プライバシーポリシー

01Who we are and our role

Kayease is a software company based in Jaipur, Rajasthan, India. KaySetu is a business software platform (ERP and CRM) that Kayease licenses to organisations. The KaySetu Android app is used by the field staff of those organisations; you can only sign in to it with an account your organisation has issued, and you cannot create a personal account in the app.

We act in two different roles. For information inside the platform, your employer (the organisation that issued your account) decides what is collected, who in the organisation can see it and how long it is kept. In the terms of India's Digital Personal Data Protection Act, 2023, your employer is the Data Fiduciary and Kayease is the Data Processor, handling that information on your employer's written instructions. For visitors to our website, people who contact us, organisations that sign up and pay for a subscription, and anyone who raises a support request with us, Kayease is the Data Fiduciary.

02Information we collect in the mobile app

The app collects only what the features your organisation has switched on need. Each item below is used for the purpose stated next to it and nothing else.

• Account and profile: your name, mobile number, email address, employee identifier, role, organisation code, operating city or territory, team or reporting manager, and a profile photo if you add one. Used to sign you in and to attribute your work to you.
• Sign-in details: a one-time code sent by SMS to your mobile number, or your email address and password. The app reads only the KaySetu code message, through Android's SMS Retriever, and does not request the SMS permission or read any other message. If you set a quick-unlock PIN, it is stored only on your device and is never sent to us.
• Precise location, collected in the background during an open shift: latitude, longitude, accuracy, speed, heading, the time of each reading and whether the device reports the position as simulated. Readings are taken every 15 to 120 seconds depending on whether you are still, walking or driving, and uploaded in batches. Used for attendance punch-in and punch-out (with the address looked up on your device), for the live location and day route your managers can see during the shift, to confirm that visit check-in and check-out happened at the customer's address, and to measure the distance travelled for travel allowance.
• Location you capture deliberately: when you create or edit a customer, lead or distributor, the app can record the device's current position, or a point you pick on a map, as that party's address.
• Photos: a selfie when you check in to a visit, shop or outlet photos at check-in and check-out, expense receipts attached to travel allowance claims, your profile photo, images attached to support requests, and identity or registration documents of customers and distributors (for example Aadhaar, PAN or GST certificates) that you capture on your employer's behalf when onboarding them. The camera and gallery are used only when you tap to take or choose a photo; the app never opens the camera on its own and never scans your gallery.
• Voice notes you record when checking out of a visit, stored against that visit. Recording starts only when you tap the record control and stops when you stop it. There is no background listening.
• Work records: visits, orders, leads, customers, distributors, stock requests, collections, attendance, leave, travel allowance trips and claims, and support requests you create. These are your employer's business records.
• Device and diagnostic information: device manufacturer and model, Android version, app version, and tracking events such as whether location permission is granted, battery-optimisation status, and when tracking started, stopped or failed. Used only to diagnose tracking faults, which on some devices are caused by the manufacturer's battery settings.
• Push notification token: a Firebase Cloud Messaging registration token for your device, used to deliver work notifications such as new visits, approvals, reminders and announcements from your organisation.
• Sign-in records: every sign-in attempt is logged with the time, the method (code or password), whether it succeeded, your IP address, the device or browser identification string and an approximate city derived from the IP address. Used to keep accounts secure and to help your administrator spot misuse.

We do not collect your contacts, call logs, messages other than the KaySetu sign-in code, or any file you have not chosen to attach. The app contains no advertising and no third-party analytics or advertising software. We do not sell personal information.

03Background location in detail

Because background location is sensitive, this section sets out exactly how it works.

• It starts only when you punch in. Nothing is recorded before you begin a shift.
• It stops when you punch out, when your employer's automatic end-of-day checkout runs, or when you sign out. Outside a shift the app reads your location only at the moment you use a feature that needs it, such as checking in to a visit or capturing a customer's address.
• You are always told it is running. A notification stays in your notification bar for the entire time tracking is on.
• It is opt-in at the device level. Before any permission is requested, the app shows a disclosure screen explaining what it collects and why. Android then asks for "Allow all the time" separately, after you have allowed location while using the app.
• You can withdraw it at any time in Android Settings, under Apps, KaySetu, Permissions, Location. Punch-in, visit check-in and travel allowance will then not work. Your employer may require them for your role, but the choice is enforced by your device, not by us.
• Readings are stored on your device when there is no mobile signal and uploaded when connectivity returns, so a shift in a poor-coverage area is still recorded accurately.
• The app detects simulated ("mock") location. It blocks punch-in while a mock location is active and flags readings the device reports as simulated, so that attendance and allowance records stay trustworthy.
• The app asks to be excluded from battery optimisation so that Android does not stop tracking part-way through a shift. That setting collects no data by itself.

04Information we collect on the website and web portal

Enquiries: when you request a demo or contact us through kaysetu.in we collect what you enter, normally your name, company, email address, phone number and message, together with your IP address, which we use to block automated spam.

Sign-up and billing: when an organisation signs up we collect its administrator's name, email address, phone number and password, the organisation's name, and the billing details needed to issue GST invoices (legal name, billing address, GSTIN and state). Subscription payments are processed by Razorpay. Card, UPI or net-banking details are entered on Razorpay's checkout and never reach our servers; we store only the payment reference, amount and status.

Portal use: the web portal stores the business data your organisation enters, such as customers, suppliers, products, orders, inventory, invoices, ledgers and employee records. Managers and administrators see the field data described above.

Sign-in records and technical data: sign-ins to the portal are logged in the same way as in the app. Our servers also keep standard access logs containing the IP address, the page or API requested, the time and the browser identification string.

Cookies and local storage: we use only what is essential to run the service, such as your session tokens, your remembered organisation code and display preferences. We do not set advertising or cross-site tracking cookies, and the website and portal do not currently load any third-party analytics. If we enable analytics in future we will update this policy first.

Support: when you raise a support request we collect what you write and any files you attach.

05Why we use information, and the legal basis

We use the information described above:

• to provide the service your organisation subscribed to: sign you in, record attendance, visits, orders and claims, and keep the app and the portal in sync;
• to calculate travel allowance correctly from the recorded route;
• to let your managers supervise field work during working hours;
• to keep the service secure: to detect misuse, simulated location and unauthorised access;
• to support you and fix faults, using diagnostic events and support requests;
• to bill organisations and issue GST invoices;
• to answer enquiries sent through the website;
• to comply with the law and with requests from authorities.

Workforce information is processed for the employment purposes your employer has specified, with the consent you give when you accept the disclosure shown on first launch and when you grant each device permission. Website, sign-up, billing and support information is processed on the basis of your consent and to perform our contract with your organisation.

06Who your information is shared with

Your employer. Managers and administrators at your organisation can see your attendance, your recorded location and route during working hours, the records you create and your sign-in records. How your employer uses that information internally is governed by its own policies; please ask your employer for them.

Kayease staff. Our staff access data only where needed to operate, secure or support the service, and administrative actions are logged.

Service providers. We use the following providers, each of which processes data only to provide its service to us:

• Cloudflare, Inc. provides network security and content delivery in front of all KaySetu services and sees traffic metadata such as your IP address.
• Our hosting providers operate the servers on which KaySetu's databases and uploaded files are stored.
• Google LLC provides Firebase Cloud Messaging, which delivers push notifications (it receives your device token and the notification content); Google Maps Platform, used for address search in the app (your search text and approximate position are sent through our server, so no key is stored on your phone) and for the maps shown in the web portal; and the Android platform geocoder on your phone, which converts coordinates into an address.
• The OpenStreetMap Foundation serves the map tiles shown in the app's location picker; its servers receive your IP address and the map area you view.
• SMS gateways (SMSGatewayHub, MSG91 or Textlocal) deliver one-time sign-in codes and alerts and receive your mobile number and the message text.
• Our email provider delivers account and notification emails over SMTP.
• ip-api.com converts the IP address of a sign-in into an approximate city for the sign-in log and receives only the IP address.
• Razorpay Software Private Limited processes subscription payments made by organisation administrators.

Legal requirements. We may disclose information where required by law, by a court order or by a government authority, or where necessary to protect the rights, property or safety of Kayease, our customers or others.

Business transfers. If Kayease or the KaySetu business is merged, acquired or sold, information may be transferred to the new owner, who must continue to protect it under this policy.

We never sell personal information and never share it with advertisers or data brokers.

07How long we keep information

Retention periods differ by the kind of information:

• Work records and location: kept for as long as your organisation's subscription is active and for as long as your employer requires them for payroll, allowance, audit and tax purposes. Your employer controls this period and can correct or delete records through the portal.
• When an organisation closes its account, its dedicated database is deleted, backup copies are overwritten within seven days, and we delete the files it uploaded to our media storage.
• Account information: kept while your account is active. After your account is deactivated your name stays attached to the records you created, so that your employer's business records remain intact, until your employer deletes them or the organisation closes its account.
• Sign-in records and device diagnostic events: kept as part of your organisation's security and support log and deleted together with the organisation's data.
• One-time sign-in codes: stored in hashed form and expire after five minutes.
• Sessions: an access token lasts 24 hours and a refresh token expires after seven days without use, so a lost device stops being able to reach your account within a week.
• Website enquiries: kept while we respond and follow up, and deleted on request.
• Billing records and invoices: kept for the period Indian tax law requires.

08Your rights and choices

You can see your own attendance, visits, orders and claims in the app at any time. Under the Digital Personal Data Protection Act, 2023 you also have the right to access your personal information, to have it corrected or updated, to have it erased where it is no longer needed, to withdraw consent you have given, to nominate someone to exercise these rights for you, and to have a grievance heard.

Because your employer controls the records inside the platform, please contact your organisation's administrator first. You can also write to us at [email protected] from your registered email address, quoting your organisation code. We will verify your identity, coordinate with your employer where it controls the records, and respond within 30 days.

Deleting your account: ask your organisation's administrator to deactivate or delete your user, or email us at [email protected] with your organisation code and registered mobile number or email address. We remove your profile and sign-in credentials. Business records you created, such as orders and visits, remain with your employer as its records.

Device permissions: you can withdraw location, camera, microphone or notification access at any time in Android Settings without deleting the app. Features that depend on a withdrawn permission will stop working. Notification categories can also be switched off inside the app.

09Security

We protect information with measures that include the following:

• All traffic between the app, the portal and our servers is encrypted with TLS. The app refuses unencrypted connections.
• Each organisation's data is kept in its own isolated database, separate from every other organisation's.
• Access inside the portal is restricted by role and by per-user permissions, and administrative actions are logged.
• Passwords and one-time codes are stored hashed, codes expire after five minutes and allow a limited number of attempts, and sign-in requests are rate-limited.
• Sessions use short-lived tokens that rotate on each refresh.
• The app stores its session in private app storage, opts out of Android's cloud backup, and detects simulated location.
• Databases are backed up daily and backups are retained for seven days.

No system is completely secure. If you believe your account or data has been compromised, tell us at [email protected] straight away.

10Information stored on your device

To work without a signal, the app keeps some information on your phone: your session tokens, profile and organisation code, the modules your organisation has enabled, location readings and records that are waiting to be uploaded, a cache of lists you have recently viewed, and your quick-unlock PIN if you set one.

Signing out removes your session tokens and profile. Your organisation code and last-used email are kept to pre-fill the sign-in form; use Change on the sign-in screen to clear them. Uninstalling the app removes everything it stored on the device.

11Children

KaySetu is a workplace tool for businesses and their employees and is not directed at children. We do not knowingly collect information from anyone under 18. If you believe a child has been given an account, contact us and we will remove it.

12Where information is processed

KaySetu is operated from India. Your organisation's data is stored on servers managed by Kayease through its hosting providers, behind Cloudflare. Some of the service providers listed above operate globally and may process the limited information they receive outside India, under their own security and privacy safeguards.

13Changes to this policy

If we change this policy we will update the effective date shown at the top. Where a change materially affects how we handle your information we will also notify you in the app or by email before it takes effect. The current version is always available at kaysetu.in/privacy.

14Contact us and grievance redressal

Questions, requests and complaints about this policy or about how your information is handled can be sent to:

Email: [email protected]

Phone: +91 98876 64666

Post: Kayease Global Solutions, B-50 A, Bhagat Singh Tilak Nagar, Jaipur, Rajasthan 302004, India

Please mark a complaint "Privacy grievance". We acknowledge every grievance and aim to resolve it within 30 days. If you are not satisfied with our response you may approach the Data Protection Board of India.