Privacy policy

Orlabia Group (TRAD/DNCC/094121/2026), Gulshan-2, is the data controller for personal data processed through Orlabia. Contact us at orlabia.org@gmail.com.

• Account data — name, email address, mobile number, company name, and a password hash held by our authentication provider. We never store your password.
• Billing data — orders, invoices, transaction references and the payment rail used. Card and wallet credentials are handled by the payment provider and never reach our servers.
• Service data — the content you put into the services you buy: employee records, attendance, salaries, payslips and staff messages in Employee Management, social order links in the SMM panel, message threads in Chat, and API request metadata in the developer platform.
• Attendance and app data — location, face photos, a phone identifier and a notification token, collected when employees check in; see clause 5.
• Technical data — IP address, browser user agent, request timestamps and error logs, kept for security and abuse prevention.
• Analytics data — see clause 6.

To provide and bill for the services you asked for (performance of a contract), to keep accounts secure and detect abuse (legitimate interest), to meet accounting and tax obligations (legal obligation), and to measure our advertising (consent, clause 6).

Only the processors we need to run the service: our authentication provider, hosting and database provider, email and SMS delivery providers, payment providers, our live-chat provider, and — where you use Employee Management, Chat or the SMM panel — the platform on the other side of the integration you connected. We do not sell personal data and we do not share it for anyone else’s advertising.

Where you use Employee Management, your organisation is the controller of your employees’ records and we are your processor. You are responsible for telling your employees what you collect and for having a lawful basis to do so.

Checking in, on the website or in the Orlabia app, collects:

• Location — the phone’s position at the moment of a check-in, check-out or movement, compared with the workplace the employer set. We never read location in the background or while the app is closed.
• Face photos — where the employer requires one, a photo of the employee’s face at check-in, matched against the one on file. Face detection runs on the phone itself. Check-in photos are deleted automatically after 60 days.
• Phone identifier — an identifier of the phone, so that one phone is tied to one employee and nobody can check in for somebody else.
• Fingerprint or face unlock — handled entirely by the phone. What we store is a public key and a counter; we never receive the fingerprint or face data that unlocks the phone.
• Notification token — so the app can show check-in reminders and messages from the workplace.

When the employer ends an employee’s access, their face photo on file, keys and phone link are deleted at once. Attendance and payroll records stay with the employer as part of its own records until it deletes them.

We use strictly necessary cookies to keep you signed in. Where enabled, we also use Google Analytics 4 and the Meta pixel to measure which ads bring signups and purchases. These set their own cookies and receive the page you visited and, on signup or purchase, that the event happened and its value. You can block them with your browser or ad blocker; the service works without them.

Account and service data for as long as your account is open. When you delete your account we schedule the personal data for erasure and hold it for at most 30 days so a mistaken deletion can be reversed and any open payment dispute can be settled. Invoices and transaction records are kept for the period our tax law requires, even after erasure.

You may ask for a copy of your data, correct it, have it erased, or object to processing based on legitimate interest. Email orlabia.org@gmail.com and we will answer within 30 days. To delete your account, see clause 11.

Traffic is served over TLS. Passwords are hashed, API keys are stored only as a SHA-256 digest, and third-party access tokens are encrypted at rest. Access to production data is limited to staff who need it and every administrative action is written to an audit log.

We will update the effective date above when this policy changes and, for material changes, tell account holders by email before they take effect.

Account holders — open Dashboard → Settings → Delete account, or email orlabia.org@gmail.com from the address on the account. We erase your personal data within 30 days, except the invoices and transaction records our tax law requires us to keep.

Employees — your employer holds your record, so ask them to end your access: your face photo, keys and phone link are deleted at once, and the rest of your record follows your employer’s retention. You can also email us and we will pass the request to your employer.