Privacy policy

Cohumi is HR software for Singapore's small and mid-sized companies — rostering, attendance, leave, payroll and claims in one system. It is operated by Noveeo Events Pte. Ltd. (UEN 202620712D), a company registered in Singapore.

This policy explains what personal data passes through Cohumi, why it is there, where it is kept and who can see it. It is written for two audiences at once: the companies who are our customers, and the employees of those companies whose working lives the product records. Because those two groups stand in different legal positions, the next section is the most important one on this page.

Singapore's Personal Data Protection Act 2012 (PDPA) distinguishes between the organisation that decides what happens to personal data and a data intermediary that processes it on that organisation's behalf. Cohumi wears both hats, and it matters which one applies to you.

If your employer uses Cohumi, your employer is the organisation responsible for your personal data under the PDPA. Your employer decides what goes into the system, who in the company can see it, which features — such as face verification at clock-in — are switched on, and how long records are kept. Cohumi acts as a data intermediary: we process your data on your employer's behalf and on its instructions, and our direct obligations to you are to protect that data and not to keep it longer than needed. We do not use employee data for our own purposes, and we never sell it or share it for advertising.

If you create or administer a company account — a business owner or HR administrator — then for your own sign-in details, contact information and billing records, Cohumi is the organisation itself, with the full set of PDPA obligations towards you.

This split decides where to send a request about your data: employees start with their employer, account holders come straight to us. The section on your rights, below, explains both routes.

Everything in this section is entered by your employer or generated when you use the employee app, and every item exists to run the employment relationship — to roster you, pay you correctly, make the statutory contributions the law requires, and keep the records an employer in Singapore must keep.

Your employment profile covers your name, contact details, date of birth, position and department, employment dates and work-pass type. Your payroll record covers your salary, allowances and deductions, your bank name and account number (so salary can be paid to you), and your CPF and self-help-group fund details (so contributions are computed correctly). Leave and claims can carry supporting documents you upload — a medical certificate for sick leave, a receipt for an expense claim — which may reveal health information. Attendance records capture when you clocked in and out, and, depending on how your employer clocks staff, the location and photo described two sections down.

Your employer records your NRIC or FIN in Cohumi because the law requires it of them: CPF contributions and tax filings such as the IR8A are made against that number. The PDPC's Advisory Guidelines on the NRIC permit collecting it where collection is required under the law, and this is such a case — the number is there for statutory filings, not convenience.

We treat it accordingly. When an NRIC field is edited, Cohumi's audit trail records that a change was made but deliberately discards the value itself, so the number does not spread into logs. The same redaction applies to bank account numbers.

If your employer turns on face verification for clocking in, you enrol by taking a photo of yourself in the employee app. Two things are then stored: the enrolment photo, kept in private storage, and a face descriptor — a short list of numbers that describes the geometry of your face as measured by the recognition model. The descriptor is not a photograph and cannot be displayed as one.

When you clock in, the comparison happens on your own phone: your device computes a descriptor from the live camera image and compares it with your enrolled one. The recognition software's model files are downloaded to your phone from a content delivery network, but your image and your descriptor are not sent there — matching runs on your device, and what reaches Cohumi is the result: a successful check lets the clock-in record be created, a failed one means no record is written. This is biometric data, and we treat it as the most sensitive data in the system: descriptors are redacted from the audit trail just like NRIC numbers, and requests to remove an enrolment go through your employer, who controls the feature.

When you clock in or out on your phone, the app takes a single GPS reading at that moment — with your device's permission — to check you are within the outlet area your employer has defined, and stores that one point with the attendance record. Cohumi does not track your location continuously and has no background location access; when you are not clocking, nothing is recorded. A shared kiosk tablet does not read anyone's location at all — it uses the outlet it was paired to.

A clock-in photo, where your employer uses it, is a single frame captured at the moment of verification. It exists for dispute resolution — the case where someone says a clock-in was not really them. Photos are kept in private storage and are viewable inside your employer's portal only through links that expire after five minutes; there is no permanent public link to any of them.

To run your company's account we hold your name, email address and password — the password only ever as a cryptographic hash, never in readable form — together with your company's profile and its billing history. When you buy credits, the payment happens on Stripe's payment page: your card number goes to Stripe and never touches our servers, and what we keep is the confirmation and receipt. When an account is created we also note the network address (IP) it came from, purely to slow down abuse of the signup form; those records are deleted automatically within seven days. Sign-ins and significant administrative actions are recorded in your company's activity log.

Cohumi's database, file storage and authentication run on Supabase in its Singapore region (ap-southeast-1), so HR records — including documents, photos and biometric descriptors — are stored at rest in Singapore. A small number of service providers handle data on our behalf, each only for its own job:

• Supabase — database, file storage and sign-in (Singapore).
• Hostinger and Netlify — serve the website and app; requests between your browser and the database pass through them.
• Stripe — processes credit purchases (PayNow and card). Stripe receives the buyer's name, email and payment details, not employee records.
• Resend — delivers emails Cohumi sends, such as sign-in codes and receipts; it receives the recipient's address and the message.
• Sentry — receives technical error reports so we can fix faults. It is configured not to collect personal data, and session recording is switched off.
• Apple and Google — deliver phone notifications, only to staff who switch them on. They receive the notification text, not HR records.

We do not pass data to advertisers, data brokers or analytics companies, and we do not sell data.

Every company on Cohumi is isolated from every other inside the database itself: row-level security rules mean each query is filtered to your company at the database layer, not merely in application code, so an application bug cannot leak one company's records to another. Uploaded files — receipts, medical certificates, clock-in photos, face enrolment photos — sit in private storage that answers only to signed links which expire after five minutes.

Kiosk PINs are stored as bcrypt hashes, kiosk device tokens only as SHA-256 hashes, and five wrong PIN attempts lock a kiosk for two minutes. An append-only audit trail records changes to sensitive records — append-only meaning entries can be added but not edited or deleted, by anyone — while the most sensitive values (NRIC and FIN numbers, bank account numbers, face descriptors, PIN and password hashes) are redacted from it, so the log shows that a change happened without repeating the value.

Employment records are kept for as long as your employer's legal obligations require. Singapore employment and CPF rules oblige employers to retain employee records for a period after employment ends — two years is the general floor — and your employer, as the organisation responsible, sets its retention on that basis. Clock-in photos serve a shorter purpose: they are kept for 12 months from capture for dispute resolution and then deleted. Signup IP records are deleted automatically within seven days. The audit trail is kept for the life of the company's account, because a partial audit trail defeats its purpose.

When a company closes its account, its data is handled as described in our Terms of Service: available for export, then deleted after 90 days.

The PDPA gives you the right to ask what personal data an organisation holds about you and how it has been used, to have errors corrected, and to withdraw consent you have previously given. The practical route depends on which relationship you are in.

Employees should start with their employer, who is the organisation responsible for their data and the only party who knows the employment context. Much of your record is already visible to you in the employee app — your profile, payslips, leave and attendance. Cohumi supports your employer in fulfilling access, correction and deletion requests, and if you feel your request is not being handled, you can write to our Data Protection Officer, who will take it up with your employer. Note that where processing is required by law — CPF filings against your NRIC, for instance — withdrawing consent cannot override the legal requirement, and which clock-in methods your workplace accepts is your employer's decision.

Company account holders can contact us directly about their own data using the details below, and we will respond within thirty days or tell you when we can.

There is none to speak of, and we consider that a feature. Cohumi runs no third-party analytics, no advertising pixels and no tracking scripts — no Google Analytics, no Facebook pixel, nothing watching you on our behalf or anyone else's. When you sign in, your session token is kept in your browser's local storage and removed when you sign out; that is the extent of what we place in your browser.

As the PDPA requires, we have designated a Data Protection Officer. For any question, request or concern about personal data, write to our Data Protection Officer at hello@cohumi.com. For general product questions, hello@cohumi.com reaches a real person.

When this policy changes, the new version is posted here with its date at the top, and material changes are notified to company account holders by email or inside the product. We will never quietly weaken a commitment made on this page.