Skip to Content

Kormi HR App Privacy Policy

Last updated: 19 October 2026

This policy explains how the Kormi HR mobile app, listed on Google Play as "kormiDot HRM — HR for Odoo" (Android package com.dotbdsolutions.kormihr), handles your information. Kormi HR is made by Dot BD Solutions Limited, Dhaka, Bangladesh ("Dot BD", "we").

The short version: Kormi HR is a phone app for an Odoo system that your employer runs. The app sends your information only to your employer's Odoo server, and to the outside services your employer chooses to switch on (listed below). Dot BD does not run a server in between, does not receive your HR data through the app, and has no analytics, advertising or tracking in the app.

1. Who is responsible for your data

Your employer (or the organisation that gave you your Kormi HR account) owns and controls the Odoo server the app connects to. When you sign in you enter that server's address, and every screen in the app reads from and writes to that server only. Your employer decides what is collected, who inside the organisation can see it and how long it is kept, so your employer is the controller of your data.

If Dot BD also hosts or maintains that Odoo server for your employer, we handle the data only on your employer's instructions and under our contract with them.

2. Information the app sends to your employer's Odoo server

Which of these apply depends on your role and on the Odoo apps and Kormi modules your employer has installed. Each screen follows your own access rights in Odoo.

  • Sign-in details: your server address, database, login or email, and password or access token, used to sign you in to your employer's Odoo.
  • Profile: your name, work contact details, employee record and profile photo, and any changes you make to your own contact details.
  • Attendance: the time of each check-in and check-out, whether it was made offline, the location of the check-in when available (see section 3), whether location was off or refused, and whether the phone reported a simulated (mock) location.
  • Check-in photo: if your employer turns on "Take pictures on check-in" in Odoo, a small picture from the front camera is taken when you check in.
  • Time off: your requests, attached documents, balances, and approvals or refusals made by managers.
  • Expenses, timesheets and approvals: expenses with receipt photos or PDFs, hours you log, and approval requests, if your employer uses these Odoo apps.
  • Payslips: payslips your employer publishes to you are shown in the app. They are not kept in the app's offline copy.
  • Recruitment (HR staff only): job positions, applicants, their CVs, stages, ratings and notes. CVs and notes are not kept in the app's offline copy.
  • Chat and calls (if your employer installs Kormi Chat): messages, voice messages, photos and files you send, and voice or video calls, group calls, meetings and screen sharing with colleagues.
  • AI assistant (if your employer installs Kormi AI and allows you to use it): the questions you type or speak and any images you attach, so the assistant can answer.
  • Device and session: a name for the signed-in device, the app version, a push notification token (if notifications are set up), and the IP address your server sees, so HR can see and revoke the devices signed in to your account.

3. Location

Kormi HR reads your location only at the moment you tap check-in or check-out, while the app is open, so your employer can confirm where the attendance was recorded (for example, inside an office or site area). The app does not track your location in the background, does not read it while the app is closed, and has no background location permission.

You can allow precise or only approximate location, or refuse it. If you refuse, the rest of the app still works; your employer's settings decide whether a check-in without location is accepted. Managers with permission can see check-in locations on a map in the app.

4. Camera, microphone, photos and files

  • Camera: used only when you take a profile photo, a check-in photo, a receipt or chat photo, or turn on video in a call.
  • Microphone: used only when you record a voice message, talk to the AI assistant, or are in a voice or video call.
  • Photos and files: only the photo or file you pick is read and uploaded. The app does not browse or upload your gallery on its own.
  • Screen sharing: your screen is shared only after you start sharing in a call and confirm Android's screen-capture prompt. It stops when you end sharing or leave the call.

5. What stays on your phone

  • Your sign-in session, so you do not have to sign in every time. Saved passwords for switching between accounts are kept in Android's encrypted storage (Android Keystore).
  • A copy of screens you recently opened, kept for up to 7 days in the app's private storage so they still show without internet. Payslips, CVs and recruitment notes are never kept in this copy.
  • Check-ins, time-off requests and decisions you made offline, until they are sent to your server.
  • Your settings (language, theme, app lock, reminders) and on-device translation models.
  • Biometric unlock (fingerprint or face) is checked by Android itself. Your fingerprint or face data never leaves the phone and is never seen by the app or by us.

Signing out deletes the session and the offline copy for that account. Uninstalling the app deletes everything the app kept on the phone.

6. Outside services the app uses

Apart from your employer's Odoo server, the app talks only to the services below, and most of them only when your employer switches the feature on:

  • Firebase Cloud Messaging (Google): delivers push notifications for chat, calls, time off and other HR news. It is used only if your employer connects its own Firebase project in Odoo; the app ships with no Firebase project of ours. Your device's push token and the notification content pass through Google's servers.
  • AI model providers: if your employer turns on Kormi AI, your employer's Odoo server (not the app) sends your question to the AI provider your employer has chosen and pays for, such as OpenAI, Anthropic, Google Gemini or Groq. Those providers handle it under their own terms with your employer.
  • OpenStreetMap: map screens load map images from tile.openstreetmap.org, which sees your IP address and the map area shown, but not who you are.
  • Call connection (WebRTC): to connect a call, the app may contact Google's public STUN server (stun.l.google.com), which sees only your IP address, or a relay server your employer sets up. Call audio and video are encrypted in transit.
  • Google ML Kit: if you choose another app language, Google's translation model is downloaded once; translation then runs on your phone.
  • Google Play: may show Google's in-app rating prompt. Your rating goes to Google Play, not to us.
  • Links such as "open in Google Maps", WhatsApp or our website open in other apps or your browser, under those services' own privacy policies.

7. What Dot BD collects

Nothing through the app. Kormi HR contains no analytics, no advertising, no crash-reporting service and no tracking SDK. We do not sell, rent or trade personal data, and we do not use it for advertising. If you contact us by email or WhatsApp, we use what you send only to answer you.

8. Who can see your data

Inside your organisation, people see your data according to the access rights your employer sets in Odoo: for example, your manager can approve your time off and HR can see attendance. The app does not share your data with anyone else, except the services in section 6 that your employer enables.

9. Security

  • The app connects to servers over HTTPS only; unencrypted connections are blocked.
  • Saved passwords are kept in Android's encrypted storage, and the offline copy lives in the app's private storage.
  • Optional app lock with fingerprint, face or device PIN, and support for Odoo two-factor authentication.
  • HR can revoke a lost or old device from Odoo, which signs it out.

10. Keeping and deleting your data

Your account and records are stored in your employer's Odoo and are kept for as long as your employer decides. To see, correct, export or delete your data, or to close your account, contact your employer's HR team or Odoo administrator. If Dot BD hosts that server for your employer, you can also write to info@dotbdsolutions.com and we will pass your request to your employer and help carry it out.

To remove the app's data from your phone, sign out or uninstall the app. Full steps: https://www.rafiurrahmanrafit.xyz/kormi-delete-data

11. Children

Kormi HR is a workplace app for employees and is not meant for children. We do not knowingly handle data of children under 13.

12. Changes to this policy

When the app changes how it handles data, we update this page and the "Last updated" date above. This page always stays at https://www.rafiurrahmanrafit.xyz/kormi-privacy-policy.

13. Contact us