Ctrlk
Website
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Data Privacy & Ethics

We360.ai data privacy — blur engine, stealth vs. visible monitoring modes, GDPR compliance, and employee data ownership.

Data Privacy & Ethics

At We360.ai, data protection and ethical processing of workforce analytics are governed by strict legal, regulatory and information security standards. Our platform is designed to ensure that organizational visibility is achieved without compromising individual privacy, data ownership or lawful processing principles.

Lawful, Fair & Purpose Limited Processing

We360.ai processes data solely for legitimate and explicitly defined business purposes, including productivity insights, operational analytics, insights, system security and regulatory compliance.

Data collection is limited to what is relevant, necessary and proportionate to these purposes, in alignment with globally accepted privacy principles and the requirements of the Digital Personal Data Protection Act (DPDP Act 2023), India.

Transparency & Informed Use

We enable organizations to implement clear and auditable monitoring policies by providing:

  • Configurable tracking controls aligned to business requirements

  • Visibility into what data is collected and how it is used

  • Access for users to view their own work analytics

This ensures transparency, supports informed deployment and promotes accountable data governance.

Data Subject Rights & Control

We360.ai supports the exercise of user rights, including the ability to:

  • Access and review personal data

  • Request rectification or erasure, where applicable

  • Withdraw consent in consent based environments

  • Raise grievances through defined redressal mechanisms

Data ownership remains with the customer organization and We360.ai acts as a data processor in accordance with contractual obligations.

Security & Technical Safeguards

We maintain enterprise grade information security controls to ensure the confidentiality, integrity and availability of data, including:

  • Encryption of data in transit and at rest

  • Role based access control and least privilege enforcement

  • Secure hosting infrastructure

  • Continuous monitoring and vulnerability management

Our security framework aligns with internationally recognized standards such as ISO 27001, VAPT and SOC 2 Type II.

Data Collection Specifics

All data collected by the We360.ai agent is encrypted both in transit and at rest using Google Cloud Platform (GCP) for secure storage.

Computer and User Information

The agent collects essential device and session metadata (not tied to individual user activities):

  • Computer Name -- The machine's hostname.

  • Computer Timezone -- The local timezone configured on the device.

  • Logon Domain -- The Active Directory domain name, or the computer name if not domain-joined.

  • Network ID -- A hashed representation used for uniqueness.

  • Private IP -- Local network IP address.

  • Public IP -- Internet-facing IP address.

  • Session ID -- Identifies different user sessions, particularly on terminal servers.

  • User Information -- Login names from the operating system (friendly name and simple login name).

User Activity Information

User activity is defined as the currently active window with mouse movement, mouse clicks, and keypresses — all captured with sub-second precision. We360.ai provides fully functional keyboard and mouse activity tracking but does not perform keylogging; individual characters typed are never recorded. The information collected includes:

  • Date and Time -- When a specific activity was first accessed.

  • Description -- Brief description of each activity.

  • Duration -- Time spent on an activity.

  • Executable -- The executable file associated with each activity.

  • Screenshots -- Periodic screenshots of the active window (frequency is configurable).

  • Title -- Content of the title bar of the activity window.

  • URL -- Full URL accessed in a browser for web-based activities.

Data We Never Collect

We360.ai strictly does not collect:

  • Keystroke logging -- Individual keystrokes are never recorded.

  • Video camera monitoring -- Webcam feeds are never accessed or recorded.

The Blur Engine

To further strengthen privacy protection, We360.ai incorporates a built-in Blur Engine designed to prevent the exposure of sensitive or confidential information during screen monitoring or analytics processes.

The Blur Engine automatically obscures or masks sensitive visual data that may appear on user screens, ensuring that productivity insights can be generated without revealing confidential content.

The Blur Engine reinforces We360.ai’s commitment to privacy by design, ensuring that productivity analytics and workforce intelligence can be delivered while minimizing unnecessary exposure of sensitive data.

Key Capabilities of the Blur Engine

  • Automatic blurring of sensitive on-screen content where required

  • Configurable privacy settings aligned with organizational policies

  • Protection of confidential information such as personal communications, financial details, authentication fields, or other sensitive data elements

  • Support for privacy-conscious monitoring practices in hybrid and remote work environments

Data Lifecycle

Data Retention & Minimization

Data is retained only for the duration necessary to fulfill the specified purpose or to meet contractual and legal requirements. Upon expiry of the retention period, data is securely deleted or irreversibly anonymized.

Third-Party Processing

If required, any engagement with subprocessors is governed by strict confidentiality, data processing agreements and equivalent security obligations. Cross border data transfers, where applicable, are conducted in compliance with relevant legal frameworks.

Compliance Commitment

Our privacy and security program are structured to support compliance with major global data protection and industry regulations:

Digital Personal Data Protection Act 2023 (India) Aligns with requirements governing the processing of digital personal data in India.

General Data Protection Regulation Governs the protection of personal data for individuals within the European Union.

California Consumer Privacy Act Provides California residents with enhanced rights regarding the use of their personal data.

Health Insurance Portability and Accountability Act Protects sensitive patient health information from being disclosed without the patient's consent or knowledge.

Service Organization Control 2 Type II Validates that internal controls meet the Trust Service Criteria.

Governance & Accountability

We maintain internal policies, audit mechanisms and contractual controls to ensure responsible data handling and continuous compliance with evolving regulatory standards.

Data Governance Policies

Data Residency

Customer data is hosted in secure cloud infrastructure environments designed to meet enterprise security and compliance requirements. Where applicable, We360.ai supports hosting customer data within specific geographic regions to comply with regulatory or organizational data residency requirements. For customers operating in India, data may be hosted within infrastructure located in India to support compliance with the Digital Personal Data Protection Act and other applicable regulations.

Data Ownership

Customers retain full ownership of the data they provide or generate within We360.ai. The organization does not sell, rent, or commercially exploit customer data. Customer data is processed solely for the purpose of delivering platform services and supporting system functionality.

Data Usage Limitations

Customer data is processed only for legitimate operational purposes related to the delivery of platform services including:

  • Platform functionality and analytics

  • System monitoring and troubleshooting

  • Service improvement and reliability

Unauthorized access, sharing, or use of customer data is strictly prohibited. Data usage is governed by strict access control policies and internal security procedures.

Customer Access & Portability

Customer Data Access Rights

Customers maintain control over access to their data within We360.ai. Authorized customer administrators can:

  • Manage user access permissions

  • Configure system integrations

  • View and analyze operational data

  • Export data where functionality permits

Data Portability

Customers may request access to their data in order to export or transfer it for operational or compliance purposes through APIs, system reports, or explicit export mechanisms.

Ethical Use of Workforce Analytics

We360.ai is built on the principle that workforce analytics must enable better work outcomes while preserving individual dignity, trust and organizational transparency. The platform is designed to generate objective, work pattern based insights that support process optimization, capacity planning and data driven decision making, rather than employee surveillance.

Workplace data is contextualized to reflect productivity trends, application usage patterns and workflow efficiency, ensuring that insights are business relevant and not behaviorally intrusive.

We360.ai does not position analytics as a tool for micromanagement or punitive evaluation. Instead, it enables organizations to adopt a balanced, proportionate and policy driven approach that is consistent with applicable data protection laws, internal governance frameworks and globally accepted workplace ethics standards.

We360.ai promotes ethical deployment by enabling organizations to:

  • Define role-based and policy driven tracking configurations aligned with business needs.

  • Restrict monitoring to designated work hours and authorized environments.

  • Provide employees visibility into their own productivity analytics to encourage self improvement and accountability.

  • Use aggregated and trend based insights for performance conversations, workforce planning and process enhancement.

  • Avoid disproportionate or covert monitoring practices.

Stealth and Visible Modes

We360.ai provides configurable deployment options through Stealth Mode and Visible Mode, allowing organizations to align monitoring practices with their internal policies and regulatory requirements.

Ensures transparency by displaying the application interface to users, allowing them to view their work analytics and system status. Users are required to punch in & out in Visible Mode.

Where permitted by applicable laws and organizational policies, allows the monitoring agent to operate silently in the background without a visible interface. Stealth Mode is fully functional — all tracking features (per-second activity monitoring, screenshots, input tracking, and screen recording) work identically to Visible Mode.

PreviousThe Anatomy of the We360.ai Agent
NextSystem Architecture

Last updated

Was this helpful?