Privacy Policy

We do not sell your personal information. We share information only in these limited circumstances:

• ›Within your organization: administrators and staff members of your organization can view attendance records, profiles, and reports for members of that organization.
• ›Service providers: we use vetted third-party vendors to help operate the Service (e.g., cloud hosting, email/SMS delivery, analytics). These vendors access your data only to perform services on our behalf and are bound by confidentiality agreements.
• ›Business transfers: if TurnoutHQ is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.
• ›Legal requirements: we may disclose information when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect the rights, property, or safety of TurnoutHQ, our users, or others.
• ›With your consent: we will share information for any other purpose with your explicit consent.

The Attendly mobile app (Android) functions as a kiosk check-in device for organizations. It requests the following device permissions:

• ›Camera: used to scan QR codes for attendee check-in and to capture session photos. Camera access is active only while the scanning interface is open.
• ›NFC (Near Field Communication): used to read NFC-enabled badges for contactless check-in. NFC data is read-only and is not written to or stored on badges.
• ›Local storage (encrypted): the app stores attendance data locally in an encrypted database when the device is offline. This data is synced to our servers when connectivity is restored and then removed from local storage per your organization's retention settings.
• ›Network access: used to sync data with TurnoutHQ servers and to authenticate kiosk devices.

The Attendly app does not transmit camera or NFC data to third parties. All captured data is sent only to your organization's TurnoutHQ account.

We use the following technologies to operate and improve the Service:

• ›Session cookies: set when you sign in to maintain your authenticated session. These are deleted when you sign out or close your browser.
• ›Preference storage (localStorage): we store your UI preferences such as theme (light/dark mode) and language in your browser's local storage. This data stays on your device and is not transmitted to our servers.
• ›CSRF tokens: short-lived tokens included in forms to protect against cross-site request forgery. These are not used for tracking.
• ›No third-party advertising trackers: we do not use advertising cookies, third-party pixel trackers, or cross-site tracking technologies.

Most browsers allow you to control cookies through their settings. Disabling session cookies will prevent you from signing in to the Service.

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

• ›Account data is retained for the lifetime of your organization's account and for up to 90 days after account closure, after which it is permanently deleted.
• ›Attendance records are retained for as long as configured by your organization administrator (default: indefinitely while the account is active).
• ›Audit logs are retained for 12 months for security and compliance purposes.
• ›Backups may persist for up to 30 additional days after deletion before being purged from backup systems.

You may request deletion of your personal data at any time (see Your Rights).

We implement industry-standard technical and organizational measures to protect your information, including:

• ›Encryption of data in transit using TLS 1.2 or higher.
• ›Encryption of sensitive data at rest (including local mobile storage using AES-256).
• ›Hashed password storage (bcrypt) — we never store passwords in plain text.
• ›Two-factor authentication (TOTP) available for all accounts.
• ›Role-based access controls that limit data access to authorized personnel only.
• ›Regular security reviews and audit logging of sensitive operations.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users as required by applicable law.

Depending on your location, you may have the following rights regarding your personal data:

• ›Access: request a copy of the personal data we hold about you.
• ›Correction: request that we correct inaccurate or incomplete personal data.
• ›Deletion: request that we delete your personal data, subject to legal retention requirements.
• ›Portability: request a machine-readable export of your personal data.
• ›Objection / Restriction: object to or request restriction of certain processing activities.
• ›Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@turnouthq.ai. We will respond within 30 days. Note that some requests may be subject to verification of identity and to limitations under applicable law.

To request deletion of your Attendly account and associated data, you may also use our Account Deletion Request form.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

EEA / UK residents have rights under the General Data Protection Regulation (GDPR). Our lawful basis for processing is typically performance of a contract (providing the Service) and legitimate interests (security, fraud prevention, service improvement).

TurnoutHQ is operated in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer. We take steps to ensure that transferred data receives adequate protection consistent with this Privacy Policy and applicable law.

South Korea (PIPA): For users in South Korea, we process personal data in accordance with the Personal Information Protection Act (개인정보 보호법, PIPA). You have the right to request access, correction, deletion, and suspension of processing of your personal data. To exercise these rights, contact us at privacy@turnouthq.ai.