OnSite Privacy Policy
Last updated: 25 October 2026
OnSite is a staff sign-in and sign-out app made by Corvo Business Intelligence, trading as RedRok ("RedRok", "we", "us"), South Africa. This policy explains what personal information the OnSite app and the OnSite company web app collect, why, and what your rights are under the Protection of Personal Information Act, 2013 (POPIA).
OnSite is used by employers ("your company") to record when their staff arrive at and leave work sites. Your company decides who may use the app and is the responsible party for your information under POPIA. RedRok processes the information on your company's behalf as its operator.
1. What we collect
| Information | When | Why |
|---|---|---|
| Your mobile number | When you open the app the first time | To find you on your company's staff list and link the app to you. |
| Your name, position and shift details | Provided by your company, shown in the app | To show you your details and shifts. |
| A selfie (face photo) | Your first sign-in, on a new phone, and (if your company chooses) at every sign-in | To confirm it is really you, so nobody else can sign in as you. See section 2. |
| Precise location (GPS) | Only at the moment you tap Sign in, Sign out or log a promotion, while the app is open | To confirm you are at your work site. OnSite does not track your location in the background. |
| A random app ID for your phone | Created when the app is installed | To know that your account is being used on the same phone. It is not your phone's IMEI or serial number. |
| Sign-in and sign-out records | Each time you sign in or out | Date, time, site, address, distance from the site and whether your face matched, for your company's attendance records. |
| Work reports | When your company's process asks for them | For example checklist answers, sales figures, photos of a store or promotion, a store manager's name, phone number and signature. |
We do not collect your contacts, messages, call logs, browsing history, or files on your phone, and the app has no advertising.
2. Face photos and face matching
Your first selfie becomes the reference photo for your mobile number. When you sign in on a new phone (or at every sign-in, if your company has chosen that), your new selfie is compared with the reference photo by Amazon Rekognition, a service of Amazon Web Services. Amazon returns a similarity score. We do not create a face collection with Amazon, and we have opted out of Amazon storing or using our images to improve its services. If the photos do not match closely enough, the sign-in is refused.
Your reference photo is stored securely and is only visible to authorised administrators at your company and RedRok support. If the wrong person's photo was saved for your number, your company can reset it.
3. Who sees your information
- Your company: authorised administrators see your attendance records, reports and reference photo.
- RedRok: only to run, support and secure the service.
- Service providers that host or process data for us under contract: Google Cloud / Firebase (servers, database and file storage) and Amazon Web Services (face matching). If your company uses WhatsApp codes, Meta (WhatsApp) delivers the code message.
We do not sell your personal information or use it for advertising.
4. Where it is stored
Information is stored on Google Cloud (Firebase) and processed by Amazon Web Services in data centres that may be outside South Africa (for example in the European Union and the United States). These providers are bound by agreements that require them to protect personal information to a standard comparable to POPIA.
5. How long we keep it
- Your reference photo and phone link: until your company removes you from its staff list or resets your photo, or you ask us to delete it.
- Attendance records and work reports: for as long as your company needs them for employment, payroll and legal record-keeping, after which they are deleted.
- Selfies used only for a face check are not kept after the check.
6. Security
All information travels over encrypted connections (HTTPS). Databases and files are not open to the public: they can only be reached by our servers and by your company's authorised administrators. The app's ID and sign-in details are kept in your phone's encrypted storage.
7. Your rights and deleting your data
Under POPIA you may ask to see the personal information held about you, ask for it to be corrected or deleted, and object to its processing. Because your company is responsible for your work records, you can ask your company directly, or email us at pieter@redrok.online with your mobile number and company name. We will verify the request with you and your company and respond within 30 days.
Deleting the app from your phone removes the app's data from your phone, but not your company's attendance records.
If you are not satisfied, you may complain to the Information Regulator (South Africa): inforegulator.org.za.
8. Children
OnSite is for employees and is not intended for anyone under 18.
9. Changes
We will update this page if the way we handle information changes, and show the new date at the top.
10. Contact
Corvo Business Intelligence, trading as RedRok
Email: pieter@redrok.online
Website: redrok.online