Privacy Policy
Last updated: 18 September 2026
FRAMES is a staff attendance and event management platform operated by MaxCIT Limited (Freetown, Sierra Leone). It is sold to organizations — employers, institutions and event organizers — who use it to record the attendance of their own adult staff and members. It may not be used to enrol anyone under 18 (see section 3).
This policy explains what the FRAMES software collects and why. In most cases the organization that enrolled you is the data controller and MaxCIT is a data processor acting on their instructions. If you were enrolled by your employer or school, contact them first about your data; we will assist them.
1. What we collect
| Data | Why | Where it lives |
|---|---|---|
| Profile photo — one photo per person, taken when they are enrolled | Shown on the kiosk when that person checks in, so the operator can confirm the right person was matched | On the enrolling device, and stored in the organization’s FRAMES account on our servers so every kiosk in that organization can show it |
| Check-in images captured each time someone is recognised | To recognise the person at that moment, and as a visual record on the device | On the kiosk device only. Check-in images are never uploaded to our servers |
| Face embeddings — a numeric template derived from a face image | To match a face against the enrolled roster | On the device, and synced to the organization's FRAMES server so a new device can recognise existing members |
| Identity details — name, member/employee ID, group, and email or phone where provided | To identify who an attendance record belongs to | Device and server |
| Attendance records — date, time, check-in/out type, and the kiosk that recorded it | The core purpose of the product | Device and server |
| Kiosk location label — an administrator-chosen text name such as “Main Entrance” | To show where a check-in happened | Device and server |
| Device identifiers — the kiosk's device code and sync status | To authorise the device and keep it in sync | Device and server |
| Administrator accounts — name, email, hashed password | To sign in to the web portal | Server |
| Event registrations — name, email, and any answers to the organizer's form | To register attendees and issue tickets | Server |
We do not collect satellite or network location. The FRAMES mobile app requests no location permission and never reads your device's position. “Location” in FRAMES means a text label an administrator typed, such as “Main Gate”.
2. Biometric data
Face recognition is the core of FRAMES, so we are specific about it.
- Matching happens on the device. The kiosk compares a live face against templates stored locally. It does not stream video or images to us.
- Two things leave the device: embeddings and one profile photo. An embedding is a list of numbers describing facial geometry — it is not a photograph and cannot be viewed as one. The profile photo is the single picture taken at enrolment, shared with the other kiosks in the same organization so they can show it when that person checks in.
- Check-in images stay on the kiosk that captured them. They are never uploaded, and they are removed when the app’s data is cleared or the device is unlinked from the organization.
- Deleting a member deletes their face data. Their embeddings and profile photo are removed from our servers straight away, and from each kiosk the next time it syncs.
- We do not use faces to train anything. Embeddings are used only to match members within the organization that enrolled them, and are never sold, shared with other customers, or used to build models.
Biometric data is treated as sensitive personal data. Many jurisdictions require explicit, informed consent before it is collected. The organization enrolling members is responsible for obtaining that consent; FRAMES provides the means to delete a member and their biometric data at any time.
3. Age restriction — adults only
FRAMES is for staff attendance only. Organizations may not enrol anyone under 18 years of age. This is a condition of use, stated in our Terms of Use and confirmed by every organization when it registers.
This applies to every sector, including education. A school, college or training provider may use FRAMES for teachers and other staff. It may not be used to enrol pupils or students who are under 18.
We take this position deliberately. Biometric data of minors is among the most sensitive categories of personal data, its processing is restricted or prohibited outright in a number of jurisdictions, and it normally requires verifiable parental consent that FRAMES has no mechanism to record. Rather than leave that to each customer to get right, we exclude it.
The FRAMES apps are not directed to children, we do not knowingly collect data from children, and we show no advertising and do no cross-service tracking. If you believe an organization has enrolled a person under 18, tell us at privacy@maxcit.com — we will investigate, require the records to be deleted, and may suspend the account.
4. How we use the data
- To recognise enrolled members and record their attendance.
- To produce attendance reports, timesheets and exports for the organization.
- To run event registration, approvals, QR tickets and reminder emails.
- To keep kiosks in sync and to secure and support the service.
- To bill the organization for its subscription.
We do not sell personal data. We do not use it for advertising. We do not share it with other customers.
5. Sharing
We share data only where necessary to run the service:
- PayPal processes subscription payments. Card and PayPal account details are handled entirely by PayPal and never reach FRAMES servers.
- Email delivery — verification, invitation, ticket and reminder emails are sent through the organization's own mail server, or ours where they have not configured one.
- Hosting — servers operated by MaxCIT or its infrastructure provider.
- Legal obligations — where we are required by law to disclose.
6. Retention
Data is kept for as long as the organization's account is active, because attendance history is the record they are paying to keep. Administrators can delete members, attendance records and events at any time. When a subscription ends, data is retained but inaccessible until the organization either resubscribes or asks us to delete it; on a written deletion request we remove the organization's data within 30 days, except where we must retain records to meet a legal obligation.
Registrations that are never confirmed are deleted after 7 days. If somebody signs up and does not confirm their email address, we hold what they submitted — their name, email address and organization name — for 7 days so they can complete the confirmation, and then delete it automatically. An unconfirmed account cannot be signed into, so nothing beyond the signup form itself is ever collected against it.
7. Security
- Traffic between apps and the server is encrypted in transit (HTTPS).
- Administrator passwords are stored hashed, never in plain text.
- Each organization's data is isolated at the database level, so one customer cannot read another's records.
- Stored credentials such as mail-server passwords are encrypted at rest.
- Kiosks authenticate with per-device credentials that an administrator can revoke.
No system is perfectly secure, and we do not claim otherwise. We will notify affected organizations without undue delay if we become aware of a breach involving their data.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your data, to object to processing, or to withdraw consent. Because your organization controls your record, please contact them first — they can action most requests immediately in the FRAMES portal. If you cannot reach them, contact us at privacy@maxcit.com and we will help, subject to verifying your identity and the organization's instructions.
9. Changes
We will update this policy as the product changes and revise the date above. Material changes will be notified to account administrators by email.
10. Contact
MaxCIT Limited, 8 Jabbiela Drive, Freetown, Sierra Leone
Privacy enquiries: privacy@maxcit.com
General: info@maxcit.com · +232 72 667 635