SiteClock · by MySteel

Privacy Policy

Written for the people it describes

Last updated 23 August 2026

Your employer decides

They choose what is collected and why. They are the data controller. If you want your records corrected or explained, they are the people who can do it.

SiteClock stores it

We provide the software and hold the data on your employer's behalf. We do not decide how it is used and we do not use it for our own purposes.

SiteClock is a workforce attendance and payroll app used by employers in Malaysia. This policy explains what it collects from you, why, who sees it, and how long it is kept.

It is written to be read by the people it describes — workers on a site — rather than by lawyers. If anything here is unclear, ask your employer, or contact us at the address at the bottom.

What SiteClock collects when you clock in and out

The time: — Taken from your phone at the moment you press the button.
Your location: — Latitude, longitude, and how accurate the reading was. Location is read only at the moment you clock in or clock out. The app does not track your movements at any other time, and does not run location in the background.
A photograph of you: — Taken by the app at that moment. The time, the site name, your name and the accuracy of the location reading are written into the image itself.
Which site: — The site you selected, and whether you were inside its boundary.
Basic details of the phone: — Model and operating system version — so a disputed record can be traced to a device.

When you use other parts of the app

Leave requests: — The dates, the type of leave, your reason if you give one, and any document you attach (for example a medical certificate).
Expense claims: — The amount, what it was for, the date, and the photograph of the receipt if you attach one.
Your profile: — Name, staff ID, phone number, and a profile picture if you set one.
Employment details: — Held by your employer: pay terms, employee type, start date, and — for foreign workers — permit, passport and FOMEMA expiry dates.

Automatically

A notification token, so your phone can receive alerts about approvals.
Error logs, if something in the app fails.

SiteClock does not collect contacts, messages, browsing activity, advertising identifiers, or anything from your phone outside the app.

Why the photograph and the location

Attendance decides pay. A record that says only “someone pressed a button at 07:02” cannot be checked by anyone afterwards, which is a problem for you as much as for your employer — it is the evidence that you were where you said you were.

The photograph is compared against your name on the record. It is not used for facial recognition, is not matched against any database, and is not analysed to judge your appearance, your clothing or your safety equipment.

Who can see it

Your managers and your employer's payroll staff. Managers see their own team; whoever runs payroll sees pay figures.
Nobody else. Your data is not shared with other employers, is never sold, and is not used for advertising.
Our service providers, only to the extent needed to run the app: Google Firebase (Google Cloud) — hosting, authentication, database, file storage and notifications. Data is stored in Google's Singapore region (asia-southeast1).

We disclose data to anyone else only where the law requires it — for example a court order, or a request from the Labour Department under the Employment Act.

How long it is kept

What	How long
Clock-in and clock-out photographs	Your employer sets a retention period, after which photographs are deleted automatically. The default is 30 days.
Attendance, leave and claim records, and payslips	Kept for six years. This is not our choice — section 61 of the Employment Act 1955 requires an employer to keep a wage register for that long.
Your login	Removed when your account is closed.

Closing your account

You can close your account from the app: Profile → Close account. It asks for your password first.

Closing it deletes your login and clears your contact details. It does not delete your pay records, because your employer is legally required to keep them for six years. The app tells you this before you confirm, rather than after.

Your rights

Under Malaysia's Personal Data Protection Act 2010 you may ask to:

see the personal data held about you;
have anything inaccurate corrected;
limit how it is processed;
withdraw consent, though this may mean you can no longer clock in through the app.

Ask your employer first — they hold the data and can act on it directly. If they cannot help, contact us below.

Security

Access is controlled by rules enforced on the server, not by the app hiding buttons. A worker can read their own records; a manager can read their team's.
Photographs are stored in a private bucket that requires a signed-in account.
Traffic between your phone and the servers is encrypted.

No system is perfect. If we discover a breach affecting your data, we will inform your employer without undue delay.

Children

SiteClock is for employed adults. It is not directed at children and we do not knowingly collect data from anyone under 16.

Changes

If this policy changes in a way that affects you, the app will tell you. The date at the top always shows the current version.

Contact

MySteel / SiteClock

jinzhang@cortexbizsolution.com

For anything about your own records, your employer can usually answer faster.