Privacy Policy

AlineBMS is a business management platform (CRM, HR, attendance, payroll, projects, marketing, and support) operated by Klivo Studios Pvt. Ltd., a company with its registered office at Sitapaila, Nagarjun, Kathmandu, Nepal ("Klivo", "we", "us"). This policy covers our website at alinebms.com, the AlineBMS web app, and the AlineBMS mobile app for Android and iOS.

It explains what personal information we handle, why, who we share it with, and the choices you have. We handle it in line with the Privacy Act, 2075 (2018) of Nepal and other laws that apply to us.

AlineBMS is used by organizations. Two different relationships apply:

• Workspace data: an organization (your employer or the business you work with) creates a workspace and decides what goes into it, including employee records, attendance, leave, payroll, and customer contacts. For this data the organization decides why and how it is used, and Klivo processes it on the organization's behalf and on its instructions.
• Account, billing, website, and product-security data: Klivo decides how this is used and is responsible for it directly.

If you are an employee or a contact in someone else's workspace, your employer or that business is your first point of contact for access, correction, or deletion of your workspace data. We will help them respond to your request.

Depending on how you use AlineBMS, we handle the following.

• Account information: name, work email, phone number, job title, organization, role and permissions, profile photo, and login credentials (passwords are stored hashed). If you sign in with Google, we receive your name and email from Google.
• Workspace data entered by your organization: employee profiles and documents, attendance and leave, shift and holiday schedules, salary structures, payroll and payslips, bank account details used for salary disbursement, expenses and advances, recruiting and vacancy records, CRM contacts, leads, deals, quotations, tasks, projects, meetings, and support tickets.
• Mobile app data: location (only when you use it for attendance check-in or field visits), photos you attach as receipts or visit proof, voice messages you record, a push notification token, and information cached on your device so the app works with poor connectivity.
• Attendance device data: punch records from biometric or card attendance machines your organization connects. See the attendance section below.
• Messages and files: content you upload, send in the app, or submit through our forms and website chat assistant.
• Billing information: company name, billing contact, tax details, and payment records. We do not store full card numbers.
• Technical and security data: IP address, device and browser type, app version, timestamps, error reports, and audit logs of important actions in the workspace.

These features involve sensitive data, so we are specific about them.

• Location: the mobile app asks for location permission only while the app is in use, and only to verify attendance against your organization's approved locations or to record a field visit. We do not track your location in the background or outside those actions.
• Camera and microphone: used only when you choose to attach a photo (for example, an expense receipt or visit proof) or record a voice message. You can deny these permissions in your phone settings; the related features will then be unavailable.
• Biometric attendance machines: when your organization connects a fingerprint, face, or card device, AlineBMS receives the resulting punch event (who, when, which device, and the verification method used). Fingerprint and face templates and images stay on the device and are not stored in AlineBMS.

Organizations are responsible for telling their employees about attendance, location, and biometric collection and for having a lawful basis for it. If you are unsure what your employer collects, ask them.

We use personal information to:

• Provide, maintain, and support the platform, including calculating attendance, leave, and payroll for your organization.
• Authenticate users, enforce role-based access, and keep accounts and workspaces secure.
• Send service messages such as sign-in, verification, approval, and payroll notifications by email, SMS, and push notification.
• Respond to demo, sales, and support requests.
• Bill customers and keep the financial records we are required to keep.
• Detect fraud, abuse, and errors, and fix bugs.
• Understand aggregate, de-identified product usage so we can improve AlineBMS.

We do not sell personal information, and we do not use workspace data for advertising.

AlineBMS includes an in-app AI assistant and AI-generated insights, and the website has a chat assistant. When you use them, your question and the workspace information needed to answer it are sent to our AI provider (OpenAI) to generate a response.

• The assistant respects the same role-based permissions as the rest of the app, so it works from data you already have access to.
• We do not use workspace data to train AI models.
• AI output can be wrong. Please check it before relying on it, especially for payroll, tax, or HR decisions.

We use a small number of providers to run AlineBMS. They process data only to provide their service to us, under contractual obligations.

• Cloudflare: website hosting, file and document storage, and bot protection on our forms.
• OpenAI: AI assistant and insights.
• Resend: transactional email delivery.
• Sparrow SMS: SMS delivery in Nepal.
• Google: sign-in with Google, optional Google Calendar sync, and push notifications through Firebase Cloud Messaging. Apple provides push notifications on iOS.

We will update this list as providers change. Business customers can contact us for the current list.

Beyond our service providers, we share personal information only:

• Within a workspace, according to the roles and permissions your organization sets. For example, an administrator or HR user may see attendance and payroll records of employees.
• When you or your organization ask us to, for example through an integration you switch on.
• When the law, a court order, or a government authority requires it.
• In connection with a merger, acquisition, or sale of our business, with notice to affected customers.

Klivo is based in Nepal, but our providers may process and store data in other countries, including the United States and other regions. Where we transfer data across borders, we rely on contractual safeguards and choose providers with established security practices.

We protect information with measures that include:

• Encryption of data in transit (HTTPS/TLS), including all mobile app traffic.
• Role-based access control inside each workspace, and separation between organizations.
• Secure on-device storage of login tokens in the mobile app.
• Audit logs of important actions, and access to production systems limited to authorized staff.

No system is perfectly secure. If a breach affects your data, we will notify affected customers without undue delay and as the law requires.

We keep workspace data for as long as the organization's subscription is active. After a subscription ends, we keep the data for 30 days so the organization can export it, then delete or anonymize it, except where the law requires us to keep it longer (for example, financial and tax records). Copies in backups are removed as backups expire.

Website form submissions and chat messages are kept as long as needed to respond to you and to keep a record of the conversation, then deleted or anonymized. Account and billing records are kept for the period required by Nepalese tax and accounting law.

Subject to applicable law, you can ask to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information, or restrict or object to certain processing.
• Receive a copy of your data in a portable format.

For workspace data, please contact your employer or organization first; they control it and can usually act fastest. For anything we hold ourselves, write to us using the contact details below. We may need to verify your identity, and we will reply within a reasonable time.

You can turn off location, camera, microphone, and notification permissions at any time in your device settings, and unsubscribe from marketing emails using the link in them. Service messages are required to operate your account.

AlineBMS is built for businesses and is not directed at children under 16. We do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

We may update this policy as AlineBMS or the law changes. We will post the new version here with a new date and, for material changes, notify account administrators by email or in the app.

Questions about this policy or a privacy request? Reach us at the details below. Klivo Studios Pvt. Ltd., Sitapaila, Nagarjun, Kathmandu, Nepal.