Privacy Policy — OpenSky HRM
1. About the App
OpenSky HRM (the “App”) is a Human Resource Management application for authorized employees, managers, and HR administrators. It includes the mobile app and the related web application.
The App connects to your organization’s OpenSky HRM backend. On mobile, the server URL is set by QR code or manual entry. On web, it is your organization’s web address. Business and employee data is processed on your organization’s servers, not on public OpenSkylabz consumer services, unless we explicitly state otherwise.
2. Information We Collect
2.1 Account and authentication data
The App may collect:
• Username
• Email address
• Password
• Access tokens (session tokens)
• User profile information from your organization’s server (name, role, employee ID, permissions, assigned locations, and licensed modules)
Password handling
When you sign in, your password is sent securely to your organization’s authentication server.
We do not store your password on the device after sign-in. The App does not support offline sign-in with a locally saved password.
Access tokens and some account information may be stored on your device to keep you signed in:
• Mobile: secure storage provided by the device or operating system
• Web: browser local storage or session storage, depending on whether you choose to stay signed in
You can remove locally stored credentials by:
• Logging out
• Clearing app data (mobile) or browser data (web)
• Uninstalling the App
We do not sell or share your password with third parties.
2.2 HR and operational data
When you use the App, it may access, display, create, upload, or sync:
• Employee profile data (name, employee code, contact details, address, date of birth, nationality, national ID, tax identifiers, employment status, job title, department, location, and manager)
• Profile photographs
• Leave balances, leave requests, and supporting documents (for example medical certificates)
• Attendance punches, timesheets, and related location or QR check-in records
• Payslips and payroll information you are authorized to view
• Approvals (for example leave approve or reject)
• In-app notifications
• Other HR records your role is allowed to access (emergency contacts, dependents, bank details for payroll, documents, recruitment, performance, learning, onboarding, and offboarding)
This data is sent to and retrieved from your configured API server.
2.3 Device configuration data
• API server URLs and company connection settings (from QR scan or manual entry)
• Company name and logo used for branding
• App or browser preferences
2.4 Location data (optional)
If you grant location permission, the App may collect GPS coordinates when you punch attendance in or out, including where geofencing is used.
Location is collected only at the time of the punch. It is not collected continuously in the background.
2.5 Camera (optional)
The camera is used to:
• Scan a QR code to connect to your company’s server
• Scan a QR code to punch attendance in or out
Photos or videos are not stored unless you use a feature that needs them (for example updating your profile photograph).
2.6 Photos and files (optional)
If you grant photo or file access, you may upload a profile photograph or attach documents (for example a medical certificate). These files are sent to your organization’s server.
2.7 Locally stored data
The App stores data on your device to keep your session and connection settings:
• Secure device storage (mobile)
• Browser storage such as localStorage or sessionStorage (web)
This may include your API server URL, company branding, access tokens, and cached profile information.
The App is not an offline-first HR system. HR records are loaded from and saved to your organization’s server when you use the App.
3. How We Use Information
We use collected information to:
• Authenticate users and keep sessions secure
• Provide HR self-service and administration (profile, leave, attendance, approvals, notifications, and payslips)
• Connect the App to your organization’s HRM server
• Attach location or QR check-in data to attendance records where enabled
• Improve reliability and security of the App
We do not sell your personal information to third parties.
4. Data Retention
On device: Data remains until you log out, clear app or browser data, uninstall the App, or your organization’s policies require removal.
On server: Retained according to your employer or organization’s data retention policies.
5. Security
We use reasonable technical measures, including:
• HTTPS communication with your configured server
• Token-based authentication
• Local encryption or storage practices supported by the device OS
No method of transmission or storage is 100% secure. You are responsible for keeping your login credentials confidential.
6. Your Choices and Rights
You may:
• Deny camera, location, photo, or file permissions (some features may not work)
• Log out and clear local app or browser data
• Contact your organization’s administrator for access, correction, or deletion of server-side HR data
Depending on your country, you may have additional privacy rights (access, correction, deletion). Contact us using the details below.
7. Children’s Privacy
The App is intended for business use by authorized employees. It is not directed at children under 13 (or 16 where applicable). We do not knowingly collect data from children.
8. International Transfers
If your organization’s server, email provider, file storage, or AI provider is located outside your country, data may be transferred internationally according to your organization’s setup and applicable law.
9. Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date will be revised. Continued use of the App after changes constitutes acceptance of the updated policy.