Privacy Policy

• Account details: name, work email address, company and role, and your password (stored only as a secure hash) or the sign-in provider you choose.
• Attendance records: check-in and check-out times, the approved place used (office, approved home or an approved other place), work schedule and requests you make, such as a request to work somewhere else.
• Location: your device’s GPS position at the moment you check in or out, and, while the app is open during a session, a periodic check that you are still at the approved place. We do not track location when the app is closed. Approved home addresses are visible only to the people your company allows to approve them.
• Device and security data: browser or device type, IP address, sign-in times and two-factor authentication status, used to keep accounts secure.
• Billing: plan, seats and payment status. Card and bank details are entered on Paystack’s or Moniepoint’s pages and are never stored by us.

If you choose “Continue with Google” or Microsoft, we receive only your name, email address and profile picture from that provider, to create and sign in to your account. We do not request access to your email, files, contacts or calendar.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, or share it except as described in this policy.

• To run the service: verify check-ins against the approved place and schedule, show attendance to the right managers and produce reports.
• To send service emails: sign-in links, invitations, approvals and billing notices.
• To keep the service secure, prevent misuse and fix problems.
• To meet legal, tax and accounting obligations.

Within your company, access follows the roles your administrators set. Ordinary managers see attendance status, not precise coordinates or home addresses.

Kora Forge staff can see a company’s staff and attendance data only when that company grants support access, and that access is recorded.

We use trusted service providers to run 5ime: Supabase (database and authentication), our cloud server host, Resend (email delivery), Paystack and Moniepoint (payments) and OpenStreetMap services (maps and address search). They process data only to provide their service to us. We do not sell personal data.

Attendance records are kept for as long as your company keeps its 5ime account, or shorter if the company deletes them. When a company closes its account, its data is deleted within 90 days, except billing records we must keep by law.

You can ask to access, correct or delete your personal data, object to its use or ask for a copy. For attendance data, please contact your company’s administrator first, as they control it; you can also email us and we will help. You may complain to the Nigeria Data Protection Commission.

Data is encrypted in transit, access is limited by role and row-level database rules, administrators can be required to use two-factor authentication, and sensitive actions are logged.

If we make significant changes, we will update the date above and tell company administrators by email or in the app.