Privacy policy

Who decides what happens to your data

Each firm decides what to record about its own projects, staff and clients. For that data the firm is the data fiduciary and we process it on the firm's behalf. For account data, such as your sign-in details and how you use the service, Modhruti LLP is the data fiduciary.

What we collect

• Account details: name, mobile number, email address and the firms you belong to.
• Project content added by firms: drawings, photos, comments, agreements, invoices, payment records and issues.
• Location of staff during a site visit, only after that person agrees to it, from the start of the journey until arrival or the end of the visit.
• Technical records: IP address, device model, operating system, app version and the time of each action, kept in an activity log for security and support.
• Subscription billing details for firms. Card and UPI details are handled by Razorpay and never reach our servers.
• Referral details: when a firm signs up with another firm's referral link or code, we record which code was used, when, and the sign-up's IP address and device identifier, to credit the referring firm and to check for self-referral. The referring firm sees only the referred firm's name and how far it got, never its contact details.
• Referral partners: for people we invite to our partner program, their name, email, mobile number and address, their PAN, GST registration and GSTIN, and the bank account or UPI ID we pay commission to, and the record of their acceptance of the partner agreement (name typed, time and IP address). PAN and payout details are stored encrypted and shown only in part, even to our own team. We keep them to pay commission, to deduct TDS and issue TDS certificates, and to meet our duty to keep tax and accounting records, for as long as the law requires (normally eight years after the financial year), after which they are deleted. Partners see only the name of a firm they referred and how far it got, never its contact details, projects or payments.

Why we use it

• To run the service: signing you in, showing each person only what they are allowed to see, and sending the emails and messages you expect.
• To show clients when someone is on the way to their site and to record attendance for the firm.
• To keep the service secure, investigate problems and answer support requests.
• To bill firms for their subscription and issue GST invoices.
• To credit referrals, pay referral partners their commission and meet the TDS and GST rules that apply to those payments.

We do not sell personal data and we do not use it for advertising.

Protection against spam and abuse

The sign-in, sign-up, admin login and partner portal sign-in pages use Google reCAPTCHA to tell people from automated programs. On those pages only, reCAPTCHA collects hardware and software information, such as device and browser details and how the page is used, and sends it to Google for analysis. We receive only a score and use it to decide whether to send a sign-in code. Use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

Cookies

We use cookies that are needed to sign you in and keep you signed in, to protect the sign-in forms, and to remember your language and your cookie choice. When you open a referral link (www.kalpanele.com/r/...), we also set a first-party cookie named kn_ref that holds only the referral code, for 90 days, so the referral is credited if you sign up later. These cookies are necessary and always on. Analytics cookies are used only if you accept them. Every cookie, what it is for and how long it lasts is listed in our cookie policy. You can change or withdraw your choice at any time from "Cookie settings" at the bottom of every page, in the app's account menu, the partner portal and the admin console.

Analytics

If you accept analytics cookies, the website, the app, the partner portal and the admin console load Google Tag Manager and Google Analytics to count visits, the screens used, the steps of sign-up and checkout and the errors people see, so we can improve the service. We do not send names, email addresses, phone numbers, addresses, GSTIN, PAN, project, client or file names, document contents or anything typed into a form: pages are reported as templates (for example /projects/:id) and links that carry a secret are reported without it. When you are signed in we send a coded identifier of your account that only we can match back to you, never the account itself, and it is cleared when you sign out. When a firm pays for a plan, our server tells Google Analytics the plan, the billing cycle, the price before GST, the GST, any coupon and KN credits used, using the analytics identifier of the browser the payment was started from, and only if that browser had accepted analytics cookies. Google Analytics keeps this data for 14 months, and a daily copy is kept in our own Google Cloud project in India for 25 months for reports; Google signals and advertising features are off. If you refuse or withdraw, these tools are not loaded and their cookies are deleted. Google acts as our processor under its data processing terms; see the Google Privacy Policy.

Records of your cookie choices

Each time you make or change a cookie choice we record a random consent identifier, the version of the cookie notice you answered, your choice for each category, how you made it, the site and the time, and your account if you are signed in. We do not record your IP address. Choices made without signing in are deleted after 13 months. Choices linked to an account are kept while the account exists; if you delete your account they are unlinked from it and kept for 3 more years as proof of consent, then deleted. You can see the choices linked to your account on the Account page of the app.

Error logs

When something fails on our servers, the error and where in our code it happened are recorded in Google Cloud (Cloud Logging and Error Reporting) so we can fix it. These records do not carry names, email addresses, phone numbers, PAN or GSTIN: values that look like them are removed before the record is written. They are kept for 30 days.

Where it is kept and for how long

Data is stored in India on Google Cloud in the Mumbai region. Project data is kept while the firm's account is active. When a firm closes its account, its data is deleted within 90 days, except records we must keep by law, such as tax invoices.

Your rights

You can ask for a copy of your personal data, ask us to correct or delete it, withdraw consent for location at any time from the app, and nominate someone to act for you. If your data was added by a firm, we will pass your request to that firm and help them respond.

Deleting your account and your data

When you delete your account, or ask us to erase your data, we delete or anonymise it as described above. Your cookie choice records are unlinked from your account and kept without it as proof of consent. Analytics data already sent to Google carries only coded identifiers; on request we ask Google to delete the analytics data linked to your account's coded identifier, and the copy in our own project expires on its own. Tax invoices and records the law requires us to keep are kept for the period the law sets.

Contact and grievances

Write to [email protected] for any privacy question or complaint. We will acknowledge it and respond within 30 days. You may also approach the Data Protection Board of India.