Launch offer: 10% off through the end of 2026 with code QRAY10Launch offer: 10% off through the end of 2026 with code QRAY10
QRAYStart free trial

QRAY is currently available for companies in Türkiye. English product and local compliance features are on our roadmap — request early access.

Privacy Policy

At QRAY, your privacy comes first. This policy explains what we collect, how we use it, and how we protect it.

In Short

  • We never sell your data to third parties
  • Google Analytics and Google Ads run on our website only with your cookie consent; the mobile app does not use Google Analytics
  • Location is read at clock-in/clock-out; continuous tracking only if your employer switches on optional location tracking with employee consent, during working hours
  • We never access contacts, SMS, or calendar
  • We collect no biometric data
  • All data is encrypted in transit

Data We Collect

Identity Information

  • Name
  • Email address (optional)
  • Phone number (optional)
  • Turkish national ID number (TC kimlik no), used to sign in

Work Information

  • Your workplace or location
  • Role / job title
  • Shift and schedule details

Attendance Records

  • Clock-in and clock-out times
  • Worked hours and overtime
  • Leave and time-off records

Media & Documents

  • Profile photo (camera or gallery)
  • Time-off request attachments (e.g. notes)
  • Support request attachments

Location Data

  • Used to verify location at fixed-QR and button clock-in and clock-out
  • While location tracking is off, captured only at the moment of a punch
  • Location tracking is optional: if your employer switches it on with employee consent, location is collected periodically during working hours only (in the background if background permission is granted); location history is kept for 90 days

Technical Data

  • Device type (Android/iOS)
  • Push notification token (for notifications and alerts)

QRAY Assistant (managers only, if your company has enabled it)

  • Questions typed to the assistant and the company information it retrieves to answer them
  • If voice features are used, audio from the microphone (so it can be transcribed)
  • If you send feedback with 👎, that question and answer

Feedback to QRAY (optional)

  • If you send feedback, your name, whether you are an employee or a manager, your company, your message and any images you attach are sent to QRAY
  • Only the QRAY team can see it, not your employer; it is used only to improve QRAY
  • Location data is removed from attached images before they are stored

App Permissions

Camera Access

  • Used to scan the QR code to clock in
  • Used to take a profile photo
  • Photos are linked to your account

Photo Library Access

  • Used to choose a profile photo
  • Used to attach documents to time-off and support requests

Location Access

  • Used to verify presence at fixed-QR and button clock-in and clock-out
  • While location tracking is off, read only at the moment of a punch
  • If your employer switches on optional location tracking with employee consent, location is read periodically during working hours only

Notifications

  • Shift assignments and changes
  • Clock-in and clock-out confirmations
  • You can turn these off at any time

Microphone Access

  • Used only in the manager app, to ask QRAY Assistant questions by voice, for the optional "Hey QRAY" wake word, and for voice conversations
  • Permission is requested only when you tap the microphone; "Hey QRAY" is off by default and the wake word is recognized on the phone only
  • The employee app does not use the microphone

Data We Do Not Access

Information We Never Collect

  • Contacts — not accessed
  • SMS or call logs — not accessed
  • Calendar — not accessed
  • Health and fitness data — not accessed
  • Browsing history — not accessed
  • Financial information — not accessed

Data Security

How We Protect Data

  • All data is encrypted in transit with SSL/TLS
  • Passwords are hashed with bcrypt
  • Access tokens are stored in secure device storage (Keychain/Keystore)
  • Session tokens are rotated regularly

Access Control

  • Only authorized managers can access your data
  • Each company’s data is fully isolated from others
  • All changes are written to an audit log

Third-Party Services

Expo Push Notifications

  • Used to deliver notifications
  • The push token and notification text are sent through Expo

Website

  • On our website (qray.app), Google Analytics 4 (visit measurement) and the Google Ads tag (ad measurement and remarketing) run only if you accept cookies
  • Without consent these tags are not loaded; you can change your choice any time via "Cookie Settings" at the bottom of every page
  • The cookies we use and how long they last are listed in our Cookie Policy

OpenAI (USA)

  • To generate QRAY Assistant answers, questions and the related company information are sent, with people’s names and personal details replaced by codes
  • In the panel's Ask QRAY (QRAY'a Sor) assistant, questions and the company information needed for the answer, including names, are sent
  • Data is not used for model training; it may be kept for up to 30 days for abuse monitoring

ElevenLabs (USA)

  • Used to transcribe speech and for spoken answers
  • Voice recordings attached to support requests are also sent to ElevenLabs for transcription, or to OpenAI if ElevenLabs is unavailable
  • Audio recordings sent in batch and their transcripts are deleted at our request right after use (they may remain in the provider’s backups for up to 30 days)
  • Data is not used for model training

Anthropic (USA)

  • Used as a backup AI provider for the QRAY Assistant, Ask QRAY (QRAY'a Sor), the website chat and the support AI when OpenAI is unavailable
  • In the QRAY Assistant, names and personal details are sent in coded form
  • Data is not used for model training

Services We Do Not Use

  • Google Analytics in the mobile app — not used
  • Facebook SDK — not used
  • Selling data — never

Data Retention & Deletion

Retention

  • Attendance records: kept as required by labor law (US: typically 3 years under the FLSA; UK: 2 years, with longer holiday-record retention from April 2026)
  • Account information: while the account is active
  • Session data: cleared on sign-out
  • Assistant conversations: deleted when you close the conversation, sign out, or the retention period ends; QRAY does not store audio recordings
  • Feedback: resolved items are deleted after 90 days, all others after 1 year at the latest
  • Feedback sent to QRAY: deleted after 1 year at the latest

Your Right to Deletion

  • Your account is deactivated when you leave the workplace
  • You can request deletion of your personal data
  • Local data on your device is cleared on sign-out

Your Rights Under UK GDPR

Under the UK GDPR and Data Protection Act, you have the following rights regarding your personal data:

  • Know whether your personal data is being processed
  • Access the personal data we hold about you
  • Understand the purpose of processing and how it is used
  • Know any third parties your data is shared with
  • Have inaccurate or incomplete data corrected
  • Request deletion or erasure of your data
  • Object to or restrict certain processing

Contact

For any questions about this privacy policy, get in touch with us.

info@qray.app