Privacy Policy
The app may be downloaded by anyone, but HR information is available only to users whose account has been created and authorized by a participating company.
1. Who operates the app
SpeedBath HR is operated by Speedbath for Speedbath and participating group companies that use the HR system. The company employing or engaging you is responsible for the employment records it controls and for the customer order records its employees enter. Questions may be sent to info@mcbath.in or raised with your HR administrator.
2. Information we process
- Identity and employment data: name, employee code, company, department, designation, reporting relationship, role and employment details.
- Contact and account data: work email or employee ID, phone, address, emergency-contact information, authentication/session information and app version.
- Attendance data: check-in and check-out times, shift and attendance status, leave, regularization, overtime and biometric-machine-derived punch records.
- Location and camera data: device location and a selfie when an authorized mobile attendance flow requires them. For employees placed under an approved tracking policy, location is also collected in the background — including when the app is closed or the screen is locked — between check-in and check-out only, to record the work route. See section 4.
- Customer order data (Orders): the details that sales staff (or an administrator, on a sales person’s behalf) type in about a customer and the order — the customer’s or shop’s name, the customer’s 10-digit mobile number, the quantity, the order value and the company’s order number. Orders taken with an earlier version of the app can also hold the customer’s city and address, the items ordered and a note. We also record each order’s progress through approval, procurement, packing and dispatch: who handled each step and when, purchase-order numbers, and the remarks and reasons entered at each step. Orders taken before the app was introduced were copied in from the company’s earlier order records.
- HR workflow data: requests, approvals, comments and supporting files submitted by the user.
- Employment-service data: payslip availability, policies, notifications, tasks, learning enrolment/progress/answers/certificates, KPI plans/updates/reviews and related audit history.
- Technical and security data: IP address, device/session identifiers, request logs (which can include text typed into the app’s search boxes, such as an order number or a customer’s name), error references and security events needed to protect the service.
3. Why we process it
We process information to authenticate authorized users; administer attendance, leave and HR requests; record customer orders and move them through approval, procurement, packing and dispatch, alerting the employee responsible for each step; provide employment documents and notices; deliver learning and KPI workflows; investigate errors or misuse; maintain audit trails; secure accounts; and meet employment, tax, safety, legal and record-keeping obligations.
4. Permissions
Location (while in use) is requested when the user performs a location-enabled attendance action. Location (background) is requested only from employees an administrator has approved under a named tracking policy, and only after the app has shown a full disclosure stating that location is collected when the app is not in use. Background collection starts at check-in and stops at check-out or, at the latest, at the first limit the policy sets: a set time after the shift ends (2 hours unless the policy says otherwise), a maximum session length (16 hours unless the policy says otherwise) or an optional daily cut-off. Nothing is collected outside a checked-in work session: not between shifts, not on days off and not on leave. While recording runs, the phone shows a permanent notification, and if the phone restarts during the shift, recording resumes. Each recorded point holds the position with its accuracy, speed, altitude and heading, whether the phone was moving, and whether the phone reported a simulated location. If the company has assigned a work area, the route is compared with it and times outside it are recorded. The route can be seen by the employee and by the people named in the notice the employee receives when the policy is approved — the reporting manager and a super administrator or, if the policy says so, the department manager and administrators or the company’s administrators — and it is kept for the number of days stated in that notice (365 days unless it says otherwise), then deleted. The employee may decline, and no location is then collected. Whether attendance can then still be marked in the app depends on the employee’s tracking policy, and the disclosure says which applies before the permission is asked: where the policy requires the route, attendance cannot be marked in the app until the permission is allowed, and the employee can raise this with HR. Every other feature stays usable.
Camera is used for the attendance selfie and field-visit photos. Notifications are used for HR notices, order updates and optional task reminders. The Orders feature uses no additional permission.
5. Sharing
Information is visible only to authorized employees, managers, HR personnel, administrators and service providers to the extent needed for their role. We do not sell employee or customer personal information or use it for advertising. Hosting, device-platform and video providers may process limited technical data when their services are used. Information may also be disclosed where required by law or necessary to protect people, systems or legal rights.
Some screens load content directly from other services. Those services receive your phone’s IP address and what is requested:
- OpenStreetMap (tile.openstreetmap.org) supplies the map images on the visit map, the live-tracking map and the work-area editor. It sees which part of the map is shown, not the recorded positions.
- YouTube plays the training videos in its privacy-enhanced embedded player (youtube-nocookie.com). It sees which video is played.
- Google Play: the app checks its public listing there for a newer version.
- Google Maps opens only when you tap a check-in location, and receives that position.
5a. Customer information (Orders)
When sales staff take an order, the customer’s details are typed into the app by the employee, or picked from that employee’s own earlier orders, and are stored with the rest of the order on Speedbath’s own HR server, which a hosting provider runs for Speedbath. They become part of the company’s own customer order records and are used only to process and deliver those orders, to contact the customer about them and to keep the company’s order records.
Customer details are not sold, not used for advertising and not shared with anyone outside the company, except the hosting provider that stores them for Speedbath, or where the law requires it. The app does not read the phone’s address book, and tapping a customer’s number only opens the phone’s own dialler.
An order, including the customer’s details, can be seen in the app by the sales person it is credited to and anyone who entered it for them, that sales person’s reporting managers, the employees the company has made responsible for approval, procurement, packing and dispatch, and the company’s super administrators.
When an order is punched or moves to its next step, the app’s Inbox alerts the employees who need to act on it and tells the sales person what happened to their order. These alerts quote the order number and the customer’s name (with the city, where it was recorded), and some also give the quantity, the order value or the remark entered. They also appear as notifications on those employees’ phones and, depending on each phone’s settings, can be read on its lock screen.
Customer order records are kept for 8 years after the order is closed (dispatched, rejected, withdrawn or cancelled), and are then deleted or anonymised. A customer whose details were entered in an order can ask Speedbath to see, correct or delete them by writing to info@mcbath.in; every request is answered within 30 days. We verify each request, and delete or anonymise the details unless the order must be kept for tax, accounting or legal reasons, in which case we keep only what that requires.
6. Storage, security and retention
Data is transmitted to the HR service over HTTPS. Access is controlled by authenticated accounts, company scope and role permissions. Sensitive credentials are stored using the device's protected credential storage. Downloaded learning videos are kept in app-private storage. No security system is perfect; users must protect their credentials and report suspected misuse promptly.
Records are retained according to the participating company's employment, payroll, attendance, safety, audit and legal requirements; customer order records are retained as described in section 5a. Orders an employee entered or handled stay part of the company's order records after that employee leaves or deletes their account. Some records cannot be deleted immediately after employment ends because the company must preserve them for lawful business or statutory purposes.
7. Your choices and requests
Send privacy requests — to access, correct or delete personal information — to info@mcbath.in. Every request is answered within 30 days. Employees can also raise them with HR, and can ask for their account to be deleted in the app (More → Delete my account). Customers whose details were entered in an order can make the same requests as described in section 5a. You may also ask HR to deactivate your account. Requests are verified before action, and deletion may be limited where retention is legally or operationally required. See Account & Data Requests.
8. Children and public users
This is a workforce application and is not directed to children. Installing the public app does not create an account or expose HR information. Unauthorized users cannot access protected content.
9. Changes
We may update this policy when app features, data handling or legal requirements change. The latest version and effective date will remain available at this URL.