This statement explains how personal data is handled inside eCorpOS —
the business platform at os.ecorpit.com — and by
eClock, the desktop application some organisations use with it for
attendance and, where separately agreed, activity monitoring.
If you are an employee whose work is recorded by eClock: the organisation that asked you to install it decides what is collected and why. eCorpIT stores it for them and cannot change or delete it on request. Ask your employer first — sections 2 and 5 explain exactly what is held, and section 10 explains what to do if your employer does not respond.
eCorpOS puts eCorpIT in two different roles, and almost all of the data is in the second one.
| Data | Our role | Who decides |
|---|---|---|
| Your organisation’s account: the people who sign in, the subscription, invoices we issue you, support correspondence | Data Fiduciary (Controller) | eCorpIT |
| Everything your organisation puts into eCorpOS: your staff records, payroll, your customers and contacts, your invoices, and all eClock attendance and monitoring data | Data Processor | Your organisation |
As a Processor we act on the customer’s documented instructions. We do not decide what an employer collects about its staff, we do not sell it, and we do not use it to train models or for our own marketing. Processing in that role is governed by the customer’s agreement and Data Processing Agreement, which prevail over this statement if they conflict.
This statement is written under the Indian Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and — where they apply to a customer or their staff — the EU and UK GDPR. eCorpIT’s handling of its own website, marketing and recruitment data is covered separately at ecorpit.com/privacy.
Only what a module is actually used for. An organisation that does not use HR holds no HR records; one that has not bought monitoring collects no activity data at all.
The HR module holds statutory identifiers that Indian payroll requires. Two design decisions limit what is at stake, and we state them because they are verifiable rather than reassuring:
We do not collect caste, religion, political opinion, trade-union membership, sexual orientation, or genetic or biometric identifiers. Blood group is held only where an employer records it for emergency contact purposes.
eClock is installed by an organisation on computers used for work. What it records is set by that organisation and shown to the person before anything is collected.
This is attendance, not surveillance, and it is the whole of what an HR-only installation collects.
How a person is told depends on which edition of eCorpIT’s monitoring notice their employer has adopted. Under notice v4 or later, monitoring is part of how the employer runs its business (Digital Personal Data Protection Act 2023, section 7(i)): the employer’s package decides which of these are recorded, and the person reads the whole notice on their own computer before anything is recorded; they are told, not asked. Under an earlier notice, each of these is a separate permission, shown by name on screen before enrolment finishes and refusable individually:
Under an earlier notice, consent can be withdrawn. Declining a permission at re-enrolment withdraws it, and the agent stops collecting that category on its next check. Where an employer changes what it asks for or reworks its notice, existing agreements stop applying and each person is asked again before collection resumes.
Under notice v4 a person cannot switch off part of what the package records. Clocking out, or taking a break, still stops everything at once; blocking still needs their own agreement; and the rights in this statement are what they have instead of a refusal. When a new edition is adopted, nothing is recorded from a person until they have read it.
Live view. Where the employer’s package includes screenshots, an owner or administrator may watch a person’s screen live, for up to fifteen minutes, while they are clocked in. A banner on the screen names the viewer for the whole time, chat windows are blurred as in screenshots, and nothing of the picture is kept. From eClock 0.6.0 the picture is encrypted end to end between the computer and the viewer’s browser and relayed through Cloudflare Realtime, which cannot read it. Who watched which computer, and when, is on the person’s own record.
Remote control (eClock 0.6.0, only where the package includes it and the employer has adopted notice v5). The owner, or an administrator the owner allows, may control a computer for up to an hour: its screen, pointer and keyboard, copied text, and files sent to it or picked on it in its own Open window. The person is asked each time and nothing happens until they press Allow, unless they have themselves allowed control without asking on that computer; then the controller must first enter a code sent to their own email, and the person is told afterwards who it was, when, and which files moved. A banner names the controller for the whole session and has a Stop button, and nobody can clock the person in or out, or agree to anything in eClock in their name, while it lasts. The screen and everything typed or copied pass encrypted end to end and are not stored. What is kept is the record: who controlled which computer, when, how it ended, and each file’s name, size and direction — never its contents. Where the employer records sessions, the banner says so, and the recording is encrypted under the organisation’s key, kept for 90 days, and watchable by the person on their own record; every playback is recorded. eCorpIT’s staff can never view or control a customer’s computer, even under a support grant.
Managers and two figures (only where the employer has adopted eCorpIT’s monitoring notice v6). A person’s manager — anyone they report to, directly or through others — may see what is recorded of them from the day the employer adopted v6, and cannot view or control their screen, lock their computer or change its settings; every look is on the person’s own record. eCorpOS works out two figures for each person and day from what is recorded: productivity, productive time as a share of time at the computer, and effectiveness, productive time against the shift’s hours. Neutral and uncategorised time never count against the person, they see their own, and nothing is decided about them by the figures alone. For a YouTube channel rule, eCorpOS asks Google which channel published a video, with the employer’s own key, sending only the video’s identifier.
Daily summaries and screen labels (only where the employer has adopted eCorpIT’s monitoring notice v7). From 22 November 2026, a language model run with Cloudflare Workers AI may word each person’s daily summary from that day’s figures: it is given no name, screenshot, window title or page address, its requests are not logged, and Cloudflare does not train on them. Code checks every sentence and supplies every number; the person and the people who may see their record read the same text, and the person can add a note to it. Where the employer switches screen labels on, eClock reads the text on each screenshot on the person’s own computer only to label the kind of work it shows; the words never leave the computer, and a part the employer has chosen to blur is not read.
Who published a video. Where an employer has turned on network rules, eClock may ask Google’s YouTube API or Meta’s oEmbed service who publishes a video or post that was opened — the channel or account, not the title — so a rule can be written about a publisher rather than about an opaque link. Only the video or post identifier is sent; nothing about the person is. The answer is cached so the same identifier is not looked up twice.
| Data | Kept for |
|---|---|
| eClock monitoring data — visible to the employer | The period their plan sets (30, 90 or 180 days), fixed at the moment of capture |
| eClock monitoring data — sealed copy held by eCorpIT | At least 365 and at most 380 days from capture, then destroyed with the screenshots. The store itself destroys each screenshot object 366 days after it was uploaded, and an upload may follow its capture by up to 14 days. |
| Attendance records | As long as employment records are required, under the employer’s own retention rules |
| Payroll, tax and statutory records | As required by Indian tax and labour law |
| Invoices and accounting records | As required under the GST and Companies Acts |
| Unsubscribes and bounce suppressions | Permanently — deleting one would allow the address to be re-added |
| Live-view and remote-control records, with the names and sizes of files moved | For the life of the account, on the person’s own record |
| Recordings of remote-control sessions | 90 days from the session, then destroyed; the storage service deletes each recording 91 days after it was uploaded |
| Audit log — changes | Retained for the life of the account; it is the record of who changed what |
| Audit log — looks at monitoring data | 365 days from the look, then deleted; the same year the pictures themselves get |
| Sign-in sessions and codes | Short-lived; codes expire in minutes, sessions on sign-out or expiry |
A retention period is fixed when data is captured, not when it is deleted. If an organisation later changes its retention setting, data already collected keeps the period that applied when it was recorded. A longer setting does not reach backwards.
The sealed one-year copy is held for dispute and legal-hold purposes. Nothing in the product reads it, no screen displays it, and window titles, page addresses and screenshots inside it stay encrypted under the organisation’s own key. When an organisation’s data is erased, that key is destroyed and the sealed copy becomes unreadable — which is what makes the erasure real rather than a deletion we ask you to trust.
We do not sell personal data. It is shared only with the providers that run the service:
| Provider | Purpose | Where |
|---|---|---|
| Cloudflare | Application hosting, database, file storage, queues, and the live video relay (Realtime) for live view and remote control, which carries end-to-end encrypted traffic it cannot read; from 22 November 2026, Workers AI, which words eClock’s daily summaries from figures with no name attached | Global edge network |
| Amazon Web Services (SES) | Sending email and processing bounces | United States |
| Razorpay | Card and UPI payments for subscriptions and invoices | India |
| Microsoft, Google or Zoho | Reading a connected mailbox, only where a user connects one | Provider’s region |
| Google (YouTube Data API) | Resolving a video title, only where address recording is enabled | United States |
We also disclose data where the law requires it — a court order, a tax authority, or a lawful request we are obliged to answer. Where we are permitted to tell the customer first, we do.
eCorpOS is operated from India. Data is stored on Cloudflare’s network and email is sent through Amazon SES in the United States, so personal data is processed outside India and outside the EEA and UK. Transfers rely on the providers’ contractual protections, including Standard Contractual Clauses where GDPR applies.
Subject to the law that applies to you, you may ask to access your data, correct it, have it erased, restrict or object to its processing, receive a copy, and withdraw consent you have given.
Ask your employer or the organisation that holds your data first. For almost everything in eCorpOS they are the Data Fiduciary and we act on their instructions — we are not permitted to alter or delete their records on a third party’s request, and doing so could destroy something they are legally required to keep.
If they do not respond, or you believe they are misusing the platform, write to grievance@ecorpit.com. We will assist and, where required, act. You may also complain to the Data Protection Board of India or, in the EEA or UK, your supervisory authority.
eCorpOS scores sales leads and categorises applications as more or less productive to produce summaries. These are aids to a human decision and produce no legal or similarly significant effect on their own. No employment decision is made automatically by eCorpOS. Where an employer uses monitoring data in a decision about someone, that is the employer’s decision, and their own policy governs it.
eCorpOS is a workplace product and is not offered to children. Accounts are for adults acting for an organisation. The only data about a child that may appear is a dependant’s name and date of birth recorded by an employer for benefits, entered by the employee. eClock is never installed on a child’s device by us, and we do not knowingly process children’s data for any other purpose.
Where a breach affects personal data we hold, we notify affected customers without undue delay, with what we know, what we are doing, and what they should do. Where we are the Fiduciary we notify the Data Protection Board of India and, where GDPR applies, supervisory authorities within the statutory deadlines. Where we are a Processor we notify the customer so that they can meet theirs.
Suspected vulnerabilities can be reported to security@ecorpit.com. We will not pursue good-faith research that respects privacy and does not degrade the service.
Material changes are announced in the product before they take effect. Where a change alters what eClock collects or how long it is kept, the disclosure is re-versioned and affected people are asked again — an existing agreement does not carry over to new terms.
Version 1.7 (23 October 2026) describes eCorpIT’s monitoring notice v7, for organisations that adopt it: daily summaries a language model may word from 22 November 2026, and screen labels read on the person’s own computer (section 4).
Version 1.6 (19 October 2026) describes eCorpIT’s monitoring notice v6, for organisations that adopt it: a person’s manager seeing what is recorded of the people who report to them, the two figures per person (section 4), and the YouTube lookup a channel rule makes. Nothing changes for an organisation that keeps an earlier notice.
Version 1.5 (17 October 2026) describes live view, which section 4 had left out since it arrived with eClock 0.5.0, and remote control, for organisations that adopt eCorpIT’s monitoring notice v5 with eClock 0.6.0: what is kept about a session, the optional recording and its 90 days (section 5), the clipboard during a session (section 4), and Cloudflare Realtime as the relay (section 7). Nothing is collected without the person being told first, and remote control is asked for each time unless the person has allowed it themselves.
Version 1.4 (15 October 2026) describes eCorpIT’s monitoring notice v4: monitoring under it rests on employment rather than consent (sections 4 and 6), people are told rather than asked, and nothing is recorded from a person until they have read it. It also corrects section 4’s statement that eClock never blocks anything: since notice v3 it can, only where the employer turns blocking on and the person agrees to it themselves. Organisations that keep an earlier notice are unaffected.
Version 1.1 (15 September 2026) added web addresses to section 4, for organisations that ask for them with eClock 0.2.0 or later. Every such organisation re-issues its own notice, and each person is asked again before an address is recorded.
Version 1.2 (17 September 2026) states the sealed copy's life as a range — at least 365 and at most 380 days from capture — because from eClock 0.3 screenshots are destroyed by the storage service itself, 366 days after they were uploaded, rather than by a nightly job counting from the day of capture. Nothing is kept longer than before beyond the days an upload may lag its capture; nothing new is collected, so no one is asked again.
Version 1.3 (21 September 2026) corrects two rows rather than changing anything that is collected. The audit log is split in two: changes are still kept for the life of the account, and a record of somebody LOOKING at monitoring data is now deleted after 365 days — which is what the product has done since 17 September, and what this statement should have said then. And the video lookup is described as what it is: the publishing channel or account rather than a title, Meta as well as Google, and gated on network rules rather than on address recording. Nothing new is collected and nothing is kept longer, so no one is asked again.