Who this covers
Team Pilot is a product of AZOTOS APP STUDIO PVT LTD (“AZOTOS”, “we”, “us”). This policy covers our public website, Team Pilot web service and the Team Pilot mobile apps, including the iOS app listed as “Team Pilot Azotos” and the Android app with package name com.az.teampilot.
In an organization-managed workspace, your employer or customer organization generally determines why employee and business records are processed and who can access them. AZOTOS handles those records to provide the service under that organization’s instructions and agreement. AZOTOS is separately responsible for information it handles for its own website, support and business administration. Your organization’s employment/privacy notices also apply; this policy does not replace them or remove its legal responsibilities.
Information we handle and why
The information involved depends on the modules, fields and attendance methods your organization uses. Information may be supplied by you, your organization, authorized colleagues, imports or configured integrations.
- Account and contact information: names, work email, phone number, employee/user identifiers, credentials and profile photographs, for account access, identification, communication and account recovery.
- Employment and personal records: department, designation, joining/leaving dates, shifts, date of birth, addresses, emergency/family contacts, qualifications and uploaded employment/identity documents, for organization and personnel administration. Configured fields can include government identifiers and health-related information such as blood group; provide these only when necessary and lawfully requested by your organization.
- Finance and payroll records: salary, payslips, allowances, reimbursements, advances, bank-account details and tax/social-security identifiers, for the organization’s payroll and financial workflows. These are employment finance records, not a public shopping checkout.
- Attendance and location: check-in/out times, working durations, leave and permission requests, shift details, IP addresses and attendance geotags, for recording workdays and checking configured attendance locations.
- Device and service information: device identifiers, platform/model/version details, push-notification tokens, session and authentication data, for device-linked access, notifications, troubleshooting and service operation.
- Business content and communications: tasks, time entries, project records, clients/leads, assets, notes, requests, support messages and uploaded files, for the modules your organization enables and the assistance you request.
- Website requests: IP address, browser/request details and necessary session information associated with loading the website and its resources, for serving pages and maintaining sessions.
Reports, exports and notifications can reproduce relevant records. Do not enter another person’s information without the necessary authority, notice and lawful basis. We do not sell personal data.
Attendance geotagging and app permissions
The mobile attendance flow captures location when you initiate a check-in or check-out to record its geotag and, where configured, evaluate the permitted attendance location. Team Pilot does not collect location in the background in the current service. Attendance location is associated with the user’s work record.
You can manage location and notification permissions in your device settings. Denying location can prevent location-based attendance from working; ask your organization about the attendance methods it permits. Notifications support work updates and do not replace a record’s status inside the service.
Profile pictures, documents and other files are processed when you or an authorized administrator upload them. Grant any photo/file permissions requested by your app only for the feature you choose. A new feature requiring a different permission or purpose must be explained before the additional collection takes place. Device permissions alone are not a substitute for the notices and legal basis required for employment processing.
Storage, client deployments and local AI
Current primary production storage for Team Pilot is in India. Client-isolated deployments are also available; responsibility for hosting, administration and the agreed deployment location must be identified in the client agreement. Third-party delivery and external website providers may process the limited information they receive outside the primary storage environment; an India hosting location is not a promise that every third-party request stays in India. Any transfer of sensitive information must satisfy the protections and conditions required by applicable law.
Where a client-specific local AI feature is agreed and enabled, its processing takes place in the local client/device or server environment described for that deployment, rather than sending the input to an external generative-AI service. The feature’s inputs, purpose and access must be explained separately before use. This policy does not grant permission to use workplace personal data for unrelated model training or new purposes; those require a separate lawful basis and notice where applicable.
Security and incident handling
The application uses password hashing, session/token authentication and role-based access controls. Your organization and deployment operator also have responsibilities for account provisioning, configured access, hosting, file access and safe export handling. Do not share credentials or send confidential records through an unapproved channel.
No system can guarantee absolute security. If you suspect unauthorized access, contact your administrator and our grievance/support contact promptly. Security incidents and legally required notices must be handled under applicable law and the relevant client agreement. We do not claim an independent certification or universal end-to-end encryption in this policy.
Retention and deletion
Workplace records are kept for the service purposes and the retention requirements applicable to the organization and record type. Statutory employment, tax, accounting, dispute or security obligations may require specific records to be retained. We do not apply a single automatic expiry period to every record.
For example, ICT/security logs covered by the applicable CERT-In directions must be maintained securely in India for a rolling 180-day period. That legally required log retention is separate from deleting eligible live account records and their backup copies. A lawful preservation order may require particular records to remain longer.
On a deletion request, our stated service process is to delete eligible account/personal data and associated backup copies within 7 days of receiving the request, with necessary identity verification handled promptly. This is a support-operated process, not an instant deletion button on this website. Where a legal obligation requires a record to remain, we will identify the retained category, reason and applicable retention period in our response, restrict its use and delete it when that obligation ends.
Signing out, uninstalling the app or disabling access does not by itself delete server records. Account deactivation or a soft-deleted record is not the same as permanent erasure. See Account & data deletion for the request steps.
Your choices and requests
Contact us to request information about your data, correction of inaccurate information, deletion of eligible data or withdrawal of consent where processing relies on consent. You may decline optional information; a feature may not work without information genuinely needed for it. Withdrawal does not undo lawful prior processing or records that must be retained for a valid legal obligation.
For records managed on your organization’s instructions, we will coordinate with that organization and explain who is responsible for the response. We will not release another person’s records as part of your request. This policy preserves rights and complaint routes that apply under the law in force; it does not treat not-yet-commenced statutory provisions as already effective.
Age and children
Team Pilot is designed for workplace use and is not directed at children. Customer organizations must ensure that any information about an individual under 18 is handled lawfully, with the notices, authority and parental/guardian consent required by the law applicable at the time. Do not create an under-18 user account or upload a child’s information without first resolving those requirements with the organization and AZOTOS.
Changes to this policy
We will publish revised policies with their effective dates. A materially different use of personal data requires the further notice and lawful basis applicable to that change; changing this text alone does not authorize it. Statutory protections and a binding client data-processing agreement cannot be removed by a website update.
Read the App Policy and Terms & Conditions alongside this document. This policy is a description of data handling, not a blanket consent to every optional collection.
The applicable Indian framework includes the Information Technology Act, 2000 and its relevant rules and directions, and the Digital Personal Data Protection Act, 2023 and Rules, 2025 to the extent their provisions have commenced and apply. The DPDP framework has phased commencement; future provisions will not be represented as present statutory rights before they take effect.
Contact and grievances
AZOTOS APP STUDIO PVT LTD, Trichy (Tiruchirappalli), Tamil Nadu, India.
Postal address: Trichy, Tamil Nadu 620010, India
Privacy requests: info@azotos.in.
Grievance Officer: Nagarajan Sampathkumar. Email: info@azotos.in.
Phone: +91 86676 52156.
Include your name, organization, a safe reply address and the nature of your request. Do not send passwords, full bank details or identity documents in an initial message. We may request proportionate identity verification before releasing or changing records.
For employer-managed records, you can also contact your organization’s HR or workspace administrator. Where the 2011 Sensitive Personal Data or Information Rules apply, grievances must be addressed within one month of receipt; any shorter legally applicable deadline takes precedence. This does not restrict access to a competent authority or other statutory remedy.