Privacy policy

1. Who we are

Cordyna makes business software for teams in India: TaskSense for tasks and approvals, Adsum for attendance, the Cordyna phone app, and this website (together, the “Services”).

Cordyna subscriptions are sold and billed by Green Bottle LLP, a limited liability partnership in India. In this policy, “Cordyna”, “we”, “us” and “our” mean Cordyna and Green Bottle LLP. We follow the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made under them.

2. Your organization's data and ours

Most of the Services are used by organizations for their own people. That gives us two different roles:

• Workspace data. Tasks, comments, files, client records, employee details and attendance records belong to the organization that uses Cordyna. The organization decides why and how that data is used and is the Data Fiduciary for it. We process it on the organization's behalf and on its instructions, as its Data Processor.
• Our own data. For account and billing details, sign-in and security records, support conversations and visits to this website, we decide how the data is used and we are the Data Fiduciary.

If you use Cordyna through your employer or another organization, questions about your workspace data are best sent to that organization first. We will help it respond.

3. What we collect

• Account details: name, mobile number, email address, organization, department, branch and role.
• Workspace content: tasks, approvals, comments, attachments, announcements, schedules, client and service records that people add.
• Employee records, where an organization keeps them in Cordyna: for example joining date and documents it uploads.
• Attendance data (Adsum only): check-in and check-out times, selfies, face reference photos, location at the moment of marking, shifts, leave and requests. See section 5.
• Device and usage data: device type and name, app version, IP address, sign-in times and whether notifications are switched on, used to keep accounts secure and the apps working.
• Billing details: plan, invoices, the billing contact and GST details. Card, UPI and bank details are entered with our payment gateway and are not stored by us.
• Support conversations, including screenshots you choose to send.

4. How we use it

• To provide the Services: showing people their work, sending reminders and notifications, and running the features an organization switches on.
• To sign people in with one-time codes and to keep accounts and data secure.
• To bill subscriptions and keep the records that tax law requires.
• To answer support requests and tell admins about changes to the Services.
• To find and fix faults, and to understand which features are used, in aggregate.
• To meet legal obligations.

We do not sell personal data, and we do not use it for advertising.

5. Attendance, selfies and location

When an organization uses Adsum, a person is asked for consent before any selfie or location is captured. With that consent:

• A selfie taken at check-in is compared with the person's face reference photo to confirm it is them. Face matching runs on Amazon Rekognition in Mumbai.
• The phone's location is checked against the office geofence when a person marks attendance.
• If the person also allows location access in the background, the phone reports when they enter or leave an office geofence, for example to record a check-out automatically. Adsum receives these crossings, not a continuous trail of locations.
• Each mark carries the server's time. Marks are never edited afterwards; corrections are recorded as new entries.
• How long selfies are kept is the organization's setting. Face reference photos are deleted when the person leaves the organization.

A person can withdraw consent at any time through their organization. Attendance that depends on a selfie or location then has to be marked another way the organization allows.

6. Cordy, the assistant

Cordy helps people plan their day and draft updates in TaskSense. To answer a question, Cordy sends the relevant task details to an AI model provider. People's names are replaced before anything is sent, so they never reach the model. Every change Cordy suggests waits for the person's approval. Conversations with Cordy are deleted 90 days after their last use.

7. Who we share it with

We share personal data only with service providers that help us run the Services, under contracts that limit their use of it, and when the law requires it. We do not share it with anyone else.

Inside an organization, what each person sees is decided by the organization's roles and settings.

8. Where it is stored

Our servers, database and files are in India, in Mumbai. Some providers listed above, such as those for push notifications and AI answers, may process limited data outside India. Where they do, it is only for the purpose shown and as the DPDP Act allows.

9. How long we keep it

• Workspace data is kept for as long as the organization keeps its Cordyna account. When an account is closed, we delete its workspace data within a reasonable time, except where the law requires us to keep it.
• Face reference photos are deleted when a person leaves the organization. Selfies are kept for the period the organization sets.
• Conversations with Cordy are deleted 90 days after their last use.
• Billing records are kept for as long as Indian tax law requires.

10. How we protect it

• All traffic is encrypted in transit, and data is encrypted at rest by our hosting providers.
• Files are private. They open only for signed-in people who are allowed to see the record they belong to.
• Sign-in uses one-time codes, with two-step verification available. Sessions end after a period without use.
• Admin changes are recorded with who made them and when.
• Access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach affects your personal data, we will tell the affected organizations, the people concerned and the Data Protection Board of India as the law requires.

11. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct, complete, update or erase it;
• withdraw consent you have given, as easily as you gave it;
• nominate someone to exercise these rights if you die or cannot act; and
• raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

For workspace data, we will pass your request to your organization and help it respond. Withdrawing consent does not affect anything done before you withdrew it.

12. Children

The Services are for businesses and are not meant for anyone under 18. We do not knowingly collect personal data from children.

13. Cookies and this website

This website does not use advertising or tracking cookies. Our hosting provider keeps short-lived logs of requests, such as IP addresses, to keep the site secure. The Cordyna apps store a sign-in token on your device so that you stay signed in.

14. Changes to this policy

We will update this page when our practices change and show the date of the latest version at the top. If a change materially affects how we use personal data, we will tell organization admins before it takes effect.

15. Contact and grievances

For questions, requests or grievances about personal data, write to our Grievance Officer at info@coordina.in, with “Privacy request” in the subject. We will acknowledge your message and resolve it within 30 days.

Grievance Officer, Green Bottle LLP, India.
Subscriptions are billed by Green Bottle LLP, India.