Last updated: October 11, 2026

Idenua app privacy policy

This policy explains how the Idenua app for iPhone and Android, and the Idenua web dashboard (biometricos.exdoo.mx), handle the data of the people who use it to record their attendance. It complements Exdoo's general privacy notice.

Who is responsible for your data

Your employer is the data controller. Idenua is a tool that companies hire to record their staff's attendance: the company decides who clocks in, from where, and how long records are kept. Exdoo TI S DE RL DE CV ("Exdoo"), Mexico, operates the platform and processes that data on behalf of the company, solely to provide the service.

Contact: info@exdoo.mx · WhatsApp +52 771 135 4817.

What data the app uses

• Your employee identification: your name and the number your company assigned to you. The phone is linked to you with an activation code provided by Human Resources.
• A selfie for each clock-in: the app takes a photo with the front camera at the moment you clock in or out. It is the evidence of who recorded the attendance.
• Location: the GPS location is taken at the moment you clock in or out, to know whether you are inside the area your company authorized. Only when clocking in or out: the app does not track you in the background or record where you are the rest of the day.
• Device data: model, operating system and an installation identifier, to link a single phone per person and be able to revoke it if it is lost.
• Time and type of record: clock-in, lunch out, lunch in and clock-out.

Face data from the TrueDepth camera (iPhone)

On iPhones with Face ID, when you clock in or out the app uses the TrueDepth camera through ARKit (Apple's face tracking) to confirm that a real, three-dimensional face is in front of the camera and not a printed photo or a screen.

• What data is used: the face geometry, its position and distance from the camera, and the facial expression coefficients (blend shapes, for example eye blinks) provided by ARKit, only while the clock-in screen is open.
• Purpose: solely this liveness check at the moment of clocking in or out. It is not used to identify you, for advertising, for analytics or to train artificial intelligence models.
• Where it is processed: only on your phone, in real time.
• What leaves the phone: no TrueDepth data. The face mesh, the depth map and the expression coefficients are never sent. Only the result (real face: yes or no) and a single number between 0 and 1 indicating how much the face moved travel with the clock-in, together with the selfie, which is a regular color photo.
• Who it is shared with: no one. TrueDepth data does not reach Exdoo, your employer or any third party.
• How long it is kept: it is not stored. It is discarded as soon as the check finishes and is never written to the phone or to our servers.

Other checks on your phone

Before sending the selfie, the app checks on the phone itself that the photo contains a face, using the operating system's features (Vision on iPhone, ML Kit on Android). This check does not create a biometric template, cannot be used to identify you among other people and does not leave the phone: only the result is sent (how many faces were seen and how large the face appears in the photo).

When the app asks for Face ID or your fingerprint, it is your phone that verifies you: Exdoo never receives your face or your fingerprint, only the confirmation that the phone recognized you.

What we do not do

• We do not track you outside the moment of clocking in or out.
• We do not sell or rent your data, or use it for advertising.
• We do not read your photo library, contacts or messages.
• We do not use facial recognition to identify you or compare your face against any database.
• We do not use your data to train artificial intelligence models.

Who it is shared with

• Your employer: Human Resources sees your clock-ins, the selfie, the location and whether you were inside or outside the authorized area.
• Your employer's system: if your company uses Odoo, the clock-ins are copied to its own attendance system.
• Infrastructure providers: the servers where the platform runs, under contract and without permission to use the data for their own purposes.
• Authorities: only when required by law.

How long data is kept

Clock-ins and their selfies are kept while your company keeps the service, because they are the attendance record the law requires it to keep. If your company cancels, its data is deleted from our servers within the following 90 days, unless it must be kept to comply with a legal obligation.

Unlinking your phone or deleting your data

You can ask at any time for your phone to be unlinked: Human Resources does it from the dashboard and the app can no longer clock in. Since your employer is responsible for attendance records, deletion requests are handled through your employer; if you contact us, we will help route the request and notify the company.

Write to us at info@exdoo.mx and we will reply within 20 business days at most.

Your rights

You have the right to access, rectify, cancel or object to the processing of your personal data (ARCO rights), under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. Exercise them with your employer or by writing to info@exdoo.mx.

Security

Everything travels encrypted (HTTPS) between the app and our servers. The phone session is stored in the system's secure storage (Keychain on iPhone, Keystore on Android) and your password is never stored. Selfies are stored on the platform's server, accessible only to your company's authorized staff.

Children

Idenua is a work tool and is not directed at children.

Changes

If we change this policy, we will publish the new version at this same address with its update date.