Privacy Policy

We do not sell your personal information. We share information only in these limited circumstances:

• ›Within your organization: administrators and staff members of your organization can view attendance records, profiles, and reports for members of that organization.
• ›Service providers: we use vetted third-party vendors to help operate the Service (e.g., cloud hosting, email/SMS delivery, analytics). These vendors access your data only to perform services on our behalf and are bound by confidentiality agreements.
• ›Business transfers: if Joyvill is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.
• ›Legal requirements: we may disclose information when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect the rights, property, or safety of Joyvill, our users, or others.
• ›With your consent: we will share information for any other purpose with your explicit consent.

We use the following technologies to operate and improve the Service:

• ›Session cookies: set when you sign in to maintain your authenticated session. These are deleted when you sign out or close your browser.
• ›Preference storage (localStorage): we store your UI preferences such as theme (light/dark mode) and language in your browser's local storage. This data stays on your device and is not transmitted to our servers.
• ›CSRF tokens: short-lived tokens included in forms to protect against cross-site request forgery. These are not used for tracking.
• ›No third-party advertising trackers: we do not use advertising cookies, third-party pixel trackers, or cross-site tracking technologies.

Most browsers allow you to control cookies through their settings. Disabling session cookies will prevent you from signing in to the Service.

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

• ›Account data is retained for the lifetime of your organization's account and for up to 90 days after account closure, after which it is permanently deleted.
• ›Attendance records are retained for as long as configured by your organization administrator (default: indefinitely while the account is active).
• ›Audit logs are retained for 12 months for security and compliance purposes.
• ›Attendance records created by location check-in hold the same information as any other attendance record, plus whether you were inside or outside your organization's boundary and coarse ranges for accuracy and distance. They do not contain your coordinates, and they are retained on the same terms as every other attendance record.
• ›Location check-in attempts — your position rounded to four decimal places (roughly 11 metres), a scrambled code standing for that place, the result, and the accuracy and distance ranges — are kept for 90 days and then deleted automatically. No coordinates are kept at all for two kinds of reading: one too imprecise for us to judge, and one we accepted only because you had produced a better reading minutes earlier. The scrambled code is kept in that second case even though the coordinates are not, because it is what lets us see that several people reported one spot. It is a blind, not anonymisation — with the key that protects it, it could be worked back to the place — so it is treated as information about you and is deleted on the same 90-day schedule as the coordinates. Only your organization's administrators can see this log. Each entry carries a time, so it is a limited 90-day record of where you were at the moments you checked in; it is not, and cannot be assembled into, a continuous track of your movements.
• ›A reading taken only to offer you check-in — when you open your card near the time of one of your classes, before you tap anything — is not stored at all. It is used to answer whether you can check in and then discarded: no coordinates, no accuracy, no scrambled code, and no entry in the check-in attempt log. If you then check in, the app takes a fresh reading for that, and it is kept as described above.
• ›Backups may persist for up to 30 additional days after deletion before being purged from backup systems.

You may request deletion of your personal data at any time (see Your Rights).

We implement industry-standard technical and organizational measures to protect your information, including:

• ›Encryption of data in transit using TLS 1.2 or higher.
• ›Encryption of sensitive data at rest (including local mobile storage using AES-256).
• ›Hashed password storage (bcrypt) — we never store passwords in plain text.
• ›Two-factor authentication (TOTP) available for all accounts.
• ›Role-based access controls that limit data access to authorized personnel only.
• ›Regular security reviews and audit logging of sensitive operations.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users as required by applicable law.

Depending on your location, you may have the following rights regarding your personal data:

• ›Access: request a copy of the personal data we hold about you.
• ›Correction: request that we correct inaccurate or incomplete personal data.
• ›Deletion: request that we delete your personal data, subject to legal retention requirements.
• ›Portability: request a machine-readable export of your personal data.
• ›Objection / Restriction: object to or request restriction of certain processing activities.
• ›Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@turnouthq.ai. We will respond within 30 days. Note that some requests may be subject to verification of identity and to limitations under applicable law.

To request deletion of your Attendly account and associated data, you may also use our Account Deletion Request form.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

EEA / UK residents have rights under the General Data Protection Regulation (GDPR). Our lawful basis for processing is typically performance of a contract (providing the Service) and legitimate interests (security, fraud prevention, service improvement).

TurnoutHQ is operated in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer. We take steps to ensure that transferred data receives adequate protection consistent with this Privacy Policy and applicable law.

If you are in Canada: your information is stored and processed outside Canada, in the United States, by us and by the service providers described in How We Share Your Information. While it is held there it is subject to the laws of that country, and its courts, law-enforcement bodies and national security authorities may be able to compel access to it under their own lawful access powers — in some cases without notice to you, and without the protections you would have under Canadian law. No contractual safeguard we put in place can remove that possibility; we can only limit what there is to disclose.

Why this matters more for location. A location reading taken at a place of worship can support an inference about your religious beliefs, which is precisely the kind of information this notice is about. That is why we ask for your express consent before taking one, keep no coordinates on the attendance record itself, round the coordinates we do keep to roughly 11 metres, and delete them after 90 days — see Canada — PIPEDA and Data Retention. If you would prefer that no location of yours leave Canada, simply do not turn location check-in on: your QR card, your organization's poster, and check-in by a staff member all remain available, and all of them count toward course completion identically.

South Korea (PIPA): For users in South Korea, we process personal data in accordance with the Personal Information Protection Act (개인정보 보호법, PIPA). You have the right to request access, correction, deletion, and suspension of processing of your personal data. To exercise these rights, contact us at privacy@turnouthq.ai.

Joyvill Inc. is based in Toronto, Ontario. Where we handle personal information in the course of our commercial activities in Canada, we do so in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, the substantially similar provincial privacy laws.

Location is sensitive, so your consent must be express. A record placing an identifiable person at a place of worship says something about their religious practice, and Canadian regulators treat information about religious beliefs as sensitive. We therefore do not rely on implied consent for location check-in. Before the app takes any location reading:

• ›You opt in. You are asked in a separate step, for location alone. It is not bundled into our terms of service, and it is not pre-selected or checked by default — nothing happens until you choose it.
• ›You are asked in your own language. The request is presented in the language your app is set to, in plain words, and it tells you what is kept and for how long before you answer.
• ›You can withdraw at any time. You can turn location check-in off in the app's settings, or revoke the permission in your device's settings, without giving a reason and without losing access to anything else.
• ›It is never a condition of service. We will not require your consent to location as a condition of using the Service, of belonging to your organization, or of completing a course. Checking in by QR card, by scanning your organization's poster, or by asking a staff member does exactly the same thing, and a check-in recorded by location counts toward course completion (수료) no differently from any other. This reflects PIPEDA Schedule 1, clause 4.3.3, under which an organization must not, as a condition of supplying a product or service, require consent to collection beyond what is necessary for the explicitly specified purposes.

Turning it off takes effect at once on the phone you turn it off on, whether or not you have a connection, and that phone stops taking readings from that moment. Updating our own record of your choice needs a connection, so if your phone cannot reach us yet the app says so and offers to try again — the phone has still stopped, and that is the part that decides whether a reading is taken at all. If you use Attendly Card on more than one device, another device finds out the next time it tries to check in or to offer you check-in: it may take one last reading and send it before it learns of your decision, but we refuse it without ever working out where you were and keep no coordinates from it, and that device then stops and asks you to decide again. If you withdraw consent, we stop collecting new location readings from you immediately. Attendance already recorded stays as it is — it is your attendance record, not a location record — and any coordinates already held in the check-in attempt log are deleted on the 90-day schedule described in Data Retention, or sooner if you ask us.

If you are not satisfied with our answer. You may complain to the Office of the Privacy Commissioner of Canada. The Commissioner ordinarily expects you to raise the matter with us first, but you do not need our permission to complain and we will not treat you differently for doing so. The Office can be reached at priv.gc.ca or by telephone at 1-800-282-1376.

The rights listed in Your Rights and Choices — access, correction, deletion, and withdrawal of consent — are available to you in Canada as well, and are exercised the same way.