Privacy Policy — DrishtiOps

1. Who is responsible

Your employer or principal (the organisation that enrolled you) decides what is recorded on its sites and why. Under the Digital Personal Data Protection Act 2023 it is the data fiduciary.

SSN TechSphere builds and runs DrishtiOps and processes the data on the organisation’s instructions. For questions about this policy, or to exercise a right, write to privacy@ssntechsphere.com. Our Grievance Officer is [name of Grievance Officer].

2. What is recorded, and why

Category	What	Why
Identity	Name, email or phone number, employee number, role, organisation and site, date of birth.	To sign you in, to know which site and crew you belong to, and to confirm you are 18 or over. The date of birth is required by law before anyone can be enrolled.
Attendance	Check-in and check-out times, shift date, whether the check-in was inside the site boundary, and who recorded it if it was done on a crew device.	The muster roll the site is required to keep. It is not a wage calculation.
Location	Your position at check-in and when a photograph is taken, and whether it was inside the site boundary. Stored rounded to about 110 metres except in the precise record attached to a photograph.	To show that work and attendance happened on site. “Could not be checked” is recorded as exactly that, never as “outside”.
Photographs and voice notes	Photos taken in the app as completion evidence, with a signed capture record (hash, time, position, device). Optional voice notes describing a problem.	Evidence that work was completed and how. Photos are taken with the camera only; the app cannot read your photo library for evidence. Faces can be pixelated before the photo is sealed.
Work	Tasks assigned to you, their status, your notes, blocked reasons, escalations, procurement requests, approvals and the audit trail of who changed what and when.	Running the work and keeping the record of it.
Messages and notices	Chat messages in your organisation, site and direct channels; notices published to you.	Communication about the work.
Device	A push-notification token, a device signing key (public half only), your handset make and model, app version, and a session record so a lost phone can be revoked.	Notifications, evidence signing, and security.
Errors	Crash and error reports with a message, stack trace and app version.	Fixing defects. Kept 30 days.

We do not collect analytics, advertising identifiers or behavioural tracking. There is no analytics or advertising software in either app.

3. No consent toggles, and why

Attendance, location at check-in and completion photographs are conditions of the work, not options. The app does not ask you to “agree” to them, because a daily-wage worker cannot meaningfully refuse and a recorded agreement obtained that way would be worthless. Instead the app tells you, in your own language, exactly what is recorded and why. The legal basis is the employer’s legitimate employment purposes and, for the registers, its legal obligation to keep them.

The one thing you genuinely can refuse is raising a grievance. That is the only place a consent question is asked.

4. Who can see what

You can see your own attendance, tasks, photographs, messages and a summary of everything held about you (“My data” in the app).
Your supervisor, manager and organisation owner can see the work and attendance of the crews and sites they are responsible for. Access is enforced in the database, not just in the app.
External inspectors, observers and auditors can see only the sites and categories your organisation has granted them, for a limited time. Photographs shown to them have precise location and handset data removed. Every view is logged.
Other organisations cannot see your data.
We access data only to operate the Service, fix defects, or when required by law. Our staff do not browse customer records.

Your work record is yours. You can generate a link to it and choose who to send it to. Nobody in your organisation, including the owner, can list the links you have made or look up another worker’s record by name. There is deliberately no such function.

5. Who processes data on our behalf

Provider	What they receive	Where
Supabase (on Amazon Web Services)	All stored data: database, files, authentication.	Mumbai, India (ap-south-1)
Vercel	Hosting of the web console. No personal data is stored there.	Global edge network
Google Firebase Cloud Messaging	Your push token and the text of each notification.	Google infrastructure
MyMemory (Translated srl) and Google Translate	The text of ordinary task instructions, sent for machine translation into Hindi. Never your name, photographs, location or attendance. Never any text from a high-risk task (electrical, work at height, confined space, hot work, lifting), which are translated only from reviewed phrases held by us.	EU (MyMemory); Google infrastructure

MyMemory is a public translation memory and may retain submitted text. Instructions can name a site or a piece of equipment. Organisations that consider this unacceptable can disable machine translation for their tasks, in which case workers see English with a “not translated” marker.

We do not sell personal data and we do not share it for advertising.

6. How long it is kept

Each kind of record has its own period, set by what the law requires of the site. The full schedule is published in machine-readable form and every period below can be verified against it.

What	Kept for	Why
Task audit trail, attendance register, dispute records, access and export logs	5 years	Statutory registers under the BOCW Central Rules 1998; CERT-In log floor. Cannot be shortened, including by your employer.
Completion photographs, voice notes and their signed capture records	Up to 5 years from task close	Evidence supporting the registers. Your employer may choose a shorter period. Never indefinite.
Precise location and handset details attached to a photograph	1 year from task close	The most identifying data held, so the shortest period that serves the purpose.
Reference photographs attached to a task	30 days after task close	Instruction, not evidence.
Chat messages	1 year	Long enough to settle who asked for what.
Notifications and alerts	90 days	Operational messaging with no evidentiary role.
Crash and error reports	30 days	Diagnostic only.
Exported files	1 hour	Served by a short-lived link, then inaccessible.

A record may be held beyond these periods only under a legal hold, which records who placed it, when and why, and which only an organisation owner can release.

7. Your rights

See it. “My data” in the app shows every category held about you, with counts and the date each retention clock started. No request is needed.
Correct it. Ask your supervisor or manager to correct your name, phone number or an attendance entry. Corrections to registers are recorded as new entries, never by editing the old one.
Delete your account. From the app, at any time, without giving a reason. See section 8.
Take your work record with you. Generate a share link from the app. It shows your completions and attendance, never a score or a ranking against anyone else.
Complain. Raise a grievance in the app. It is routed to an owner or manager who is not the subject of the complaint, and that person cannot read it. If it cannot be routed it is still recorded and you are told. You may also write to us, or to the Data Protection Board of India.

8. What deleting your account does

Deleted, permanently: your name, email, phone number and date of birth; every photograph and voice note you captured; your chat membership, devices, crew and site assignments; your error reports and notifications; the links to your work record.

Kept, and why: the record of work that was done does not disappear when an account is deleted. Your employer is required to preserve the attendance register and task audit trail for five years, and they are also the record that a job was done safely. What we do instead is remove you from them. Every entry refers to a person by a random reference number, not by name. Deleting your account destroys the only link between that number and you. The entry continues to say what was done, when, and by someone in what role. This is pseudonymisation, not anonymisation, and we do not call it complete deletion.

9. Security

Data is encrypted in transit (TLS) and at rest.
Access rules are enforced row by row in the database. Every organisation’s data is isolated; a bug in the app cannot reach across that boundary.
Photographs are stored privately and served only through short-lived signed links.
Evidence photographs are hashed on the device before upload and, where the handset supports it, signed by a key that cannot leave the phone. The audit trail is a hash chain with a daily published anchor, so alteration after the fact is detectable.
On Android, data waiting to be sent is encrypted on the device with a key held in the phone’s secure hardware. An optional app lock is available.
We never store passwords; authentication is handled by Supabase Auth. PINs are stored hashed.

Two limits are worth stating plainly. A phone that never reconnects to a network cannot be remotely wiped. And a rooted or compromised phone can produce a photograph the app cannot distinguish from a real one; the signature proves the claims were not altered after capture, not that the scene was genuine.

10. Children

The Service is for adults at work. It refuses to enrol anyone under 18 and this cannot be overridden.

11. Changes

We will notify organisation owners of material changes at least 14 days in advance and update the in-app notice shown to workers. The date at the top of this page is the date the current version took effect.

12. Contact

SSN TechSphere, [registered office address]. privacy@ssntechsphere.com. See also the Terms of Service and Disclaimer.