Privacy Policy
Last updated: June 18, 2026
1. Introduction
Punchual ("we", "our", or "us") is operated by Magnus Digital Sdn Bhd. This Privacy Policy explains how we collect, use, store, and protect information when you use the Punchual mobile application and web dashboard (collectively, the "Service").
By using Punchual, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account Information
When you register, we collect your name, email address, company name, and password to create and manage your account.
2.2 Location Data
Punchual collects precise GPS location data when a staff member performs a punch-in or punch-out. Location is used solely to verify that the staff member is within the designated work geofence. Location data is not collected in the background between punch events.
2.3 Photos and Camera
The app captures a selfie photo at each punch-in to verify the staff member's identity. The photo is processed on-device to extract a facial descriptor (a numeric representation of facial features). The photo itself is not permanently stored on our servers — only the descriptor is retained for identity verification purposes.
2.4 Biometric / Face Data
During onboarding, staff members voluntarily register their face once. Punchual stores a secure AI-generated facial descriptor — not a photograph — associated with the staff member's account. This descriptor is used exclusively for employee attendance identity verification at punch-in. It is never shared with third parties, never used for advertising, profiling, or any purpose other than attendance verification, and is never transferred outside our secure database.
Staff members may request deletion of their facial descriptor at any time by deleting their account from within the app (Home → Delete Account) or by contacting support@punchual.my. Facial descriptors are permanently deleted when the associated staff account is removed.
2.5 Attendance Records
We store punch-in and punch-out timestamps, late flags, overtime records, and leave requests as part of the core attendance tracking service.
2.6 Device Information
We may collect device identifiers and operating system information to detect GPS spoofing and mock location providers as part of our fraud prevention features.
3. How We Use Your Information
- To provide and operate the attendance tracking and staff engagement features
- To verify staff identity and prevent fraudulent punch-ins
- To detect and block GPS spoofing, buddy punching, and time manipulation
- To generate attendance reports for payroll and HR purposes
- To send notifications and announcements within the app
- To improve the reliability and security of the Service
We do not use your data for advertising. We do not sell your data to third parties.
4. Data Storage and Security
All data is stored on Google Cloud (Firebase) infrastructure with industry-standard encryption in transit and at rest. Access to data is restricted to authorised personnel only.
5. Data Retention
Attendance records are retained for as long as your company account is active. Facial descriptors are deleted when a staff member's account is removed. You may request deletion of all company data by contacting us at hello@punchual.my.
6. Data Sharing
We do not sell, rent, or share your personal data with third parties except:
- Google Firebase — cloud infrastructure for data storage and authentication
- Legal requirements — if required by law or valid legal process
7. Staff Consent and Transparency
Employers are responsible for informing their staff that Punchual is being used for attendance tracking, and that facial recognition and GPS location will be collected at punch-in. Staff members must register their face voluntarily during onboarding.
8. Children's Privacy
Punchual is intended for use by adults in a workplace context. We do not knowingly collect data from individuals under the age of 18.
9. Your Rights
You have the right to access, correct, or request deletion of your personal data. Contact us at hello@punchual.my.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Continued use of the Service after changes constitutes acceptance of the updated policy.