Troop — Privacy Policy

Last updated: 8 May 2026

This policy covers the Troop mobile and web applications operated by AIAS Technologies Ltd. The application is currently in internal testing; this notice will be reviewed and revised before any public release.

1. Who we are

Troop is operated by AIAS Technologies Ltd (the “Company”, “we”, “us”), a company registered in Ireland. AIAS Technologies Ltd acts as data controller for the personal data described in this policy. For privacy enquiries, contact brendan@aias.ie.

2. Personal data we collect

When you use Troop, we collect the following categories of personal data:

Account data — your name, email address, role, and the organisation (tenant) and workspace (space) you belong to. Authentication is handled by our identity provider, Auth0.
Identity verification data — a photograph of an identity document you provide and one or more selfie photographs used to verify that the document belongs to you.
Biometric data (special category) — facial templates derived from your selfies. These templates are used to confirm your identity when you clock in or perform a sensitive action. We do not use this data for any other purpose.
Location data — your device’s approximate location at the moment you clock in or out, used solely to confirm you are within the geofenced work area.
Workforce records — clock-in / clock-out events, shift assignments, completed assessments, journal entries, and accreditation submissions (for example, photographs of safety certificates).
Device and diagnostic data — device model, OS version, app version, error reports, and crash logs. We use Sentry for crash reporting.

3. Device permissions

Camera — to capture identity documents, enrolment selfies, face verification at clock-in, and accreditation photographs.
Location — to confirm you are inside an authorised geofence at clock-in / clock-out.
Photos — to attach existing accreditation documents from your photo library.
Notifications — to alert you about shifts, accreditation expiries, and supervisor messages.

You can revoke any of these permissions in your device settings; some app features will be unavailable as a result.

4. Why we use your data and the legal basis

To provide the service (clock-in, shift management, accreditation tracking) — performance of a contract with your employer (your employer is the contracting party; you are a permitted user).
To verify your identity using face biometrics — explicit consent under Article 9(2)(a) GDPR. You may withdraw this consent at any time by contacting your supervisor or us; doing so will prevent you from using face-based clock-in.
To prevent fraud, ensure workplace safety, and meet your employer’s compliance obligations — legitimate interests of your employer and of us as the platform operator.
To diagnose and fix problems — legitimate interests in maintaining a secure, reliable service.

5. Who processes your data on our behalf

We use the following sub-processors:

Microsoft Azure (North Europe / EU) — application hosting, database, blob storage.
Auth0 by Okta — authentication. Auth0 may process limited account data outside the EU; transfers are covered by Standard Contractual Clauses.
Amazon Web Services (Rekognition) — face matching for identity verification. AWS may process biometric data outside the EU; transfers are covered by Standard Contractual Clauses.
Functional Software Inc. (Sentry) — crash and error reporting.

6. International transfers

Where data leaves the European Economic Area — for example when AWS Rekognition or Auth0 process data in their US infrastructure — we rely on the European Commission’s Standard Contractual Clauses, supplemented by the technical measures (encryption in transit and at rest) described in section 8.

7. Retention

Account and workforce records — retained for the duration of your relationship with your employer plus the period your employer is required to retain employment records under applicable law.
Biometric templates — deleted within 30 days of you withdrawing consent or your account being deactivated.
Identity document images and selfies — deleted within 30 days of you withdrawing consent or your account being deactivated.
Diagnostic and crash data — retained for up to 90 days.

8. Security

Personal data is encrypted in transit (TLS 1.2 or higher) and at rest. Access to production systems is restricted, logged, and authenticated. Biometric templates are stored separately from your raw selfie images.

9. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased (subject to your employer’s legal retention obligations);
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent (in particular for face biometric processing); and
lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or your local supervisory authority.

To exercise any of these rights, contact brendan@aias.ie.

10. Children

Troop is intended for adults in a workplace context and is not directed at anyone under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to your employer and, where appropriate, to you directly through the app.

12. Contact

AIAS Technologies Ltd
Monaghan, Ireland
brendan@aias.ie