Privacy Policy

Last updated

This policy explains what CivilOne collects through CivilOne, why, and what happens to it. It covers our website, our mobile applications and everything reached from them.

What we collect

Details you give us

• Your name, email address, phone number and the name of your business, when you create an account.
• Billing details — the legal name, address, GSTIN and contact details that go on your invoices.
• The records you enter about your projects: sites, stages, staff, attendance, wages, materials, vendors, sub-contractors, clients, payments, and the documents and photographs you attach.
• Anything you send through the in-app "Tell us" form, including a screenshot if you attach one.

Details collected as you use it

• Location, when you clock in or out or record work on site — so attendance is tied to the site it happened at.
• Location during a shift, only where your business has set an automatic clock-out boundary for the site. While your shift is running the app checks your phone's location every couple of minutes, in the background, with a notification showing the whole time. Each check is only compared with the site boundary and is not saved, except the point at which it clocks you out. The checks stop when your shift ends.
• Photographs you take through the app, with the date they were taken.
• Face data, where your business uses face-verified attendance: reference photos of your face taken when you are set up, and a mathematical template made from them on the device. Both are stored for your business and used only to recognise you at clock-in. The photo taken at each face-checked clock-in is deleted automatically after 48 hours.
• Technical information — device type, app version, and error reports when something goes wrong.

Why we hold it

• To provide the service you subscribed to.
• To bill you, and to issue the tax invoices the law requires.
• To support you when you ask for help, and to fix what has broken.
• To keep the service secure and prevent misuse.
• To meet our own legal and tax obligations.

We do not use your records to train AI models. Where an AI feature is used, the specific content you send it is processed to answer that request and is not used to improve anyone's model.

Who it is shared with

Only where it is needed to run the service:

Google Firebase

Hosting, database, file storage and notifications. Data is held on Google Cloud infrastructure.

Razorpay

Payment collection. They receive what is needed to take the payment. We never receive or store your card or UPI details.

Anthropic

The AI features. Only the content of the specific request is sent.

Resend

The verification codes and notices we email. They receive your email address and the message.

Google Maps Platform

Address search when a site's location is set. The text typed into the search is sent to find matching addresses.

We may disclose information where the law requires it. We do not sell personal information, and we do not share it for advertising.

Your staff and your clients

Much of what is in your account is about other people — your employees, your clients, your vendors. For that information you are the controller and we process it on your instructions. You are responsible for telling those people what you hold and why.

How long we keep it

For as long as your account is active. After an account ends we keep the data for a reasonable period so you can recover it, then delete it. Invoices and tax records are kept for as long as Indian tax law requires, which is longer.

Security

Data is encrypted in transit and at rest. Access is controlled by role, so people see what their job needs. Our own back-office access is limited to a named list and is used for support and billing, never to browse your records. Photographs and documents sit in per-business storage that no other customer can reach.

Your rights

You can ask us to show you what we hold, correct it, or delete it. Most of it you can see, edit and export yourself from inside the app at any time. For anything else, write to our contact page. We answer within thirty days.

Deleting your account

Anyone with a CivilOne login can ask for their account to be deleted from inside the app: open Profile, scroll to the bottom and tap Delete my account. You are signed out straight away, and a manager of your business carries the deletion out from Approvals.

When it is carried out, your login is removed, along with your phone number, email address, face photos and template, and the documents on your profile. Records your business must keep by law — attendance, wages, payments — stay with the business under your name, for as long as the law requires.

If you cannot open the app, write to our contact page from the phone number or email address on the account, and we will arrange it. A business owner who wants the whole business and all its data removed can do that from Profile → Reset & recovery, or by writing to us.

Children

CivilOne is business software and is not intended for anyone under 18.

Changes

If this policy changes materially we will say so in the app or by email before the change takes effect.

Getting in touch

Questions about privacy, or about anything we hold, go to our contact page. Our postal address is on the contact page.