STAMP privacy policy

Clocktower Software Limited provides STAMP to New Zealand employers. This policy explains how we handle personal information when an employer uses STAMP, when a worker clocks time or uses a STAMP account, and when someone contacts us.

Who makes decisions about worker information

Your employer decides who can use STAMP, which clocking checks apply, who within the business can see records, which payroll system receives timesheets, and how the business uses them. We store and process worker information to provide STAMP to that employer. The employer remains responsible for explaining its workplace use of STAMP and for handling employment and payroll decisions.

If you are a worker and want to access or correct your timesheet, photo or clock location, contact your employer first. If you contact us, we will acknowledge your request and work out whether it should be handled by us, your employer, or both. We will not ignore a direct privacy request.

We make our own decisions about information used to run our business, such as account owner contact details, support messages, service security records and billing records.

Information STAMP handles

Depending on how your employer sets up STAMP, this may include:

• Names, work email addresses, employee numbers, organisation details, roles and account access records.
• Clock events, work entries, breaks, leave, timesheet approvals, corrections, notes and audit history.
• A location fix taken at a clock event when the employer requires GPS, with its accuracy and whether the phone reported a simulated location. The employer chooses whether to require it. A worker may deny phone location permission, but this can stop the clock event from completing under that employer's settings. STAMP does not request background location.
• A photo taken at a clock event when the employer requires one. An authorised manager may review it by eye. STAMP does not automatically match faces, identify people from photos, create face templates or use photos for advertising or AI model training.
• Messages and announcements sent inside STAMP, and files or support information that users choose to submit.
• Payroll identifiers, such as a worker's employee number or the ID their payroll system uses, when the employer connects a payroll system.
• The name and email address of the person responsible for billing.
• Technical records needed for sign-in, device security, push notifications, troubleshooting and reliable operation. These include a device's notification token and the app version.

We collect some information from you directly, some from your employer, and some from a payroll system that your employer chooses to connect. If you sign in with Google, we receive your name, email address and Google account ID from Google. A clock event may not be accepted without information that your employer has made mandatory for that event. Your employer should explain the alternatives and workplace consequences.

What we use it for

We use this information to provide clocking, timesheets, approvals, payroll exports and connections, messages and notifications, account access, billing, support, security, and legally required record handling. We do not sell personal information or use it for advertising. STAMP has no analytics, advertising or crash-reporting trackers. We never send clock photos or GPS locations to a face-recognition or AI provider.

Payroll systems

Timesheets only go to the payroll system that your employer already uses and chooses to connect. We do not send worker information to any other payroll provider.

Your employer can download a payroll file from STAMP and upload it to payroll itself. STAMP does not send that file anywhere. It can contain names, employee numbers, IRD numbers where the employer has set them up, hours and dates.

Where STAMP offers a direct connection, the employer connects its own payroll account and can disconnect it at any time. When an authorised person sends a pay period, the payroll system receives each worker's hours and dates, with the employee number or ID that the payroll system uses. It can also receive leave dates, leave types and pay codes that the employer has set up. It does not receive clock photos or GPS locations.

A direct connection can also bring information into STAMP from the payroll system: workers' names, preferred names, email addresses, employee numbers or payroll IDs, active status, finish dates and leave balances. While a connection is active, STAMP may check the payroll system's employee list regularly to keep workers matched, and may add new active employees unless the employer has excluded them. When an employer imports staff from payroll, STAMP may email each new worker a code to set up their account.

Ask STAMP, the settings assistant

Owners, admins and managers can use Ask STAMP to answer questions about their settings and change them. It uses an AI model run by Venice AI. When someone uses it, Venice receives their messages and the organisation's name and settings. When someone asks about team access, Venice also receives the names and roles of the organisation's owners, admins and managers, but not their email addresses. It does not receive timesheets, clock photos or GPS locations, unless someone types those details into a message. Venice's terms say it does not store message content after replying and does not use it to train AI models. Ask STAMP uses a private model that Venice serves itself or through partners that keep no message data. Messages are not passed to the model's original developer. We do not save chat conversations. We keep a record of any change the assistant makes, with the before and after values, so the change can be reviewed. Most changes can be undone from that record. Changes to someone's role or access, turning off timesheet approval and changing the PIN length cannot be undone automatically.

Where STAMP stores information

STAMP runs on a server that we own and manage in New Zealand. It stores all STAMP data, including clock photos. We will update this policy before we move STAMP to a different hosting provider.

Who can receive it

Authorised people at the employer can see information according to their STAMP permissions. We also use the service providers below. Each receives only what it needs for its task.

A payment provider receives billing information, never individual employee timesheets. STAMP's website and account pages serve their font files and map images from our own server, so viewing clock locations on a map sends nothing to an outside map provider. A manager can choose to open a clock location on the OpenStreetMap website. That link sends the location's coordinates to the OpenStreetMap Foundation in the United Kingdom. We may disclose information where the law requires it or to protect the service and its users.

Overseas processing

Some service providers store or process information outside New Zealand, including in Australia, India, Japan and the United States. Most handle it only on our behalf, to provide their service to us, under contracts that limit how they can use it. Stripe also uses some payment information for its own fraud prevention and legal compliance, under its own privacy policy. We choose providers whose security and privacy protections we consider comparable to those of New Zealand's Privacy Act 2020.

Storage, security and retention

We use access controls, encrypted connections and operational safeguards appropriate to the information. Only authorised people and service providers may access information for their work. No online service can promise perfect security. We will investigate suspected privacy breaches and notify the affected people and the Privacy Commissioner where the law requires it.

We keep timesheet, leave and account records while the employer's account is active. New Zealand employers must keep wage, time and leave records for six years, and the employer can export them at any time.

We delete clock photos and GPS locations 90 days after the pay period they belong to closes. The employer can hold specific records for longer during a dispute, investigation or legal obligation.

When an account closes, the employer receives a full export of its data. The account stays read-only for 90 days so the employer can review and export records again. We then delete the account data. The employer keeps any records it must hold for six years. We keep invoices and the account owner's billing details for seven years for tax.

Encrypted database backups are kept for 30 days. Deleted information can remain in a backup until that backup expires.

We keep server logs for 30 days. STAMP does not keep a log of each request. It holds IP addresses only in memory, for up to an hour, to limit repeated sign-in attempts. The audit history of changes to timesheets and settings is part of the employer's records, and we delete it with the account.

Your choices and rights

You can ask for access to, or correction of, personal information about you. Workers should normally ask their employer first because it controls their workplace records. You can also contact us using the details below. We may need to confirm your identity and coordinate with the employer before responding. If a correction is disputed, the Privacy Act may allow you to attach a statement of correction.

A worker can turn off phone notifications and location permission at any time. Turning off location can stop clock events where the employer requires GPS.

If you have a privacy concern, contact us or the employer. You may also contact the New Zealand Office of the Privacy Commissioner.

Deleting your account and data

To ask us to delete your STAMP account, email [email protected] from the email address on your account, or ask your employer's STAMP admin. We delete your sign-in details. We keep your employer's records about your work as described under Storage, security and retention. Our account deletion page gives the steps and lists what we delete and what we keep.

Cookies and device storage

STAMP uses the cookies and device storage needed for sign-in and service operation. It has no marketing or analytics trackers. When a phone or shared device is offline, the STAMP app keeps clock events, photos and locations on the device until it can send them to STAMP.

Changes to this policy

We will update this policy when our practices change and show the effective date above. We will give account owners reasonable notice of material changes.

Contact

Privacy officer, Clocktower Software Limited (company number 9460037). Email: [email protected].