This policy explains how MetaGuard Mobitech Pvt. Ltd. ("MetaGuard", "we", "us", or "our") and MemoFaceAI collect, use, store and protect personal information, including sensitive personal data and biometric data, across our products and services.
In most deployments, MemoFaceAI acts as a data processor on behalf of the customer organisation, which acts as the data controller. The employer or institution determines the purposes for which employee or student data is used.
Introduction
MetaGuard Mobitech Pvt. Ltd. ("MetaGuard", "we", "us", or "our") operates the MemoFaceAI platform, including the web application, Android and iOS/iPad applications, on-premise hardware integrations, APIs and associated services.
This Privacy Policy describes how we collect, use, disclose and safeguard personal information when you or your organisation uses our Services.
The policy applies to:
- Employees and workers whose attendance is recorded by MemoFaceAI on behalf of an employer.
- Administrators, HR managers and authorised personnel who access the MemoFaceAI dashboard.
- Students, faculty and institutional staff using MemoFaceAI in educational settings.
- Visitors to our website and individuals who contact us for sales or support.
Please read this policy carefully. If you do not agree with our practices, discontinue use of the Services and contact your employer or institution to understand their applicable data practices.
Who We Are
MetaGuard Mobitech Pvt. Ltd. is a company incorporated under the Companies Act, 2013 in India, with its registered office in Gurgaon, Haryana. MemoFaceAI is our AI-powered workforce intelligence product.
| Company | MetaGuard Mobitech Pvt. Ltd. |
| Product | MemoFaceAI |
| Registered Office | Gurgaon, Haryana, India |
| CIN | Available on request |
| Data Controller Contact | privacy@metaguard.in |
| DPO | Loveneesh Bansal — loveneesh@metaguard.in |
Data We Collect
We collect different categories of personal data depending on the individual's role and the Services being used.
3.1 Data provided by customer organisations
- Full name, employee or student ID, department and designation.
- Contact details including email address and mobile number.
- Employment or enrolment status, shift assignments and leave records.
- Payroll-relevant information such as working hours, overtime and deductions.
3.2 Data collected automatically
- Attendance records, including check-in and check-out timestamps.
- Approximate GPS coordinates when mobile check-in or geo-fencing features are enabled.
- Device model, operating system version and application version.
- Server logs, IP addresses, access timestamps and API usage information.
3.3 Data collected from website visitors
- Contact form submissions including name, email, company and message.
- Demo booking information.
- Newsletter subscription information.
- Analytics information collected through cookies.
Biometric Data — Special Category
What biometric data we collect
- Facial geometry templates: Mathematical representations of unique geometric facial features generated from an enrolment photograph or video frame.
- Liveness signals: Infrared or depth signals used to distinguish a live person from a photograph or mask.
How biometric data is stored
- Facial templates are stored as encrypted mathematical vectors rather than photographs.
- Templates cannot be used to reconstruct a recognisable image of the individual.
- Data is encrypted at rest using AES-256 and in transit using TLS 1.3.
- In on-premise deployments, biometric templates remain on the customer's hardware.
- Cloud-hosted templates are stored in isolated, access-controlled storage.
Consent for biometric data
Under India's Digital Personal Data Protection Act, 2023 (DPDPA) and applicable regulations, the data controller is responsible for obtaining appropriate informed consent before biometric enrolment where required by law.
Biometric data retention
Biometric templates are deleted within 30 days of termination of a customer's contract, or immediately upon a verified deletion request from the data controller. Templates for individuals who leave an organisation are deleted within 7 days of de-enrolment unless the customer organisation is legally required to retain them.
How We Use Personal Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Attendance verification and recording | Biometric template, timestamp, device data | Contract / Legitimate interest |
| Payroll processing and HRMS sync | Attendance records, working hours, OT data | Contract |
| Workforce analytics and reporting | Aggregated attendance data | Legitimate interest |
| Compliance reporting | Attendance records, shift logs | Legal obligation |
| Security and fraud prevention | Liveness data, IP logs, access logs | Legitimate interest |
| Product improvement | De-identified usage data and model performance metrics | Legitimate interest |
| Customer support and onboarding | Contact details, support ticket content | Contract |
| Marketing communications | Email address, name, industry | Consent |
We do not use biometric data to train general-purpose AI models or for purposes beyond the attendance, security and compliance functions described in this policy.
Legal Basis for Processing
Personal data may be processed under the following legal bases, as applicable under the Digital Personal Data Protection Act, 2023 (DPDPA), and where relevant, the GDPR for individuals in the EU or EEA:
- Consent: For biometric enrolment, marketing communications and non-essential data collection where applicable.
- Contract: For processing required to provide contracted Services.
- Legal obligation: Where processing is required to comply with applicable law.
- Legitimate interest: For security, fraud prevention, service improvement and internal analytics where applicable.
Data Sharing and Disclosure
We do not share personal data with third parties except where necessary for the circumstances described below.
7.1 With your employer or institution
Attendance records, reports and analytics are shared with the customer organisation as the primary purpose of the Services. The organisation controls what authorised users can access.
7.2 With integrated HRMS and payroll providers
Where enabled by the customer organisation, attendance data may be transmitted to integrated systems such as GreytHR, Keka, Zoho People, SAP HCM, Darwinbox and BambooHR.
7.3 With sub-processors and infrastructure providers
- Cloud infrastructure, servers, databases and storage.
- Email delivery and notification services.
- Analytics and monitoring tools using anonymised or aggregated information.
- Security and DDoS protection services.
A full list of sub-processors is available on request at privacy@metaguard.in .
7.4 Legal requirements
Personal data may be disclosed where required by law, court order or government authority.
7.5 Business transfers
In the event of a merger, acquisition or sale of substantially all assets, personal data may be transferred as part of that transaction, subject to applicable requirements.
Data Retention
| Data Type | Retention Period | Basis |
|---|---|---|
| Biometric templates | Until de-enrolment or contract termination + 30 days | DPDPA / Contractual |
| Attendance records | As configured by customer; default 5 years | Labour law compliance |
| Payroll-sync logs | 7 years | Legal obligation |
| Access and security logs | 12 months rolling | Security / Legitimate interest |
| Support tickets | 3 years from resolution | Contractual |
| Marketing contacts | Until unsubscribe or 3 years of inactivity | Consent |
| Website analytics | 26 months, anonymised | Legitimate interest |
Where a customer deletes an account or terminates a contract, personal data is deleted within 30 days unless applicable law requires longer retention.
Security Measures
We implement technical and organisational security measures appropriate to the sensitivity of the data processed.
- Encryption at rest: AES-256 encryption.
- Encryption in transit: TLS 1.3.
- Access control: Role-based access control and least-privilege principles.
- Network security: Firewall, intrusion detection and DDoS protection.
- Vulnerability management: Regular security assessments and penetration testing.
- Incident response: Documented incident response procedures.
- Staff training: Mandatory data protection and security training.
Your Data Rights
Subject to applicable law and MetaGuard's role as data processor or controller, individuals may have rights regarding their personal data.
Right of Access
Request a copy of personal data held about you, including the existence of biometric templates.
Right to Rectification
Request correction of inaccurate personal information.
Right to Erasure
Request deletion of personal data, subject to applicable legal retention requirements.
Right to Object
Object to processing based on legitimate interests where applicable.
Right to Portability
Request attendance records in a structured, machine-readable format where available.
Right to Restrict Processing
Request restriction of processing while a complaint or correction request is assessed.
Because MemoFaceAI typically acts as a data processor for an employer or institution, employment-related attendance requests should generally first be directed to the relevant HR department.
Requests concerning data collected directly by MetaGuard, such as website visitor information or marketing data, can be sent to privacy@metaguard.in .
Cookies and Tracking
The MemoFaceAI and MetaGuard websites use cookies and similar technologies. The MemoFaceAI application platform uses strictly necessary session cookies to maintain authenticated sessions.
| Cookie Type | Purpose | Opt-Out? |
|---|---|---|
| Strictly necessary | Session authentication, CSRF protection and load balancing | No |
| Analytics | Anonymised page views and navigation patterns | Yes |
| Preferences | Language, region and theme preferences | Yes |
| Marketing | No retargeting pixels or advertising cookies | N/A |
Cookie preferences can be managed through the website cookie settings or through browser settings.
Children's Privacy
MemoFaceAI may be used in school and educational environments where individuals under 18 may be enrolled.
- The educational institution acts as the data controller and is responsible for obtaining appropriate parental or guardian consent where required.
- Student data receives the protections described in this policy and additional restrictions.
- Student data is not used for commercial purposes.
- Parents or guardians may request access, correction or deletion of their child's data through the relevant school or institution.
- MetaGuard does not knowingly collect personal data from children under 13 through direct-to-consumer website channels.
International Data Transfers
MetaGuard's primary data infrastructure is hosted in India. For customers in the MENA region, data may be hosted in regional cloud infrastructure to support data residency requirements.
Where personal data is transferred internationally, appropriate safeguards may include:
- Standard contractual clauses where required.
- Adequacy decisions or equivalent safeguards.
- Data Processing Agreements with applicable sub-processors.
Customers requiring specific data residency guarantees, including data that must remain within India, may opt for an on-premise deployment or discuss dedicated regional hosting arrangements.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our Services, legal requirements or industry practices.
For material changes, we may:
- Update the "Last Updated" date.
- Notify customer organisations by email where applicable.
- Display a notice in the MemoFaceAI dashboard.
- Seek renewed consent where required for changes involving biometric processing.
Previous versions of this policy may be requested by contacting privacy@metaguard.in .
Contact Us
If you have questions, concerns or requests regarding this Privacy Policy or our data practices, please contact us through the channels below.
Get in touch about privacy
Our Data Protection Officer is available for privacy enquiries, data rights requests and concerns about personal data processing.
Gurgaon, Haryana, India