1. Who this policy applies to
Entryo provides visitor-management technology to organizations, buildings, companies, hosts, assigned guards and building administrators. For visitor records, the organization operating Entryo at a location generally determines why the records are collected and how they are used for that location. Entryo provides and operates the platform and may process relevant information on that organization's documented instructions. Entryo may separately determine purposes for limited account, service security, support and legal-compliance processing. The role applicable to a particular processing activity depends on who determines its purpose and means.
The applicable customer agreement and any data-processing terms describe the parties' responsibilities. This Policy explains the relevant processing and contact routes; it does not itself authorize a purpose that is not otherwise lawful.
For a request about a specific visit, contact the relevant building or inviting organization first. You may also use our Contact & Support page .
Privacy Notice — Entryo Visitor Registration
The organisation you are visiting and Entryo process your personal information to manage visitor registration, invitations, entry and exit records, access verification and related security and operational requirements.
Authorised personnel of the organisation and authorised Entryo support/security personnel may access relevant information where necessary for service delivery, technical support, security investigations or legal obligations, subject to applicable access controls and privacy requirements.
Your information will be retained according to the applicable retention policy and legal requirements. For privacy questions or requests, contact the relevant organisation or Entryo at supportentryo@gmail.com.
The information collected and its purposes are described in sections 2 and 3 below. Walk-in visitor photos are required; invited visitor photos are optional. A visitor who submits the registration or pass-details form records their own consent for the visit purposes described in the notice. An inviting account separately confirms that it has the visitor's consent to share the invitation details; that confirmation is recorded as the inviting account's statement, not as the visitor's own action.
2. Information processed by Entryo
- Visitor and invitation information: name, mobile number, optional email, required walk-in visitor photo, optional invited visitor photo, walk-in origin (company, organisation or city), optional vehicle number, optional ID proof type and last four characters (not the full ID number), destination company, host, purpose, invitation validity, pass status, check-in and checkout time.
- Gate information: the building, gate and barcode permanently associated with the scanned QR.
- Staff account information: name, email, role, active status, company/building/gate assignments and preferred language.
- Technical and security information: IP address, browser or device information, session/token details, an anonymous visitor-device cookie, scan outcomes, failure reasons, login and administrative audit activity.
- Organization information: customer, subscription, building, gate, barcode and company records required to operate the service.
- Subscription and payment information: subscription plan, payment amount, payment date, transaction or reference number and other information reasonably required to verify and manage a customer's subscription.
3. Why the information is used
We process information to register and identify visitors, let authorized building and security staff visually verify the required walk-in photo and any optional invited photo, validate gate-mapped QR codes, verify time-bound invitations, maintain an entry and checkout record, provide role-scoped dashboards and reports, prevent misuse, investigate failures, secure accounts, maintain audit history and meet lawful operational obligations.
Entryo does not use visitor check-in, checkout or invitation records to create sales leads, target visitors with Entryo marketing, or sell or disclose those records as a data product. Any materially different use would require a separate lawful basis, clear notice and appropriate safeguards before it begins.
Entryo does not perform facial recognition or create a biometric template from the photo.
Entryo does not request device GPS for QR check-in or checkout. The scanned QR is validated against its permanently assigned customer, building and gate.
For walk-in visits, an anonymous HTTP-only browser cookie lets a repeat scan of the same gate QR close the active visit without asking for the registration form again. Only a one-way hash is stored with the active visit. It is not used for advertising, and the visit association is removed at checkout.
A short-lived cache marker prevents accidental immediate rescans from reopening registration. IP addresses are not used to identify a returning visitor.
3A. Platform-level data access and security investigations
Entryo retains and processes visitor entry and exit records, including walk-in and invited visitor records, to provide and support the visitor-management service, maintain operational and security records, and meet applicable legal and contractual requirements.
Only authorized Entryo personnel with the required platform role may access visitor records. They may review relevant details across customer organizations when reasonably necessary to operate or support the service, investigate a reported security incident, an entry or exit discrepancy, suspected misuse, a technical failure, a dispute, or another service or security issue. Any correction or update to a visitor record must be justified, within the person's assigned permissions, and handled with the relevant customer organization under the applicable agreement or lawful process.
Entryo restricts such use to personnel with a legitimate service-related need, under role-based access controls, confidentiality obligations and applicable audit logging. Personnel must use only the records reasonably relevant to the matter. Platform access does not permit staff to browse, change or use visitor information for unrelated purposes.
4. How information is obtained
Information may be provided directly by a visitor, entered by an authorized host or administrator, or generated during a gate scan or authorized account action.
5. Who may receive information
Customer users can access information only within their authorized customer, building, company, host, guard or administrator scope. Entryo personnel with the required platform role may access relevant walk-in and invited visitor records across customer organizations for the limited service, support, correction, security-investigation or legal purposes described in the platform-level access section above. Such access is subject to the applicable customer agreement, internal authorization and confidentiality requirements.
Information may also be processed by infrastructure and service providers needed to host, secure, back up or operate Entryo.
Information may also be disclosed where required by law or where reasonably necessary to protect people, rights, property or systems.
Entryo does not use visitor information for third-party advertising or sell visitor information as a data product.
Android app, camera and barcode scanning
The Entryo Android app requests camera access to read visitor invitation QR codes. You can deny this permission and enter a pass manually. QR camera frames are processed on the device by Google's bundled ML Kit barcode scanner; they are not sent to Entryo as visitor photographs. The decoded pass token is sent over HTTPS to Entryo to verify the pass and carry out the check-in or checkout you select.
Google's ML Kit SDK collects device and application information (such as device manufacturer, model, operating system, app name and version), per-installation identifiers, performance and diagnostic information (including API configuration, processing latency, input/output sizes and errors) for diagnostics and usage analytics. This SDK information is transmitted to Google using encryption in transit. See Google's ML Kit data disclosure.
The Android app keeps its sign-in token in encrypted device storage, removes it on sign-out, and excludes app data from Android backup and device transfer. Downloaded documents may be temporarily cached when you use the device share sheet. Copies you choose to share or save in another app are controlled by that app. In-app arrival notifications are retrieved from Entryo while the workspace is active; the app does not use Firebase Cloud Messaging for background push notifications.
6. Retention and deletion
Entryo and its customer organizations retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, the customer organization's documented retention requirements, contractual obligations, security and audit requirements, or applicable law.
The standard retention period for customer visitor records and related audit logs is one year after the customer's final active Entryo subscription ends or is terminated, including any agreed renewals. This period is separate from the length of the subscription. An existing signed customer agreement may specify different terms; Entryo processes customer records under that agreement and documented instructions, subject to applicable law.
Where a valid deletion request is made, Entryo will assess the request against applicable law, contractual obligations, security requirements, audit requirements and legitimate record-keeping needs.
Earlier erasure may be required when the specified purpose and permitted retention grounds end. Information that must be retained longer for applicable law or a documented legal, security, fraud-prevention, dispute-resolution or audit need may be retained for that applicable period.
When information is no longer required for its specified purpose and no legal or permitted retention ground applies, the responsible organization will take reasonable steps to erase it or cause it to be erased. Deletion from active systems and any backup copies follows the applicable manual service and backup processes; no automatic retention-based purge is currently in place.
Request deletion of your Entryo account or personal data
You do not need to sign in or keep the app installed to submit a request. Email supportentryo@gmail.com with the subject “Entryo account or data deletion request”. Include your registered email, organization or building, and whether you want your account and associated personal data deleted, or only specific personal data. Do not send passwords, pass tokens or unnecessary copies of visitor records.
Support will verify the requester's identity and coordinate with the organization responsible for the records. Account deactivation alone is not deletion. A request can cover account identity/contact details and associated personal data such as visitor details or photos where relevant. Records that must be retained for legal, security, fraud-prevention, dispute-resolution or audit purposes are subject to the retention criteria in section 6. Ask support which records and retention periods apply to your request; the applicable period depends on the record and organization.
In the Android app, open “Privacy, account deletion & support” from the sign-in screen or Profile, then select “Request account/data deletion”. You can also report inappropriate content or user misuse through that screen or our Contact & Support page.
7. Security
Entryo uses role-based authorization, server-side scope enforcement, secure sessions, expiring API tokens, opaque QR/pass tokens, password hashing, request validation, rate limits, audit logs, restrictive security headers and database constraints.
Uploaded visitor photos are size- and type-limited, reconstructed as fresh image data, assigned random filenames, kept outside the public web root and served only after an authorized request.
No system can guarantee absolute security. Users must not share passwords, account credentials, private pass URLs, QR/pass tokens or other confidential access information.
8. Your choices and requests
Depending on the applicable relationship and law, individuals may request information about the processing of their personal data, access or correction of their information, deletion where permitted, withdrawal of consent where consent is the applicable legal basis, grievance handling, and nomination of another person to exercise rights where provided by applicable law. The rights and procedures available depend on the law and provisions in force for the relevant request.
For visitor records collected through a particular building or organization, the relevant organization should generally be contacted first because it determines the purpose and operational handling of the visit.
Entryo may require reasonable verification before responding to a request in order to prevent unauthorized disclosure of personal information.
Privacy requests may be submitted through the Entryo Contact & Support page .
Please identify the relevant building or organization and the type of request. Do not send passwords, QR/pass tokens or unnecessary personal information.
9. Children
Entryo is intended for managed workplace visitor access and is not designed for children to use independently.
Organizations using Entryo must assess whether a visitor is a child and apply any required notice, verifiable parental consent, authorization and other safeguards before processing the child's information. The platform must not be used to track or behaviorally monitor children or target advertising to them where prohibited by applicable law.
10. Hosting and international processing
The hosting location and service providers may vary by deployment.
Entryo may use infrastructure and service providers necessary to host, secure, back up and operate the service.
Applicable hosting locations, service providers and transfer arrangements will be managed in accordance with the customer organization's requirements and applicable law.
11. Security incidents
Entryo maintains reasonable technical and organizational security measures designed to protect personal information against unauthorized access, loss, misuse, alteration or disclosure.
If Entryo becomes aware of a security incident affecting personal information, Entryo will take reasonable steps to investigate, contain and remediate it, notify the affected customer without undue delay as required by the applicable customer agreement, and assist with notifications to individuals or authorities when required by applicable law. Any statutory notification will follow the requirements and commencement dates then in force.
12. Changes and contact
We may update this policy when the product, deployment or legal requirements change.
The effective date above will be revised when material updates are published.
Privacy and support requests: +91 77392 86549 or supportentryo@gmail.com .