Privacy Policy

Last Updated: June 1, 2026

Welcome to KKTechTherm. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and backend services (collectively, the "Service").

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the application.

1. Information We Collect

We collect various types of information in connection with the services we provide, including:

a. Personal Information

When you register or use the Service, we may collect personally identifiable information, such as:

• User Account Data: Full name, email address, phone number, and account passwords.
• Worker Data: Names, phone numbers, Universal Account Numbers (UAN), daily wages, and assigned job roles of construction site workers managed via the app.

b. Media, Documents, and Files

To provide core functionalities like expense and site management, we collect data you upload directly or capture using your device camera:

• Profile Photos: Images uploaded for user profiles.
• Invoices and Receipts: Images or PDFs of expenses for accounting and tracking.
• Site Documents: Documents related to purchase orders (PO), billing, and general site files.
• Inventory, Machinery & Tool Images: Photos related to site machinery, tools, and inventory, including Third-Party Inspection (TPI) images.

c. Application Usage, Technical & Operational Data

We automatically collect data generated through your use of the application and its underlying infrastructure, which includes:

• Network & Device Information: Internet Protocol (IP) addresses, device host details, request paths, HTTP methods, and response durations captured automatically by our server middleware.
• Attendance Records: Daily check-ins, overtime logs in minutes, and absenteeism of workers.
• Site Activity: Expense logs (amount, payment mode, payer), inventory tracking, site location data, and project management status.
• Machinery Data: Machinery usage details, including vehicle numbers, origins ("from location"), rates, and operating weights.
• System Activity: Login and logout timestamps, backdated attendance requests, feature usage, and synchronization logs between the mobile app and our servers.

d. Device Permissions (Frontend App)

When using our mobile application, we may request access to certain device features:

• Camera and Photo Library: To allow you to take and upload profile pictures, invoice receipts, and TPI images directly within the app.
• Push Notification Tokens: We collect device-specific tokens (e.g., Expo Push Tokens) to send necessary administrative alerts, updates, and sync notifications to your mobile device.
• Local Storage: We utilize local on-device storage (using SQLite and Async Storage) to cache data for offline-first capabilities, ensuring your data synchronizes automatically once network connectivity is restored.

2. How We Use Your Information

We use the collected information for the following purposes:

• To Provide and Maintain the Service: Enabling site tracking, workforce management, financial tracking, and attendance logging.
• Authentication & Security: Verifying user identities, preventing unauthorized access, monitoring system health, and providing Role-Based Access Control (RBAC).
• Data Synchronization: Ensuring offline mobile data is accurately synced with our central database.
• Communication: Sending push notifications, administrative messages, and updates regarding your assigned sites.
• Record Keeping & Analytics: Generating operational statistics, financial reports, and workforce insights.

3. Disclosure of Your Information

We do not sell your personal data. We may share information we have collected about you in certain situations, primarily with trusted third-party service providers that perform services for us or on our behalf. These include:

• Cloud Infrastructure Providers: We use Google Cloud Platform (GCP) for hosting our application securely.
• Storage and Database Services: We use Supabase to securely host and manage uploaded documents and images.
• Application Monitoring and Logging: We use Better Stack (Logtail) to monitor our application's health. Transient data such as IP addresses, User IDs, and request paths are shared with this service for debugging and security purposes.
• Notification Services: We utilize the Expo Push API and Google Firebase Cloud Messaging (FCM) to deliver push notifications to your mobile device. Notification payloads (which may include site names and user names) and Push Tokens are shared with these services to facilitate delivery.
• By Law or to Protect Rights: If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others.
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4. Data Security

We use administrative, technical, and physical security measures to help protect your personal information. This includes encrypted password storage (Scrypt hashing), secure JSON Web Tokens (JWT) for session management, encrypted connections, and cloud secret management. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable.

5. Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our systems utilize logical ("soft") deletion methods to preserve historical integrity for attendance, expenses, and operational audits while restricting active access.

6. Your Data Privacy Rights

Depending on your location, you may have the right to:

• Request access to the personal data we hold about you.
• Request correction of incomplete or inaccurate data.
• Request deletion of your personal data.
• Object to or restrict the processing of your data.