PRIVACY POLICY – KeyWebHR
PRIVACY POLICY – KeyWebHR
Effective Date: 25 October 2026
App: KeyWebHR (Android, package: com.appsinapp.keywebhr) and the KeyWebHR website at https://keywebhr.com
Contact Email: appsinappdev@gmail.com
KeyWebHR is a business app with two products:
KeyWebHR HR: Helps companies manage attendance, leave, payroll, expenses, helpdesk requests, and other work activities.
KeyWebHR Gym: Helps gyms manage memberships, attendance, workouts, payments, and billing for staff and members.
Your company or gym creates your account and decides what information to add. Your company or gym is responsible for your employee or membership records. We process this information to provide the service.
We are responsible for the app's own analytics and advertising activities described in this policy.
This policy explains what information we collect, why we collect it, who can access it, and what choices you have.
Your company, gym, or you may provide:
Name, Employee ID or Member ID, company or gym name, role, department, designation, and reporting manager.
Mobile number, email address, date of birth, address, emergency contact, and blood group for gym staff, if provided.
Joining date, employment status, shifts, working days, and work location.
Profile photo, if added. The app reduces the photo size on your phone before uploading it.
For company owners, the registration email address, which is verified using a six-digit code.
For HR users with the required permission, we process:
Salary details and salary history.
Payment type, such as monthly, daily, or hourly.
Allowances and deductions, including PF, ESI, professional tax, TDS, advances, and loans.
Bank account number, IFSC, bank name, PAN, and KYC details.
Payslips, bonuses, reimbursements, and company payroll rules.
We collect and process:
Check-in and check-out times, work sessions, breaks, working hours, overtime, and late marks.
Leave requests, leave balances, attendance correction requests, shift schedules, and holidays.
Location at the time of check-in or check-out, but only if your company or gym has enabled location checking. See Section 3.
For KeyWebHR Gym, we may process:
Membership plans, membership dates, payments, invoices, and outstanding dues.
Gym visit and attendance records.
Fitness goals, body measurements, workout plans, workout history, diet plans, and trainer notes entered by you or your trainer.
You may upload employee documents, ID proof, offer letters, certificates, expense receipts, helpdesk attachments, feedback files, and company logos.
Supported file types are JPG, PNG, WebP, HEIC, and PDF. Each file can be up to 10 MB.
We process expense claims, helpdesk tickets, feedback, ideas, profile-change requests, approvals, rejections, tasks, and other work-related information.
We also keep records of important actions, such as payroll processing, approvals, and access to sensitive documents.
Each employee or member can have a personal QR code for attendance. It contains an ID and a random code, not personal details.
The company or gym Office QR contains a company or gym identifier and a code that expires after a limited time.
We use analytics to understand how the app is used. This may include screens opened, app sessions, app version, device model, Android version, approximate country, and an app-instance identifier.
See Section 6.
Google AdMob may use your Android advertising ID and device information to show ads.
See Section 7.
We do not collect your contacts, call logs, SMS, microphone audio, browsing history, or data from other apps. We do not track your location in the background.
Internet: Used to sign in and send or receive information from the KeyWebHR server.
Camera: Used only to scan QR codes, including Office QR codes, employee QR codes when you are authorised, and asset labels. Images are processed on your phone. Photos and videos are not saved or uploaded by the scanner. Camera permission is requested when you open a scanner for the first time. You can deny permission and continue using other app features.
Location: Used only at check-in or check-out when your company or gym has enabled location checking. Your location at that moment is sent with your attendance record to confirm that you are at the workplace. Location is never collected in the background. If you deny permission, you may not be able to check in yourself where location checking is required.
Photos and Files: You choose which profile photo, company logo, receipt, or document to upload using Android's file picker. The app accesses only the files you select.
Advertising ID: Used by Google AdMob and Firebase as described in Sections 6 and 7.
You sign in using your company or gym name, Employee ID or Member ID, and password.
Your password is not stored in readable form. The server stores a secure one-way password hash.
After you sign in, the server provides:
A short-lived access token that stays in the app's memory.
A refresh token that can remain valid for up to 30 days to keep you signed in. It is encrypted on your phone using AES-256, with keys protected by Android Keystore.
When you sign out, the session is deleted from your phone and ended on the server.
We do not use Google, Facebook, or other third-party sign-in services.
We use your information to:
Run company HR activities, including attendance, leave, shifts, payroll, payslips, expenses, helpdesk, documents, onboarding, and work tools.
Run gym activities, including memberships, visits, billing, workouts, and fitness tracking.
Show each user only the information allowed by their role.
Send in-app notifications, such as leave approvals and membership updates.
Keep records of important actions for security and accountability.
Understand app usage and improve the app.
Show ads to employees and gym members.
We do not sell your personal information. We do not use your HR, payroll, attendance, gym, or fitness information to show advertisements.
We use Google Firebase Analytics in the Android app downloaded from Google Play to understand app usage, find problems, and improve the service.
It records information such as:
Which screens are opened, using screen names only.
App sessions and app version.
Device model and Android version.
Approximate country.
Advertising ID and an app-instance identifier, where applicable.
Firebase Analytics does not receive the names, IDs, or values displayed on screens. It does not receive your HR, payroll, attendance, gym, or fitness records.
Google processes this information under its own privacy policy:
https://policies.google.com/privacy
KeyWebHR uses Google AdMob to show ads.
Who sees ads? Employees using the company HR app and gym members using the gym member app. Company owners, HR users, managers, and gym staff do not see ads.
Where are ads shown? Ads may appear as cards labelled "Sponsored" on selected screens, such as the dashboard, notifications, attendance, leave, search, scanner, and gym member screens. A full-screen ad may appear after a completed action, such as recording an Office QR check-in or check-out, or saving a gym workout. These full-screen ads are shown at most once a day.
Ads are not shown in the middle of a form or before an action is completed.
What type of ads are shown? The app requests non-personalised ads, which are not based on your past behaviour. Google may still use your advertising ID, IP address, and device information to deliver ads, limit how often they appear, measure ad performance, and prevent fraud.
We do not share HR, payroll, attendance, gym, or fitness records with Google or advertisers.
You can reset or delete your advertising ID in your phone settings. The option may be under Settings > Google > Ads or Settings > Privacy > Ads, depending on your device.
Google's policy on data use is available at:
https://policies.google.com/technologies/partner-sites
You: Your own profile, attendance, leave, salary, payslips, claims, tickets, and gym membership, visits, workouts, and progress, where applicable.
Managers and trainers: Information needed to manage their teams, approvals, attendance, or member training.
Company owners and HR: Employee records, payroll, and other information they are authorised to manage.
Gym owners and authorised staff: Gym records and member information they need to manage.
Service providers: Our hosting provider, Amazon Web Services (AWS); Google services, including Firebase Analytics, AdMob, and Google Play services; and our email provider for verification codes.
Legal authorities: Information may be disclosed when required by law, a court order, or a government authority.
Our service providers are expected to protect the information they process for us.
Each company's and gym's information is kept separate from that of other companies and gyms.
Your information is stored on our servers hosted by Amazon Web Services ([region]). The Android app and website connect to the server using encrypted HTTPS connections.
Your phone may store:
Your encrypted sign-in session.
Display preferences, such as theme and style.
Small app settings, such as when an ad was last shown.
Temporary copies of files you open, stored in the app's private storage.
Android backup is disabled for the app, so your session and app data are not copied to cloud backups through Android backup.
We keep your information while your company or gym uses KeyWebHR and for as long as required by applicable employment, tax, and payroll laws.
Payroll records may be kept for up to [8] years.
When a company or gym closes its account or asks us to delete its data, we delete or anonymise that data within [30] days, except where the law requires us to keep it.
Google manages the retention periods for analytics and advertising information under its own policies.
You can request deletion of your account and the information linked to it.
Company owners: Open the app and go to More > KeyWebHR Hub > Delete account.
Anyone: Email appsinappdev@gmail.com with the subject "Delete my KeyWebHR account". Include your name, Employee ID or Member ID, and company or gym name.
We may verify your request with your company or gym before processing it.
We delete your account and related data within 30 days, except for records that must be kept by law. Those records are deleted when the legal retention period ends.
More details are available here:
https://sites.google.com/view/appsinapp/project-page/delete-keywbhr-account
We use security measures to help protect your information, including:
Encrypted HTTPS connections between the apps and server.
Secure password hashing.
Encrypted session storage on your phone using AES-256 and Android Keystore.
Role-based access controls.
Separation of each company's and gym's data.
Access restrictions for uploaded files.
Records of access to sensitive documents.
No system is completely secure, but we work to protect your information.
Under India's Digital Personal Data Protection Act, 2023, and other applicable laws, you may have the right to:
Access your information and request a copy.
Correct incorrect information. You can request profile changes under My Profile in the app.
Request deletion when the information is no longer needed, unless the law requires us to keep it.
Withdraw consent when processing is based on consent.
Raise a complaint with us and, where applicable, with the Data Protection Board of India.
Your company or gym controls your employee or membership records, so many requests may need to go through them first.
You can also contact us at appsinappdev@gmail.com for help.
KeyWebHR is designed for businesses, employees, and gym members. Users must generally be 18 or older.
Gym members aged 13 to 17 may use the service if their gym has the consent of a parent or guardian.
We do not knowingly collect information from children under 13. Ads in the app are requested as non-personalised ads.
We may update this policy when our services or practices change.
When we make changes, we will update the effective date at the top of this policy. For important changes, we may also notify you through the app.
Email: appsinappdev@gmail.com
We aim to respond to complaints and requests within 30 days.
For questions about this policy or how your information is handled, contact us at appsin