Privacy policy

Who we are

VisiStaff is operated by RegAtlas, LLC. This policy covers the hosted service at app.visistaff.app, the VisiStaff Android, iPhone and desktop apps when they connect to it, and this website. If your company runs its own VisiStaff server, that company is responsible for the data on it.

What we collect

• Account details: your name, email address and a hashed password. We never store your password itself.
• Work records: the companies you belong to and your role, clock-in and clock-out times, and the tasks, checklists, comments and photos you or your colleagues add.
• Activity, only if your company turns it on: see Activity tracking below.
• Devices: the name and type of each signed-in device and its session identifiers. For notifications, Firebase Cloud Messaging processes installation identifiers, push tokens, app versions and technical device information so it can deliver messages.
• Server logs: IP addresses and request details, kept briefly to run the service and stop abuse.

The apps contain no advertising or third-party analytics, and we don’t sell or rent your data.

The Android app does not record your screen, keyboard or mouse activity, or access your device’s location, microphone, camera or address book. The desktop-only activity features below are not part of the Android app.

This website counts page views and the referring site with a cookieless analytics service we run ourselves. It stores nothing on your device and assigns you no persistent identifier, so it can’t follow you between visits.

Activity tracking

A company’s owner can switch on activity tracking for remote work. It is off unless they do. When it is on, the VisiStaff desktop app, while you are clocked in to that company and only then, records:

• Activity level: for each 10 minutes, how many seconds had any keyboard or mouse input. Never which keys you pressed, what you typed, where the pointer went, or which apps or websites you used.
• Screenshots, if the owner also chooses them: one picture of your screens at a random moment in each 10 minutes.
• Idle time, if the owner chooses it: when you come back after a stretch with no input, the app asks whether to keep that time or remove it from your hours.

The app shows that tracking is on whenever it is recording. You can see everything recorded about you on the web, and remove any 10 minutes, which deletes its activity and screenshots and removes that time from your hours. Your company’s owners and managers can see your activity and screenshots for that company. Screenshots are deleted 60 days after they are taken, and when you delete your account.

Who can see it

Your company’s owners and managers can see your name, email, role, hours, the work you’re part of and, if the company tracks it, your activity. People in other companies can’t. If you belong to several companies, each one sees only its own records.

Service providers

We use these providers only to run the service:

• Hetzner hosts the servers and database in Hillsboro, Oregon, USA.
• Amazon Web Services (SES) sends account, invitation and password-reset emails.
• Google Firebase Cloud Messaging delivers push notifications. Notifications contain only a generic message and an ID; details load inside the app.
• Cloudflare provides DNS, serves this website and runs its page-view analytics.

Security

All connections use TLS. On iPhone, sign-in credentials are kept in the device Keychain. On Android, saved sign-in credentials are encrypted using a key protected by Android Keystore; access tokens stay in memory. Access to production systems is limited to the people who operate the service.

Deleting your account

You can delete your account in the Android or iPhone app under Settings → Delete account, using your current password. You can also request account deletion without installing the app. Deletion removes your account name, email, password, signed-in devices and notification settings. Companies where you were the only member are deleted with all their data.

Hours you worked for a company are payroll records that employers are often required by law to keep, so they stay with that company under the name “Former member”, without your name or email. If you’re the only owner of a company with other members, make someone else an owner first.

Shared company work records, including tasks, comments and audit history, can remain with the company under “Former member”. Text or photos you previously added can contain information you supplied; contact support if you need help with personal information in those records.

How long we keep data

We keep your data while your account is active. Expired sign-in sessions, email links and invitations are purged automatically, and activity screenshots after 60 days. Backup copies can retain deleted data until those copies are replaced or deleted. Contact support about personal information that may remain in retained company records or backups.

Your choices

You can correct your details, turn notifications on or off for each company, sign out other devices and delete your account in the app. For anything else, including a copy of your data, contact us at support@visistaff.app.

Children

VisiStaff is intended for adults in workplace settings. It is not designed for children.

Changes

If we make material changes, we’ll update this page and the effective date, and tell account holders by email.