Introduction
This Privacy Policy describes how the MCSAI application and related services (“App”, “we”, “us”) handle personal information when your employer or organization (“Organization”) uses MCSAI for time and attendance, workforce management, or related purposes. We may update this document over time; new sections may be added below without changing the public URL of this page.
Canadian privacy law (PIPEDA and provincial laws)
MCSAI is intended for use by organizations operating in Canada. In the Canadian private sector, personal information is generally governed at the federal level by the Personal Information Protection and Electronic Documents Act (PIPEDA), unless a province has enacted legislation that has been declared substantially similar so that PIPEDA does not apply to provincially regulated activities in that province.
Depending on where your Organization operates and the nature of its activities, provincial or Quebec statutes may apply instead of, or in addition to, PIPEDA in specific situations. Examples include:
- Alberta and British Columbia — Personal Information Protection Act (provincial PIPA) for organizations subject to those acts;
- Quebec — Act respecting the protection of personal information in the private sector, as amended (including provisions commonly referred to in connection with Law 25).
Which law applies to a given Organization depends on facts such as location, sector, and data flows. Your Organization should confirm the applicable framework with its privacy lead or legal counsel. This policy is a transparency summary and does not replace statutory obligations or professional advice.
Under PIPEDA, organizations must follow principles such as accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Sensitive information (including certain biometric information) typically requires a higher standard of care and, where applicable, meaningful consent.
For more information on PIPEDA, see the Office of the Privacy Commissioner of Canada (OPC). Individuals may contact the OPC or the relevant provincial privacy authority about complaints, as provided by law.
Who this applies to
This policy applies to employees, contractors, and other authorized users who access the App under their Organization’s account. The Organization is typically the primary decision-maker regarding workplace data; MCSAI provides the tool on their behalf, as described in your employment or service agreements and the Organization’s own policies.
Information we collect
Depending on features enabled by your Organization, the App may process categories such as:
- Account and profile data — for example, name, work email or identifier, role, and identifiers needed to sign in and operate the service.
- Time and attendance data — for example, punch times, related metadata, and configuration required by your Organization.
- Device permissions — when you grant them, data tied to specific features as described in the sections below (for example, camera, location).
The exact fields and integrations depend on your Organization’s MCSAI configuration. Additions to this list will be reflected in future updates to this policy.
Camera and face enrollment
We access the camera only when:
- You or your Organization initiates face enrollment or identity verification in kiosk or similar modes supported by the App; or
- A feature explicitly requires live capture (for example, to register or update data tied to your work profile), and you have granted the system permission.
We do not use the camera for advertising, unrelated analytics, or background recording outside the flows you start in the App.
Processing may include:
- Still images or short captures from the camera stream used to create or update an enrollment associated with your user account;
- Technical metadata needed to operate the feature securely (for example, timestamps related to attendance events).
Detailed retention and lawful basis for biometric or face-related data may also be governed by your Organization’s policies and applicable local law; see Retention and Contact.
Location
Where your Organization enables location-based features (for example, recording approximate location with a punch or attendance event), the App may process location information when you grant permission. We use such data only to provide the workforce features your Organization has configured, not for unrelated marketing. This section may be expanded as features evolve.
How we use information
We use the information above to:
- Provide, operate, and secure the App and MCSAI services for your Organization;
- Support time tracking, attendance, and related reporting as configured by your Organization;
- Where enabled, verify identity or enforce Organization rules (for example, face-assisted checks at a kiosk).
Purposes, consent, and legal context (summary)
In Canada, we collect, use, and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, and with consent that meets applicable law (including express consent where required for sensitive information such as certain biometric data). Employment and service relationships, your Organization’s instructions, and operational necessity may inform what is reasonable in context, always subject to PIPEDA or applicable provincial law.
In other jurisdictions, different rules may apply. Where laws outside Canada use concepts such as “legal bases,” processing may be described as necessary for the performance of a contract, for legitimate interests in workforce management and site security, or as otherwise permitted, subject to local law, collective agreements, and your Organization’s policies. Your Organization can provide more detail on request.
Sharing and storage
Information may be processed on systems operated for your Organization’s MCSAI deployment (or its service providers) using industry-standard protections in transit and at rest where configured. We do not sell personal information. Access is limited to what is needed to provide the service in line with your Organization’s instructions and applicable law.
Retention
How long data is kept depends on your Organization’s policies, legal requirements, and service settings. Contact your Organization’s administrator for retention schedules and deletion requests tied to your account.
Security
We implement appropriate technical and organizational measures appropriate to the nature of the service. No method of transmission or storage is completely secure; your Organization may define additional security requirements.
Your rights and choices
Under Canadian privacy law, you generally have a right to access your personal information and to request correction of inaccuracies, subject to limited exceptions. Where applicable, you may also have rights related to withdrawal of consent, deletion, or objection.
- You can withdraw permissions (for example, camera or location) in your device settings; some features may become unavailable.
- For requests regarding data held in connection with your Organization’s account, contact your Organization’s MCSAI administrator or privacy contact in the first instance.
Children
The App is not directed at children. Organizations should not enroll minors unless permitted by law and internal policy.
Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be communicated through your Organization or in-app where appropriate. The page URL remains the same so app store listings and bookmarks stay valid.
Contact
For questions about this policy or how your data is handled in the context of your Organization’s account, contact your Organization’s administrator. For service or contractual matters, use the contact channel your Organization provides for MCSAI support.