Privacy Policy

Unikin is gate pass and visitor management software used by organisations to control and record entry to their premises. It is available as an Android application and as a web portal, both serving the same roles and functions.

This policy explains what information Unikin handles and why.

Who is responsible for your information. Unikin is supplied to organisations, and each organisation decides what information is collected at its gate, who may see it, and how long it is kept within the limits described below. That organisation is the controller of those records; we operate the software on its behalf. If you are a visitor, candidate, or employee and you want to see, correct, or delete information held about you, the organisation whose premises you visited is the right first point of contact. See Your Rights.

Information We Collect

Information entered by users of the Service

• Visitor details, entered by a guard at the gate: name, contact number, the person or department being visited, purpose of visit, vehicle details where recorded, and time of entry and exit.
• Candidate details, where an organisation records people attending interviews.
• Employee and account information, provisioned by the organisation: name, employee identifier, role (Guard, Employee, Supervisor, Admin, or HR), assigned supervisor, department, and work contact details.
• Pass records: visitor gate passes, employee exit passes (returnable and non-returnable), and monthly passes issued in bulk, including who requested a pass, who approved or rejected it, and when.
• Item records: descriptions of items carried in or out, and whether returnable items came back.
• Movement logs: entry and exit timestamps recorded against employees and visitors.

Information collected automatically

• Account activity: sign-in times and the actions taken under an account, so that approvals and pass decisions can be attributed accurately.
• Device and technical information: device model, operating system version, app version, and IP address, used for security and to diagnose faults.
• Diagnostic information: error and crash reports.

Device permissions (Android)

• Camera — to capture visitor photographs and to scan pass codes at the gate.
• Notifications — to alert employees and supervisors to approval requests awaiting action.
• Photos and media — to attach images to visitor or item records.

Permissions are requested when the relevant feature is first used and can be revoked in Android settings, though some features will not work without them.

What we do not collect. Unikin does not collect background or continuous location, does not access your contacts, call logs, or messages, and does not track you across other apps or websites.

How We Use It

Information in Unikin is used to:

• Generate visitor gate passes once a host employee has approved the visit, and make them verifiable at the gate
• Route approval requests to the correct host employee or assigned supervisor, and to an administrator where a supervisor's own request needs approval
• Issue and validate employee exit passes and monthly passes
• Record and reconcile item movement, including whether returnable items were returned
• Produce the reports available to administrators, covering visitor passes, exit passes, items, employee movement, and candidate entries
• Maintain an accurate record of who approved what, and when
• Keep the Service secure, investigate misuse, and diagnose technical faults
• Meet legal obligations that apply to us or to the customer organisation

We do not sell personal information. We do not use visitor or employee data for advertising, and we do not build advertising profiles.

Data Retention

Report records. Records visible in the reports module — visitor passes, employee exit passes, items, employee movement, and candidate entries — are retained for 3 months, after which they are removed from the reports available to administrators.

Account information. Accounts and their associated details are retained for as long as the organisation keeps the account active. When an organisation deactivates an account, we retain a minimal record of the account identifier so that historical approvals remain attributable while those records still exist.

Backups and logs. Encrypted backups and technical logs may hold copies of data for a short additional period as part of normal operation before being overwritten on a rolling basis.

Deletion requests. If your organisation asks us to delete its data, we will do so within a reasonable period, other than where we are required to keep it by law. Individual deletion requests should go to the organisation, which can act on records within the Service and can instruct us where more is needed. See Your Rights.

On termination. When an organisation stops using Unikin, its data is deleted or returned as set out in its agreement with us and in our Terms of Service.

Third-Party Services

We use third-party providers to host and operate Unikin. These providers process data on our instructions and are not permitted to use it for their own purposes.

Cloud hosting and storage

• Amazon Web Services (AWS) — application hosting, in the ap-south-1 region (Mumbai, India).
• Supabase — PostgreSQL database hosting, running on AWS infrastructure in the ap-south-1 region (Mumbai, India).

Push notifications

• Expo Push Notification Service, operated by Expo (United States) — delivers approval and pass notifications to the Unikin Android app. Notifications are relayed onward through Google Firebase Cloud Messaging (FCM).

Push notification content and the device token needed to reach your device pass through Expo's servers in the United States and through Google's messaging infrastructure. We keep notification content minimal and avoid including visitor details or other personal information in the notification text itself.

We do not currently use a third-party crash reporting, analytics, advertising, or email delivery provider.

We may also disclose information where required by law, court order, or a lawful request from a public authority; where necessary to establish or defend legal claims; or to protect the rights and safety of users and the public. Where a business transfer such as a merger or acquisition occurs, information may transfer as part of that transaction, subject to this policy.

Data location and transfers. Unikin records — including visitor details, employee accounts, pass records, item records, and movement logs — are stored in India, in the AWS Mumbai (ap-south-1) region. The one exception is push notification delivery, described above, where notification content and device tokens transit servers in the United States. Where information is transferred outside India, we take steps to ensure it remains protected to a comparable standard.

Security

We use reasonable technical and organisational measures to protect information in Unikin, including encryption of data in transit, role-based access controls that limit what each account can see, and restricted administrative access to production systems.

No system is completely secure. Users must keep their credentials confidential and must not share accounts, since Unikin attributes approval decisions to the account that made them. If we become aware of a breach affecting personal information, we will notify the affected organisations and any authority we are required to inform, without undue delay.

Your Rights

Depending on your role and the law that applies to you, you may have the right to access the information held about you, to have inaccurate information corrected, to request deletion, to object to or restrict certain processing, and to complain to a data protection authority. Indian users have rights under the Digital Personal Data Protection Act, 2023.

How to exercise these rights:

• If you are a visitor, candidate, or employee whose details were recorded at a workplace, contact that organisation directly. It holds the records and can act on them. We cannot amend or delete an organisation's records on the instruction of an individual, because we do not control them and cannot verify a request against the organisation's own policies.
• If you are an account holder, contact your organisation's Unikin administrator, who can correct your account details or deactivate your account.
• If you cannot identify or reach the organisation, write to us at hello@unikin.in and we will pass your request to the relevant organisation and support it in responding.

We will respond to requests we are responsible for within the period required by applicable law. We may need to verify your identity before acting on a request.

Deleting your account. Accounts are created and removed by your organisation's administrator, so account deletion is requested through them. If your organisation is unreachable, write to hello@unikin.in.

Children

Unikin is workplace software and is not directed at children. We do not knowingly collect information from children through account registration. Where an organisation records a visitor who is a minor, that record is entered and controlled by the organisation under its own policies.

Changes to This Policy

We may update this policy as the Service changes or as legal requirements change. The "Last updated" date at the top of this page reflects the most recent revision. Where changes are material, we will make reasonable efforts to notify customer organisations in advance.

Contact Us

Questions about this policy, or about how information is handled in Unikin, can be sent to hello@unikin.in.