HRPay

Privacy policy

Last updated: 10.09.2026

HRPay is a service for organizations that handles Face ID attendance, timesheets, payroll and employee records: the hrpay.uz web app, the HRPay mobile app (iOS and Android) and a Telegram bot. This page explains what data is collected, why it is used, who it is shared with and how it is protected.

Who is responsible for the data

  • Employee data is entered and managed by the employing organization. The organization is the controller of that data, and HRPay processes it on the organization's behalf.
  • HRPay is responsible for data from the application form, account security and the technical operation of the service.

What data is collected

  • Account: first and last name, phone number, password (stored only as a hash), role and position in the organization.
  • Employee record (entered by the organization): date of birth, passport details, personal identification number (PINFL), address, position and department, salary, advances and documents.
  • Face photo: uploaded so the Face ID terminal can recognize the employee. A frame captured by the terminal may be stored with an attendance event.
  • Attendance: check-in and check-out times, which terminal recorded them or whether they were entered manually, and the correction history.
  • Device and technical data: identifier of the device the app is installed on, push notification token, platform, IP address and error logs.
  • Application form: name, phone, email, company name and message. The phone number is verified with an SMS code.
  • The mobile app does not collect location, contacts or the advertising identifier. It accesses the camera and photo library only when you take or choose a photo, and uses the local network only to find and connect to the Face ID terminal.

How the data is used

  • Recording attendance, calculating timesheets and payroll, preparing reports and Excel exports.
  • Signing in and protecting your account: sessions, device recognition, system logs.
  • Notifications: check-ins and check-outs, tasks, advances and announcements from your organization.
  • Contacting you about an application you submitted.
  • Data is not used for advertising, is not sold and is not combined with data from other companies.

Who the data is shared with

  • Google Firebase Cloud Messaging and Apple Push Notification service, to deliver notifications to your device (device token and message text).
  • PlayMobile, to send the SMS code that verifies your phone number (phone number and code).
  • Telegram, only if you link the bot to your account yourself; notifications are then delivered through Telegram.
  • Administrators of your organization see data within their own organization. Other organizations cannot see your data.
  • Competent government authorities, where required by law.

How the data is protected

  • All communication with the server is encrypted with HTTPS. Passwords are stored as hashes and terminal passwords are stored encrypted.
  • Access to data is limited by roles and permissions, and important actions are written to the system log.
  • On the phone, the mobile app stores only the sign-in token and interface settings, in secure storage (iOS Keychain, Android Keystore).

Retention

  • Data is kept for as long as the organization uses HRPay.
  • If the organization stops using the service or asks for its data to be deleted, the data is deleted within 30 days, except for payroll records that must be kept by law.
  • Verification codes and outdated technical records are deleted automatically.

Account deletion and your rights

  • You have the right to view your data and to request its correction or deletion.
  • In the mobile app: open Profile and tap “Request account deletion”. Without the app: write to the contacts below with your phone number and the name of your organization.
  • Requests are handled within 30 days: the account is closed and your photo, passport and contact details are deleted. Payroll and attendance records that the organization must keep by law may remain in a form that no longer identifies you.
  • Because employee data belongs to the employing organization, the request is also coordinated with its administrator. You will be told the outcome.

Children

  • The service is intended for organizations and their employees. We do not knowingly collect data from anyone under 16.

Changes to this policy

  • When the policy is updated, the date on this page changes. We will announce significant changes in the app or by notification.

Contact

For questions about privacy, or to view, correct or delete your data, use the contacts below. Please include your phone number and the name of your organization.