Privacy policy

1. Who we are

Cordyna makes business software for teams in India. This policy covers TaskSense, for giving and closing work, Cordyna Adsum, for attendance, their phone apps, and this website, cordyna.com (together, the “Services”).

Cordyna subscriptions are sold and billed by Green Bottle LLP, a limited liability partnership in India (GSTIN 07AARFG1277C1ZE). In this policy, “Cordyna”, “we”, “us” and “our” mean Cordyna and Green Bottle LLP. We follow the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made under them.

Voxowa, our CRM for telecalling teams, will publish its own privacy policy. This policy covers Voxowa only for messages about it sent through this website.

2. Your organization's data and ours

Most of the Services are used by organizations for their own people. That gives us two different roles:

• Workspace data. Tasks, comments, files, client records, employee details and attendance records belong to the organization that uses Cordyna. The organization decides why and how that data is used and is the Data Fiduciary for it. We process it on the organization's behalf and on its instructions, as its Data Processor.
• Our own data. For account and billing details, sign-in and security records, support conversations, messages sent through this website and visits to it, we decide how the data is used and we are the Data Fiduciary.

If you use Cordyna through your employer or another organization, questions about your workspace data are best sent to that organization first. We will help it respond.

3. What we collect

• Account details: name, mobile number, email address, organization, department, branch and role.
• Workspace content: tasks, approvals, comments, attachments, announcements, schedules, client and service records that people add.
• Employee records, where an organization keeps them in Cordyna: for example joining date and documents it uploads.
• Attendance data (Cordyna Adsum only): check-in and check-out times, selfies, face reference photos, location at the moment of checking in or out, shifts, leave and corrections. See section 5.
• Device and usage data: device type and name, app version, IP address, sign-in times and whether notifications are switched on, used to keep accounts secure and the apps working.
• Billing details: plan, invoices, the billing contact and GST details. Card, UPI and bank details are entered with our payment gateway and are not stored by us.
• Messages and support conversations, including what you send through the contact form on this website (section 7) and screenshots you choose to send.

4. How we use it

• To provide the Services: showing people their work, sending reminders and notifications, and running the features an organization switches on.
• To sign people in with one-time codes and to keep accounts and data secure.
• To bill subscriptions and keep the records that tax law requires.
• To answer messages and support requests, and tell admins about changes to the Services.
• To find and fix faults, and to understand which features are used, in aggregate.
• To meet legal obligations.

We do not sell personal data, and we do not use it for advertising.

5. Attendance, selfies and location

When an organization uses Cordyna Adsum, a person is asked for consent before any selfie or location is captured. With that consent:

• A selfie taken at check-in is compared with the person's reference photos to confirm it is them. Face matching runs on Amazon Rekognition in Mumbai.
• The phone's location is checked against the office when a person checks in or out. A person can instead show a QR code to their supervisor, which needs no selfie or location.
• Adsum never tracks where people go. If the person allows it, the phone notices only when they leave the office after their shift, to remind them to check out.
• Each check-in carries the server's time. Check-ins are never edited afterwards; corrections are recorded as new entries.
• How long selfies are kept is the organization's setting. Face reference photos are deleted when the person leaves the organization.

A person can withdraw consent at any time through their organization. Attendance then has to be marked another way the organization allows, such as the QR code.

6. Cordy, the assistant

Cordy helps people in TaskSense give work, find tasks and move deadlines when asked. To answer, Cordy sends the relevant task details to an AI model provider. People's names are replaced before anything is sent, so they never reach the model. Every change Cordy suggests waits for the person's approval. Conversations with Cordy are deleted 90 days after their last use.

7. Messages sent through this website

When you use the contact form on cordyna.com, we receive the product you are asking about, your name and mobile number, and, if you give them, your email address, company, team size and message, together with the page you sent it from.

• We use these details only to reply to you and follow up on your message. We do not add you to a mailing list or share your details.
• They are stored in our database in Mumbai. To stop the form being misused, we keep a scrambled code made from your IP address, never the address itself, and limit how many messages one number or connection can send.
• We keep a message for as long as we need it to follow up, and delete it sooner if you ask.

8. Who we share it with

We share personal data only with service providers that help us run the Services, under contracts that limit their use of it, and when the law requires it. We do not share it with anyone else.

Inside an organization, what each person sees is decided by the organization's roles and settings.

9. Where it is stored

Our servers, database and files are in India: in Mumbai, with a backup of files in Hyderabad. Some providers listed above, such as those for push notifications and AI answers, may process limited data outside India. Where they do, it is only for the purpose shown and as the DPDP Act allows.

10. How long we keep it

• Workspace data is kept for as long as the organization keeps its Cordyna account. When an account is closed, we delete its workspace data within a reasonable time, except where the law requires us to keep it.
• Face reference photos are deleted when a person leaves the organization. Selfies are kept for the period the organization sets.
• Conversations with Cordy are deleted 90 days after their last use.
• Messages sent through this website are kept as section 7 describes.
• Billing records are kept for as long as Indian tax law requires.

11. How we protect it

• All traffic is encrypted in transit, and data is encrypted at rest by our hosting providers.
• Files are private. They open only for signed-in people who are allowed to see the record they belong to.
• Sign-in uses one-time codes, with two-step verification available. Sessions end after a period without use.
• Admin changes are recorded with who made them and when.
• Access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach affects your personal data, we will tell the affected organizations, the people concerned and the Data Protection Board of India as the law requires.

12. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct, complete, update or erase it;
• withdraw consent you have given, as easily as you gave it;
• nominate someone to exercise these rights if you die or cannot act; and
• raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

For workspace data, we will pass your request to your organization and help it respond. Withdrawing consent does not affect anything done before you withdrew it.

13. Children

The Services are for businesses and are not meant for anyone under 18. We do not knowingly collect personal data from children.

14. Cookies and this website

This website does not use advertising or tracking cookies. Our hosting provider keeps short-lived logs of requests, such as IP addresses, to keep the site secure. The Cordyna apps store a sign-in token on your device so that you stay signed in.

15. Changes to this policy

We will update this page when our practices change and show the date of the latest version at the top. If a change materially affects how we use personal data, we will tell organization admins before it takes effect.

16. Contact and grievances

For questions, requests or grievances about personal data, write to our Grievance Officer. We will acknowledge your message and resolve it within 30 days.

Grievance Officer: Vinayak Garg, Green Bottle LLP, India
Email: [email protected]

Subscriptions are billed by Green Bottle LLP, India. GSTIN 07AARFG1277C1ZE.