Vasco Privacy Policy

The Vasco services are provided by PT Vasco Digital Indonesia, business identification number (NIB) 1908260046886, located at MMTC Block L No.39, Medan, Indonesia.

Vasco is a business-to-business service. For worker data and operational data entered by customers, the customer company determines the purposes for which the data is used and acts as the data controller; Vasco processes that data to provide the service in accordance with the company's instructions and settings. Vasco is the controller of the data we need for our own purposes to manage accounts, security, subscriptions, support, compliance and product improvement.

If you are a worker, the company you work for is usually the first point of contact for requests concerning employment records. You may also contact Vasco using the details below.

The types of data depend on the features used and the data entered by the company or its users.

• Identity & contact

  Name, email address, telephone number, physical address, job title, role, worker code and other contact information.

• Projects & operations

  Schedules and shifts, attendance, tasks, teams, projects, work locations, customers, vendors, documents, approvals and activity records.

• Finance, payments & tax

  Bank accounts or payment methods, rates and payroll, salary advances (kasbon), expenses, invoices, purchases, subscription history, tax identification numbers (NPWP) and other tax data entered by users.

• Health & absence

  The type of and reason for leave or permission, and attachments that may reveal health information if a user chooses to upload them.

• Location

  Precise or approximate location for attendance and for verifying distance from a work location. Location monitoring during an active shift is available on Android with additional permission.

• Face & biometrics

  Camera images for face enrolment and matching, encrypted biometric templates linked to the worker and company, consent status, and attendance verification evidence and records. Details are set out in the face attendance section below.

• Content & communications

  Photos or visual attachments, field reports, transaction receipts, messages, comments, support emails or messages, and other content you submit.

• Identifiers & devices

  User or worker IDs, internal company IDs, IP addresses, browser, device and operating system information, session or network metadata, and device tokens for push notifications.

• Product usage

  Screens and features used, in-app actions, use of the AI Assistant, and access and security records associated with the account. This may include authentication logs, API or server function requests, access times, request outcomes and security events, used to prevent misuse and maintain service reliability.

• Website & analytics

  On the vasco.id website, the sign-up pages (vasco.id/trial and app.vasco.id/daftar) and the email confirmation page (app.vasco.id/auth/verified), we use Google Analytics 4 and Google Ads to process page URLs and titles, referring pages, campaign parameters (such as utm_source and utm_campaign) and Google ad click IDs, session statistics, approximate location, browser or device information, and certain interactions such as consultation clicks, sign-ups, email verification, trial starts (with the number of modules and team size selected), contacts and downloads.

Google Analytics 4 uses first-party cookies, such as _ga, to distinguish visitors and sessions. Google Ads uses cookies such as _gcl_au and _gcl_aw to measure whether a visit from an advertisement leads to a sign-up or trial, and for remarketing, that is, showing Vasco advertisements to people who have previously visited vasco.id when they use other websites or apps. Google also receives IP addresses as part of web communications and may use them to determine general location. The events we define do not include names, email addresses, telephone numbers or message content. We also configure GA4 to redact recognised email addresses and certain query parameters before events are sent.

When you sign up, the source of your visit (campaign parameters, ad click ID, Google Analytics client ID, referring page and landing page) is stored with your company account so that we know which marketing channel brought the user. We may upload the Google ad click ID, together with the time the trial started and the time and value of the first payment, to Google Ads to measure campaign performance, without names, email addresses or telephone numbers.

Within the web app (app.vasco.id), we use Microsoft Clarity to record how pages are used, such as clicks, taps, scrolling and page navigation, so that we can identify confusing areas and improve them. Clarity is configured with strict masking: all text on the page, including what you type such as names, numbers and wages, is masked before it is sent. We do not send your name, email address, telephone number or company name to Clarity.

Data may come directly from you, from your company's administrator, from your device when you grant permission, or be generated when the service is used. Vasco does not request access to your contacts, microphone, web browsing history or advertising data.

On iPhone and iPad, Vasco requests location when you perform an action that requires it, such as clocking in or out and verifying distance from a work location. The iOS/iPadOS app does not run continuous shift location monitoring in the background.

On Android, shift location monitoring is an optional feature. After an explanation is shown and the required permissions are granted, recording starts when a shift is active and stops when the worker clocks out, signs out of the account, or a remote shift closure is detected. With background location permission, the position may be updated while the app is not open, approximately every 120 seconds or after a movement of about 75 metres. The actual interval and stopping time depend on the operating system, device conditions and network.

Location is used to verify attendance, distance from the work location, last known position and movement history during a shift. This data can be viewed by the worker concerned and by company owners or administrators who have been granted access. If the device provides only approximate location, Vasco may receive coarse location.

You may change location permissions in your device settings. If permission is denied or location is unavailable, attendance actions that require GPS verification may be blocked. Contact your company administrator for an alternative way of recording attendance. Maps and distance verification may be less accurate if only approximate location is provided.

Face attendance is an option for recognising enrolled workers on a shared terminal, including an iPad at a work location. The feature uses an ordinary camera, not Apple Face ID, and matching takes place on Vasco's servers, not only on the device. Photos taken by a supervisor as attendance evidence are also distinct from face template enrolment.

• Data collected. During enrolment, an administrator confirms the worker's consent before capturing five images of the face from several angles. An older enrolment flow may use a short video without audio. The server converts the images into a numerical biometric template and stores it in encrypted form together with the worker ID, company, consent version, enrolment time and the identity of the administrator who performed the enrolment. During a scan, two camera images are sent for checking and matching against enrolled workers in the same company.
• Purpose and access. Face data is used to verify identity for attendance and to check for misuse. It is not used for advertising, training AI models, demographic analysis or identity searches across companies. Matching uses a face recognition service operated by Vasco itself using the CompreFace software. Face data is not sent to OpenAI or to any external face recognition API provider. Vasco's infrastructure processes the images; Supabase stores the encrypted templates, private evidence and related records. Server and company user access is restricted according to role and permission.
• Temporary images and attendance evidence. Enrolment images or videos are used only for processing and are not kept as an enrolment photo gallery. Temporary server files are removed after processing. Separately, one image from a scan may be stored as private evidence when clocking in or out. Verification records include the outcome, time, method and transaction identifiers; scans for breaks do not upload new photo evidence.
• Retention period. Face templates do not expire automatically: a template remains stored until it is deleted or replaced through re-enrolment, or until the related worker or company data is deleted. Archiving a worker or signing out does not delete the template. User access to terminal photo or video evidence is limited to 30 days. After that, the files await removal when the web terminal is opened by an authorised company owner; file deletion may occur later than the end of access. The two-minute validity of a scan result for recording attendance is not the retention period of the verification records as a whole. Attendance and audit metadata follow operational, security and retention requirements as described in section 8.
• Choices and deletion. Face enrolment applies to active terminals within the same company. A worker may ask an administrator to select Hapus Data Wajah (Delete Face Data), or contact [email protected] to withdraw consent and request deletion. Deleting a template stops further matching against that template, but does not automatically delete attendance records and evidence already created. A backup PIN may be used without enrolling a face; clocking in or out with a PIN still captures a photo or video as evidence. Contact your administrator if you need an alternative way of recording attendance.

• Creating and securing accounts, sessions, roles and access rights.
• Operating attendance, schedules, projects, stock, purchasing, payroll, salary advances, finance, invoices and reports.
• Storing photo or document evidence and displaying data to authorised company users.
• Sending operational notifications and responding to support requests.
• Preventing misuse, investigating incidents, meeting legal obligations and maintaining the integrity of the service.
• Measuring feature usage internally so that we can improve reliability and the product experience.
• Measuring visits, the performance of content and advertising campaigns, and the paths to sign-up, trial and consultation on vasco.id and the sign-up pages.

The bases for processing may include performance of the service requested by the company, the consent or action of a user when enabling certain features, legal obligations, and legitimate needs to maintain the security and quality of the service. Personal and operational data from the Vasco apps is not used for advertising, except for the trial start time and the time and value of the first payment sent together with the Google ad click ID, as described in the website and analytics section. Website analytics data and sign-up source data may be used to measure marketing and campaign performance, including remarketing through Google Ads.

The AI Assistant is disabled by default. If an owner or administrator chooses to enable it, the app displays an explanation before AI mode is turned on. When it is used, requests are processed through Vasco server functions on Supabase and the OpenAI API service. To answer questions, Vasco may send up to the 24 most recent messages and calls only the relevant data sources through server-side read tools, for example general ledger, project, attendance, payroll, stock, sales, purchasing, approval, asset or document reports. Reasons for leave and medical details are not included. Each tool is limited by the user's access rights, and company figures are re-read from Vasco's own sources rather than taken from what is shown on screen or said in the conversation.

Conversation history is stored locally on the device, limited to the 50 most recent messages per user, and can be cleared from the Assistant screen. Vasco also keeps records of AI usage and of confirmed actions for security, transparency and audit purposes. Actions that change data are carried out only after the user confirms them; the server verifies the proposal, identity, company, permissions, validity period and single-execution status before saving the change.

Expense receipt reading is a feature separate from the AI Assistant. Receipts you attach are stored in private Supabase storage. If you agree to AI reading, the content of the receipt is sent through Vasco's servers to the OpenAI API to recognise transaction details, such as the merchant or payee, date, goods or services, amount, tax and printed payment details. The results are shown as a draft for you to review; the transaction is recorded only after you save it. You may still attach a receipt and enter the expense manually without sending the receipt to OpenAI. The OpenAI training and retention terms below also apply to this feature.

According to OpenAI's data controls documentation, API data is not used to train models by default. API inputs and outputs may be retained in abuse monitoring logs for up to 30 days, unless other retention controls apply or longer retention is required by law or to protect the service and others. Do not enter unnecessary sensitive personal data into AI conversations.

We limit access to what is necessary. Data may be shared with or processed by:

• Users in your company who have the appropriate roles and permissions.
• Supabase for authentication, database, file storage and server functions.
• Expo/EAS and Apple or Google push services for app updates and notifications.
• OpenAI when the AI Assistant or expense receipt reading is used, to process requests, relevant context or receipt content sent through Vasco's servers.
• Apple Maps or Google Maps to display maps and locations.
• Microsoft (Clarity) for recordings of web app usage with masked text, so that we can improve layouts and flows.
• Google LLC (Google Analytics 4 and Google Ads) for analytics on vasco.id and the sign-up pages, measuring advertising results, and remarketing. See how Google uses information from sites or apps that use its services.
• WhatsApp or email apps, only when a user chooses to open that channel and send a message.
• Authorised Vasco personnel for support, security or service maintenance.
• Authorities or other parties where required by law or legal process, or to protect rights and safety.

We do not sell personal data. Some providers may process data outside Indonesia. In such cases, we use contractual arrangements, access controls and reasonable technical safeguards appropriate to the service used and the applicable law.

Data is retained while the account or service relationship is active and for as long as necessary for the requested functions, security, dispute resolution, bookkeeping, tax or legal obligations. Customer companies may also determine the retention period of their operational records. Different types of data may have different retention periods.

Deleting an account removes the login account and the data that can be deleted from active systems. Certain records may be anonymised or retained where the customer company or Vasco is required to keep them. Copies in encrypted backups expire as the backups are overwritten in their normal cycle and are not used again for ordinary operations.

Self-service deletion instructions are available on the Account Deletion page. Manual requests may be sent to [email protected] and may require verification of identity or authority.

In accordance with applicable law, you may request access, a copy, correction, updating, deletion, restriction or cessation of certain processing, withdraw consent, object, and request data portability where available. You may also manage location, camera, photo library and notification permissions in your device settings.

Send requests to [email protected]. We will assess requests in light of the respective roles of Vasco and the customer company, verify the requester, and explain if a request cannot be fulfilled in full because of legal obligations or the rights of others.

You may block or delete cookies through your browser settings, manage personalised advertising in Google My Ad Center, or use the Google Analytics opt-out browser add-on. Blocking analytics or advertising cookies does not prevent access to the Vasco website.

Vasco uses encryption in transit, access controls based on account, company and role, restrictions on internal access, and logging of certain actions. We review these safeguards periodically, but no system can guarantee absolute security. Users are responsible for safeguarding their credentials and for promptly reporting any suspected unauthorised access.

Vasco is intended for business use and not for children. Customer companies are responsible for ensuring that the users they register meet the legal working age and other applicable legal requirements. If we learn that a child's data has been collected without a lawful basis, we will help delete or restrict it.

We may update this policy when our services, providers or legal obligations change. The latest version is always shown on this page with its update date. For material changes, we may provide additional notice through the app or the company's contacts.

For questions, rights requests or privacy reports, contact: