Privacy Policy

1. Who We Are

CoreCloud is a company portal operated for its subscribing organizations. For data protection purposes, your organization (the employer) is the controller of the employee data entered into the Service, and CoreCloud acts as its processor.

2. Data We Collect

• Account & profile data — name, employee ID, email address, role, department and profile picture.
• HR & payroll data — attendance, leave records, salary and payroll information as configured by your organization.
• Security data — login events, IP addresses, device/user-agent information and audit trail entries used for threat detection.
• Face templates — if you register for face login, a mathematical representation of your face features is stored to enable recognition. Face images used for registration are processed to produce this template.

3. How We Use Data

• To provide the portal's HR, payroll and collaboration features to your organization.
• To authenticate you and keep your account secure.
• To detect, investigate and prevent security incidents (SOC/SIEM functionality).
• To send service notifications (e.g. leave decisions, password resets) as configured by your organization.

4. Face recognition consent and alternatives

Face login is optional. Before registration, the organization must explain the purpose and obtain any consent required by applicable law. A person may decline or withdraw consent without losing access to password login or another available authentication method.

Registration converts the camera capture into a mathematical face descriptor. The source camera image is not intended to be retained as a profile image by the face-registration flow. Face descriptors are used only to compare a login attempt with the enrolled employee record.

5. Security and encryption

Production traffic must use HTTPS. Access to face descriptors is limited to the authentication and authorized face-management workflows, and sensitive actions are recorded in the audit trail. The application protects database credentials and encryption-related secrets through deployment environment variables; operators must configure encryption at rest with the selected database and hosting providers.

No security measure is absolute. Organizations must restrict administrator access, use strong passwords and MFA where available, and review audit events.

6. Data Sharing

We do not sell personal data. Data is accessible to your organization's administrators and is processed by hosting and infrastructure providers (application hosting and database services) strictly to run the Service.

7. Retention and deletion

Organizations should define a written retention schedule for HR, payroll, audit and biometric data. Face descriptors should be deleted promptly when consent is withdrawn, an employee leaves, or the descriptor is no longer needed, subject to legal obligations. Authorized administrators can remove an employee's face registration through the face-management screen; deletion requests for other records should be sent to the organization's administrator.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete or export your personal data. Requests should be directed to your organization's administrator, who controls the data in CoreCloud.

9. Cookies

The Service uses strictly necessary session and CSRF cookies to keep you signed in and protect against cross-site request forgery. These are not used for advertising.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service.

11. Contact

For privacy questions, contact your organization's administrator or the support channels provided with the Service.