Privacy policy · Operali

Operali is a clock-in app: staff tap an NFC plaque at the store to clock in and out, and their employer gets accurate hours. This policy explains what the app and this website collect, why, where it is kept, for how long, and what you can do about it.

Who we are, and who decides

Operali is made and run by MAAI Software Inc. ("we", "us").

When a business uses Operali for its staff, that business is your employer and it controls its workforce data: it decides who is invited, which stores you work at, and what happens to your hours. We are the service provider: we store and process that data on the employer's behalf and only to run Operali.

For the data we handle for our own purposes, such as account sign-in, security, support and the website, we are responsible.

What we collect

Your name and email address, and the language you use the app in. If your employer added you without an email address, you sign in with a QR code your supervisor shows you, and we hold only the name your employer entered.
Your work details, set by your employer: the company you work for, your role, and the stores you are assigned to. Owners also enter their business details, such as company names and store names and addresses.
Precise location, only at the moment you clock in or out. The app takes one fresh location fix when you tap the plaque, with its accuracy and whether the phone reports the location as simulated. It never tracks you in the background: the app asks for location only while it is in use. We also record whether you were inside the store's area and roughly how far away you were.
Punch times: the time our server records each clock-in and clock-out, the time your phone recorded the tap, the hours that result, and any correction your supervisor makes, with the reason they give.
Plaque taps: which plaque you tapped, its tap counter, and the result of every attempt, accepted or not.
Device information: a random identifier for each punch (so a punch sent twice counts once), technical details in crash reports (operating system, device model and app version), and your IP address, which we use to limit abuse and which Cloudflare Turnstile uses for its bot check.
Support messages: what you write to us, and your email address.
Email delivery records: which invitation emails we sent, and whether an address bounced as permanently undeliverable.

The app uses the camera only to scan the sign-in code your supervisor shows you; it does not store or send images. It reads the NFC plaque only when you tap it.

Why we use it

Clocking in and out: to record when and where you start and finish work.
Fraud prevention: to check that you are at the store when you clock in, that a plaque's code is genuine and used only once, and that the location is not simulated.
Payroll records: to give your employer accurate hours for pay and for the records employers must keep.
Service emails: to send sign-in codes and links, invitations and other messages about your account. We do not send marketing email.
Support and security: to answer your questions, keep accounts safe, and find and fix errors.

We do not sell your data, and we do not use it for advertising.

Where it's stored, and who processes it

Your account and work records are stored in Canada: our database runs on Supabase in Canada (ca-central-1, Montréal), and our servers run on Vercel in Montréal.

These companies process data for us, each for one purpose:

Processor	What it does for us
Supabase	Database and sign-in.
Vercel	Hosts this website and the app's server.
Google Workspace	Sends our emails (sign-in codes, invitations), reads notices that an email could not be delivered, and receives support email.
Sentry	Error reports from the app and the server.
PostHog	Product usage counts, such as how many punches were accepted.
Cloudflare	DNS for our domains, and Turnstile, the bot check at sign-in and on the account deletion form.

Google Workspace, Sentry, PostHog and Cloudflare handle limited data outside Canada, including in the United States: the email itself, error reports, usage events and the bot check. Each processes data only to provide its service to us.

How long we keep it

Hours (your clock-in and clock-out records) are kept for at least 3 years, the time Ontario requires employers to keep employment records.
Raw GPS coordinates are kept for 90 days. After that the coordinates and their accuracy are deleted, and only whether you were inside the store's area, and the rough distance, remain.
Bounced email addresses stay on our do-not-email list for 180 days after the last bounce, then are removed. An address comes off sooner when its owner signs in with an email code, or deletes their account.
When you delete your account, your login and profile are deleted, along with any invitations and queued emails addressed to you. Your hours are kept, anonymised as "Former employee" with a number, because your employer must keep wage records. When you delete from the app, it also clears the punches waiting to be sent, and other data it saved on your phone. Our audit records and the events already sent to PostHog and Sentry keep only a random user ID, with no name or email address; once your account is deleted, that ID no longer links to you. PostHog and Sentry keep those events for the period set by that provider.
When an owner deletes a company, it can be restored for 30 days. After that its hours, punch records, stores, staff and invitations are deleted for good. The owner can export the hours first.

Your rights

Under Canada's privacy law (PIPEDA) and the rules that apply in Ontario, you can ask to:

access the personal information we hold about you;
correct it if it is wrong. You can change your name in the app; for hours, ask your supervisor or employer, who can correct them with a reason;
delete your account. In the app, go to Settings and choose "Delete my account"; if your account has an email address, we confirm with a code sent to it. You can also start from the web, at operali.com/delete-account. An owner must first transfer ownership to another owner, or delete their company and wait for its 30-day restore period to end.

Write to us for anything else. Because your employer controls your work records, we may pass a request about them to your employer, or ask you to contact them. We may need to confirm your identity before acting on a request.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Analytics and crash reports

PostHog receives product events from our server, such as "punch accepted" or "invite sent", with your user ID and your company's ID. They never include your name, email address or location, and PostHog does not locate you from your IP address. The app itself contains no analytics.
Sentry receives error reports from the app and the server: what went wrong, on which screen, with your user ID, your company's ID and technical details about the device. Names, email addresses, codes, sign-in tokens and locations are removed before a report is sent. Sentry never receives screenshots.

We show no advertising, we do not sell your data, and we do not track you across other apps or websites. This website uses no analytics or advertising cookies.

Children

Operali is a workplace tool. It is not for anyone under 16, and we do not knowingly collect information from children under 16. If you think a child under 16 is using Operali, write to us and we will delete their account.

Changes to this policy

When we change this policy, we post the new version on this page and update the date at the top. If a change affects how we use your information in a significant way, we will also tell account owners by email before it takes effect.

Contact

For privacy questions or requests, write to support@operali.com.

MAAI Software Inc.