How we look after your data

location_onWhere your data lives

• In the UK. The database, files and face matching all run in London data centres.
• Encrypted in transit (HTTPS) and at rest.

lock_personWho can see what

• Every company’s data is kept apart, and the separation is enforced by the database itself, not just by the app.
• Six roles: owner, admin, manager (only their own sites), HR, billing-only and viewer.
• Pay rates, National Insurance numbers and bank details are visible to HR roles only. The clock-in tablet and the staff app never see them.
• When our support team changes anything in your account, the change is recorded in your audit log under their name.

keySigning in

• Managers: password rules, email verification, an email when someone signs in from a new device, and a list of active sessions with “sign out everywhere”.
• Staff app: five wrong PINs pause the account for 15 minutes; repeated failures across the company pause sign-in and email administrators.
• Revoking a phone’s access signs it out straight away; leavers are signed out automatically.

faceFace recognition and photos

• Face recognition is optional. It only runs for employees whose explicit consent is recorded; PIN or QR badge always works instead.
• At enrolment we keep a face template for matching and the reference photo, both in the UK. They are deleted automatically when the employee is marked as a leaver, and whenever you remove the face or record a withdrawal of consent.
• Clock-in photos are optional and deleted automatically after your retention period (90 days by default).

historyAudit trail

• Every change to a record, every sign-in and every setting is logged with who and when.
• You choose how long the audit log is kept (1 to 10 years), and export it as CSV.

downloadYour data, your control

• Owners and admins can export all of the company’s data at any time, and one employee’s data for a subject access request.
• If you cancel, the panel stays read-only for 30 days so you can export everything; then it is permanently deleted, except invoices we must keep by law.

monitor_heartAvailability

• We aim for 99.9% monthly availability of the panel and of clock-in processing (Terms, clause 15). It is a target, not a service credit scheme.
• Tablets keep clocking in during an outage and sync afterwards.

gavelContracts and registration

• Our Terms of Service include the Data Processing Agreement: you are the controller of your staff’s data, we are the processor. The list of sub-processors is available on request.
• The Privacy Policy covers what we hold about you as a customer and as a visitor to this site.
• High Mesa Ltd, trading as Yumee. Company No. 13626375, VAT GB489456330.

bug_reportReport a security issue

Email support@yumeeservices.com with “Security” in the subject. Check service status for incidents and planned maintenance.