Rosterbook (“Rosterbook”, “we”, “us”) is a staff attendance and payroll app provided by Thirteen Twenty Productions LLP (“the Company”). This policy explains what personal data we collect, why, how we use and share it, and the choices and rights you have. It applies to the Rosterbook mobile app, the Rosterbook web dashboard (app.rosterbook.in), and related backend services.
If you are in India, we process personal data in line with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. We also describe rights commonly available under other regimes (such as the GDPR) where relevant.
We process personal data only for the purposes set out in this notice, or for any other purpose permitted under applicable law. If we want to use it for a materially different purpose, we will seek your fresh consent or notify you as required by law.
The data controller (Data Fiduciary) is Thirteen Twenty Productions LLP, contactable at info@rosterbook.in. For employees added by an employer, the employer is also a controller of the attendance, pay, and document data they manage about you; Rosterbook acts as a processor on the employer’s behalf for that data, and as a controller for the account and service data described below. Where you maintain your own portable worker profile (see Section 2), you control that personal profile information and Rosterbook acts as a controller in respect of it. See Section 12 for our designated Grievance Officer.
Account information. Email address and password (passwords are handled by a third-party authentication provider; we never see your raw password).
Employer profile. Name, contact name, business/company name (or a nickname for individuals), business address, GST number (if provided), timezone, and pay-cycle settings.
Employee profile. Name, employee code, designation, monthly salary and pay configuration (overtime, conveyance, working days), address, and driving-licence details where the employer chooses to enter them.
Worker profile (portable). An individual can create their own Rosterbook worker account and maintain a portable profile that they own — full name (as per government ID), email, phone number, date of birth, current and permanent address, and driving-licence details. The same portable profile can be linked to more than one employer and is reused across those engagements. You control and edit this personal information yourself; each employer separately controls the employment terms (such as employee code, designation, salary, and shift) for its own engagement with you.
Manager (team member) information. Where an employer adds Managers to help run their account (Plus and Business plans), we collect the Manager’s name, email address, the specific permissions the employer has assigned them, and an invite-code status. Managers can only take the actions the employer has authorised.
Documents and photographs. Employers may upload a profile photo and supporting documents for an employee — for example a copy of a driving licence or identity document — for their own record-keeping. These are stored in encrypted cloud storage (see Section 6) and are only visible to the employer/authorised Managers and the employee themselves.
Face-check (biometric) data. Where an employer enables the optional “Require face check” feature (Business plans), we process facial biometric data to confirm that the person checking in or out is the enrolled employee. See Section 5 for full details — we call this out separately because it is more sensitive than the data above.
Attendance and location data. When you check in or out, we collect your device’s GPS coordinates and accuracy at that moment, the matched work site, a timestamp, a device identifier, and a flag indicating whether a mocked/fake location was detected. We also store the geofenced work-site locations created by the employer. Location is only read at the moment you punch in or out — Rosterbook does not track your location in the background.
Payroll records. Leave, advances, computed monthly reports and payslips.
Billing and subscription information. If an employer subscribes to a paid plan (Plus or Business), the purchase is made and billed through the Apple App Store or Google Play Store — they are the merchant of record and we never receive or store your card or payment details. We receive limited subscription data (active plan, renewal status, purchase/expiry dates) from a subscription-management service provider we use, to activate the correct plan and features on your account.
Notification tokens. A push-notification token (delivered via a notification-delivery service and the underlying Apple/Google push platforms) so we can send service alerts such as check-in confirmations and report-ready notices.
Technical data. Basic device/app information and logs needed to operate and secure the service.
Legal bases (where applicable): performance of your contract / terms of use; your consent (in particular for location, notifications, and face-check data, which you can withdraw as described in Section 9); our legitimate interests in operating and securing the service and preventing fraud; and compliance with law.
Location is central to Rosterbook’s purpose: it confirms that a check-in or check-out genuinely happens at the employer’s geofenced site. We access foreground location only, and only during a punch action. We do not run background or continuous location tracking. You can decline or revoke the location permission in your device settings; doing so will prevent geofenced check-in/out from working. Stored location coordinates are encrypted at rest (see Section 10).
This section describes a feature employers can optionally turn on; it does not apply to you if your employer has not enabled “Require face check.”
We do not sell your personal data. We may share it, only as needed for the purposes described in this policy, with:
We choose reputable providers and require them, by contract, to protect your data and use it only to provide their service to us. Check-in face matching happens on the employee’s own device and the check-in selfie is never uploaded; enrolled face data is shared only with our storage and application-hosting providers — never with a third-party facial-recognition API. A current list of our specific service providers is available on request by emailing info@rosterbook.in.
Some of the service providers above may process or store your information outside India. Any transfer of personal data outside India is made in accordance with the DPDP Act, including any list of countries or territories to which transfer is restricted that the Central Government may notify from time to time. Where no such restriction applies, we take reasonable steps to ensure your information continues to be protected.
We keep personal data only for as long as necessary to serve the purpose for which it was collected, or as required to meet legal, accounting, tax, or reporting obligations, after which it is deleted or anonymised. In particular: check-in selfies are processed on the employee’s device and are never uploaded, so we do not store or retain them; enrolment photos are held only until the employer approves or rejects the enrolment and are then deleted, while the face pattern used for matching stays on the employee’s device and is not stored on our servers; other account, employer, employee, and payroll data is retained while the account is active and as needed to meet the legal/tax obligations above. Deleting data because its purpose has ended does not, by itself, require us to individually notify you — that notification duty arises only if there has been a personal data breach (Section 10).
Subject to applicable law, and in particular the DPDP Act, you have the right to:
Account deletion. You can delete your account and associated personal data from within the app (Settings → Delete account) or by emailing info@rosterbook.in. If you delete your worker account, we erase your portable personal profile and any enrolled face data; the attendance and pay records an employer holds about you may be retained by that employer as the controller for their own legal needs.
Permissions. You can grant or revoke location and notification permissions at any time in your device settings.
We implement reasonable technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access, in accordance with Section 8(5) of the DPDP Act. This includes encrypted transport (HTTPS/TLS) for data in transit; application-layer encryption at rest of sensitive fields in our database — including pay and salary figures, personal identifiers (such as names, contact numbers, addresses, and government-ID / driving-licence details), and precise check-in location — using a key held separately from the database; encrypted storage of uploaded photos and documents, which are served only through short-lived signed links; a managed authentication provider; and role-based access controls. We also keep an audit log of activity in the service and retain a copy of it within India. No system is perfectly secure, but we work to protect your data and to address issues promptly. In the event of a personal data breach, we will notify affected individuals and the Data Protection Board of India as required by Section 8(6) of the DPDP Act.
Because attendance and payroll data may be used to make decisions that affect you (such as calculating your pay) and may be seen by both you and your employer, we take reasonable steps to help keep this data complete, accurate, and consistent, in accordance with Section 8(3) of the DPDP Act — including by letting you and your employer review and correct records in the app. Please tell us or your employer promptly if you believe any information about you is inaccurate.
In accordance with Section 13 of the DPDP Act and the DPDP Rules, our Grievance Officer is:
Shankar Arora, Founder
Email: info@rosterbook.in
Thirteen Twenty Productions LLP
We aim to acknowledge grievances within 7 days and resolve them within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.
Rosterbook is not directed at children and is intended for adults (employers and working-age employees). We do not knowingly collect data from children under the age defined as a minor in your jurisdiction.
We may update this policy from time to time. We will revise the “Last updated” date and, for material changes (such as processing your data for a new purpose), provide a more prominent notice or seek fresh consent as required by law.
info@rosterbook.in · Thirteen Twenty Productions LLP