account plus 12 months for compliance purposes.
• Chat messages: Retained for the duration of your account. Deleted when your account is deleted.
• Waitlist data: Deleted within 12 months if you do not create an account.

6. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian laws, you have the following rights:

• Right to Access: You can view all personal data we hold about you through the app settings.
• Right to Correction: You can update or correct your profile information at any time through the app.
• Right to Erasure: You can request deletion of your account and associated data by contacting us.
• Right to Grievance Redressal: You can raise concerns about data processing by contacting our Grievance Officer.
• Right to Withdraw Consent: You can withdraw consent for data processing at any time, though this may limit Platform functionality.
• Right to Nominate: Under the DPDPA, you have the right to nominate a person to exercise your data rights in the event of your death or incapacity.

To exercise any of these rights, contact us at hello@cloxy.co. We will respond within 15 days.

7. Cookies and Tracking (Website)

Our website (cloxy.co) uses the following:

• Essential cookies: For basic site functionality (no tracking).
• Microsoft Clarity: Session recording and heatmaps to understand how users interact with the website. Clarity anonymises IP addresses and does not track users across other websites.

We do not use advertising cookies or retargeting. We do not sell or share cookie data with third parties for marketing.

8. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a minor, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date and notify you through the Platform. Your continued use after changes are posted constitutes your acceptance of the updated policy.

10. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDPA, 2023, our Grievance Officer can be contacted at:

Email: hello@cloxy.co
Address: Ahmedabad, Gujarat, India

We will acknowledge your grievance within 24 hours and resolve it within 15 days of receipt.

11. Contact

For any questions about this Privacy Policy or your data, contact us at hello@cloxy.co.