Biometric Information Policy

1. What We Collect

When a member enrolls in face clock-in, the device they use (a station kiosk, a computer, or a phone) uses its camera to capture images of their face. Software running on that device turns the images into a face template: 128 numbers that describe the geometry of the face. Only the template is sent to us. We store one template per member per Organization.

When the member later clocks in with their face, the device creates a new template from the camera and sends it to us. We compare it with the enrolled templates in the same Organization to find a match, and we do not keep the new template after the comparison.

We also store information about the enrollment: its status, when it was made or updated, how many samples were used, whether the member or an administrator enrolled it, and whether an administrator approved it.

We do not store face photos or video for face clock-in, and the camera images do not leave the device. A profile photo a member uploads is a profile photo; we do not create a face template from it.

A face template is "biometric information" or a "biometric identifier" under the laws that cover it, and we treat it that way.

2. Why We Collect It

The only purpose of a face template is to confirm who is clocking in or out at the Time Clock, so that time and attendance records are accurate and one member cannot clock in for another.

We do not use face templates, or the camera images they come from:

• To identify anyone outside the member's own Organization, or to search for a person
• For surveillance, location tracking, or monitoring members anywhere other than at clock-in
• For advertising or marketing
• To infer emotions, health, or any other characteristic
• To train or improve face recognition models
• For any purpose that is not described in this policy

3. Notice, Consent, and Alternatives

Face clock-in is off unless an Organization turns it on, and each member must be enrolled before it works for them.

The Organization that uses Station Clipboard is the member's employer or department and decides whether to offer face clock-in. Before a member is enrolled, the Organization must:

• Tell the member in writing that a face template will be collected and stored, why, and for how long, by giving them this policy or a notice that says the same things
• Obtain the member's written or electronic consent where the law requires it, including consent to our storing the template as the Organization's service provider. For a minor, consent must come from a parent or guardian where the law requires it.
• Offer another way to clock in, such as a PIN or a username and password, to any member who does not consent, and wherever else the law or the Organization's policy requires

A sample notice and consent that Organizations may adapt is at the end of this policy. A member may withdraw consent at any time by asking their Organization to reset their enrollment, which deletes the template.

4. No Sale, and Limited Disclosure

We do not sell, lease, trade, or otherwise profit from face templates.

We do not disclose face templates to anyone except:

• With the member's consent
• To the hosting and storage providers that store our database for us, which store templates only in encrypted form and may not use them for any purpose of their own. They are listed on our Subprocessors page.
• When required by state or federal law or municipal ordinance
• When required by a valid warrant or subpoena

Templates are never sent to our AI providers or to any integration. Organization administrators can see whether a member is enrolled, but cannot see or export the template itself.

5. How We Protect It

We protect face templates with at least the same care we use for our other confidential and sensitive information, and in line with the reasonable standard of care in our industry, including:

• Encryption of every stored template with AES-256-GCM
• Encryption in transit (HTTPS) between the device and our servers
• Keeping each Organization's templates separate, so a template is only ever compared with templates in the same Organization
• Limiting who can manage enrollments to the roles the Organization authorizes
• Limiting access by our staff to what is needed to operate and support the Service, and recording it in our audit logs

6. Retention Schedule and Destruction Guidelines

We keep a face template only as long as it is needed to confirm the member's identity at the Time Clock. We permanently destroy it at the earliest of these times:

1. Immediately when the member's enrollment is reset, whether by the member's Organization at the member's request or for any other reason. Resetting replaces the stored template with nothing.
2. Immediately when the member's account is deleted from the Organization.
3. Within 30 days after the Organization's Station Clipboard account is deleted.
4. Within 30 days after the purpose for collecting it has ended, for example because the member has left the Organization or has withdrawn consent. Organizations agree to reset a member's enrollment, or disable the member's account, within 30 days after the member leaves or withdraws consent. When a member's account has been disabled for 30 days, our daily check destroys the template automatically.
5. One year after the member's last interaction with the Organization through Station Clipboard (the last time they signed in, clocked in, or enrolled), even if no one has asked us to destroy it. Our daily check destroys it automatically.

This schedule is designed to meet or beat the deadlines in the Illinois, Texas, and Colorado laws: three years after the last interaction, one year after the purpose ends, and twenty-four months after the last interaction or forty-five days after the template is no longer needed.

Turning face clock-in off for one member stops their template from being used, but keeps it so that it can be turned back on. Turning it off does not change the retention schedule above. If a member will not use face clock-in again, the Organization should reset the enrollment instead.

How templates are destroyed. Templates are destroyed by deleting them from our production database. Encrypted backup copies are overwritten in the normal cycle of our hosting provider's backups and are never restored to use a template that has been destroyed.

Automatic enforcement. An automated check runs every day, destroys every template that is due under this schedule, and records each one in the Organization's activity log. We review this policy at least once a year.

Legal holds. If a valid warrant or subpoena requires us to keep a template, we keep it only as long as required and destroy it afterwards.

7. Requests and Questions

Members should send requests to reset, delete, or learn about their face template to their Organization's administrator, who can reset the enrollment at any time. You may also contact us at hello@stationclipboard.com with the subject line "Biometric Request." We will confirm the request with the Organization and act on it.

8. Security Incidents

If we learn that face templates may have been accessed without authorization, we will investigate and contain the incident, notify the affected Organizations without undue delay, and help them notify members and regulators as the law requires. Because templates are stored encrypted, a template that is accessed without the encryption key cannot be read.

9. Organization Responsibilities

Organizations that turn on face clock-in agree to:

• Give notice, obtain consent, and offer alternatives as described in Section 3
• Keep their own records of notice and consent where the law requires
• Reset enrollments as described in Section 6
• Place kiosks where only the people clocking in are in view of the camera, and secure kiosks and approved devices
• Comply with the biometric privacy, employment, and accommodation laws that apply to them

10. Changes to This Policy

We may update this policy as our products or the law change. We will update the "Last Updated" date and keep this policy publicly available. We will not use face templates already collected for a new purpose without new notice and consent.

11. Sample Notice and Consent for Organizations

Organizations may adapt this sample. It is not legal advice; have it reviewed for your state.

12. Contact Us

Station Automation Solutions LLC, owner and operator of Station Clipboard
Houston, Texas
Email: hello@stationclipboard.com
Phone: (979) 341-9333