Privacy policy

1. Information we collect

KaryaFlow collects the following categories of personal data from field technicians and service center administrators who use our platform:

a. Precise GPS location

When a technician checks in for attendance, KaryaFlow activates a foreground location service that records GPS coordinates approximately every 5 seconds. Location data is batched and transmitted to our servers every 60 seconds. Tracking stops automatically when the technician checks out. This feature is employer-initiated and operates only during declared work hours. GPS coordinates are stored alongside attendance records and are subject to a configurable retention period set by the employing service center.

b. Photos

We collect selfie photographs for attendance verification and job-site photographs as part of work order documentation. Photos are uploaded directly to cloud object storage (Amazon S3-compatible) using time-limited presigned URLs and are linked to the relevant work record.

c. Personal identification information

We collect name and email address for account authentication and identification. Technician accounts are created by the employing service center administrator — technicians do not self-register.

d. Device information

We may collect device manufacturer and model information to provide OEM-specific guidance for battery optimization settings that are required for reliable background location operation.

e. Attendance records

Check-in and check-out timestamps are recorded along with the GPS coordinates at each event.

f. Expense data

Technicians may submit expense claims through the app. Submitted expense records, including amounts, categories, and supporting attachments, are stored and visible to authorized managers within the same service center.

g. Billing and invoice data

We collect subscription plan details, invoice records, GST-related billing information, payment status, payment reference IDs, and partner or tenant billing contacts where required to confirm prepaid subscriptions, issue invoices, support renewals, and resolve payment disputes.

h. Usage, device, and diagnostic data

KaryaFlow uses Google Firebase Crashlytics to automatically collect crash reports and diagnostic data when the app encounters an error. This data includes stack traces, device model, operating system version, and anonymized installation identifiers. It does not include your name, email, GPS coordinates, photos, or any other content you enter into the app. Crash data is retained by Google per its Firebase data privacy policy. This data is used solely to identify and fix app stability issues.

i. Map service data

KaryaFlow uses Google Maps Platform to show maps, suggest addresses while you type, and turn addresses into map pins and map pins into addresses. GPS trails and the travel distance on tracking reports are worked out on our own routing engine, not by Google. Directions and road distances between points, such as finding the nearest technician, use Google and send it the map points involved. When maps are displayed, Google may collect usage data such as IP address and approximate location in accordance with the Google Maps Platform Terms of Service and Google’s privacy policy. We send Google the address or map points it needs, and never attendance records. Addresses are sent as typed, so a name or phone number typed into an address line reaches Google too.

j. WhatsApp messages to a service center’s customers

A service center can connect its own WhatsApp Business account to KaryaFlow through Meta’s WhatsApp Business Platform. KaryaFlow then sends messages the service center has switched on, such as invoices, service reports and job updates, from that service center’s own WhatsApp number to its customers. For this feature we store:

• The service center’s WhatsApp Business account ID, phone number ID, business name and WhatsApp number.
• The access key Meta issues so that KaryaFlow can send messages for that service center. We store it encrypted.
• The message wording the service center writes, and Meta’s approval decision for it.
• For each message: the customer’s phone number, the words and any document sent, and the delivery status Meta reports (sent, delivered, read or failed).
• Whether the customer agreed to receive WhatsApp messages, who recorded it and when, and any request to stop messages.

We receive these details from the service center, and the delivery statuses, approval decisions and stop requests from Meta. The service center decides which customers receive which messages, and we process its customers’ data on its behalf. We use data received from Meta only to run this feature for the service center that connected the account.

2. How we use your information

We use the data we collect for the following purposes:

• Providing and operating the KaryaFlow field service management platform.
• Enabling attendance tracking, including GPS-based verification of check-in and check-out locations.
• Supporting work order management, including job assignment, progress tracking, and completion documentation.
• Processing and displaying employee expense claims to authorized managers.
• Authenticating users and maintaining session security via JWT tokens.
• Delivering OEM-specific device optimization guidance to ensure reliable app performance.
• Generating operational reports and analytics for service center administrators.
• Managing prepaid subscriptions, billing, GST invoices, payment status, and renewal or refund support.
• Sending a service center's WhatsApp messages to its customers, showing the service center which messages were delivered, and stopping messages to any customer who asks.
• Complying with applicable legal obligations.

We do not use personal data for advertising, profiling unrelated to the services described above, or any automated decision-making that produces legal or similarly significant effects on individuals.

3. Data sharing and disclosure

KaryaFlow operates a multi-tenant architecture. Each service center (tenant) has its data isolated using PostgreSQL Row-Level Security. Data belonging to one tenant is not accessible to another tenant.

We share data in the following circumstances:

• Within your service center: Managers and administrators at the employing service center can view attendance records, GPS trails, job records, photos, and expense submissions for technicians in their organization.
• Partners: If your service center subscribes through a KaryaFlow partner, that partner administrator has access to aggregated and operational data for the tenants they manage.
• Cloud infrastructure providers: Data is stored on cloud servers and object storage services. These providers process data only as necessary to deliver infrastructure services and are bound by appropriate data processing agreements.
• Payment gateways and billing providers: When customers make payments or request billing support, we may share the minimum required billing, payment, invoice, and contact information with payment gateways, banks, tax advisors, partners, or billing service providers to process transactions, verify payment status, issue invoices, and handle refunds or disputes.
• Meta (WhatsApp Business Platform): When a service center has connected its WhatsApp Business account, we send Meta each customer’s phone number and the message for that customer so that Meta can deliver it. Meta processes this data for the service center as its data processor, keeps message content for at most 30 days, and states that it does not automatically use these messages to choose the ads a person sees. See Meta’s WhatsApp Business Platform data privacy page. We never share one service center’s WhatsApp data with another service center.
• Legal requirements: We may disclose data when required to do so by applicable law, court order, or governmental authority.

When a service center connects a Telegram group, or an office user connects their own Telegram chat, KaryaFlow sends office alerts there through Telegram, including names and amounts, and those chats are not end-to-end encrypted.

We do not sell personal data to third parties. Every outside company we use, what it does for us and what it receives is listed on Who we share data with.

4. Data storage and security

• Encryption in transit: All data transmitted between the mobile app and our servers uses HTTPS/TLS encryption.
• Authentication: User sessions are secured with JSON Web Tokens (JWT) stored securely on-device using platform-provided secure storage.
• Data isolation: Row-Level Security in our PostgreSQL database ensures strict isolation between service center accounts.
• Default retention periods: Unless a service center configures a different retention policy, GPS location records are retained for 90 days, photos (both selfie attendance photos and job-site photos) are retained for 12 months, attendance records and expense records are retained for the duration of the tenant’s subscription. All data is deleted within 30 days of tenant account closure, except where a longer retention period is required by law.
• WhatsApp data: WhatsApp access keys are stored encrypted. When a service center disconnects WhatsApp, we stop sending and delete its access key. Message records and consent records are kept for the duration of the tenant’s subscription, unless the service center or the customer asks us to delete them sooner. See Data deletion instructions.
• Photo storage: Photos and other files are stored in cloud object storage. Job photos, voice notes and logos open through long, random links. Private documents such as invoices, payslips and identity documents are not public: our apps open them through short-lived signed links. A document you share from KaryaFlow opens for anyone with its link until you turn the link off.
• Storage location and cross-border transfers: KaryaFlow’s primary application servers are hosted in the European Union, and our file storage is not fixed to one country. This means your personal data, including GPS coordinates and photos, may be processed and stored outside India. In accordance with Section 16 of the Digital Personal Data Protection Act 2023, we will only transfer personal data to jurisdictions that are not restricted by notification of the Central Government, and we rely on our infrastructure providers’ contractual commitments and industry-standard security controls to ensure an equivalent level of protection.
• Breach notification: In the event of a personal data breach that is likely to result in harm to affected individuals, we will notify the Data Protection Board of India and the affected data principals without undue delay and in any case in accordance with the timelines prescribed under the DPDP Act 2023 and its rules. We maintain an internal incident response process to detect, contain, and communicate such incidents.

While we take reasonable technical and organizational measures to protect your data, no system is completely immune to risk. We encourage service center administrators to use strong credentials and report any suspected security concerns promptly.

5. Cookies, tracking technologies & website analytics

This section applies to our public marketing website at karyaflow.in, as distinct from the KaryaFlow mobile app and web dashboard covered above. To understand how visitors discover and use our website — which pages they read, where they encounter difficulty, and how we can improve our content — we use cookies and third-party analytics and product-experience tools. These tools do not collect the operational data (GPS coordinates, photos, attendance) described elsewhere in this policy, and we do not use them for advertising.

a. Microsoft Clarity

We use Microsoft Clarity to capture aggregated session replays, heatmaps, and interaction metrics (such as clicks, scrolls, and frustration signals like rage clicks) on our website. Clarity sets first-party cookies (_clck, _clsk) and may set third-party cookies (CLID, ANONCHK, MUID, MR, SM) to distinguish visitors and combine page views into a single session. Clarity masks text entered into form fields by default. Data collected by Clarity is stored by Microsoft in the Microsoft Azure cloud, which may be located outside India, and your IP address may be used to derive an approximate geographic location. Microsoft acts as an independent data controller for this data; deletion is performed at the whole-project level rather than per individual visitor. For details, see the Microsoft Privacy Statement and the Microsoft Clarity Terms of Use.

b. PostHog

We use PostHog for website analytics, including page-level usage metrics and events, to understand how visitors move through our marketing pages and where content or usability can be improved. Session recording in PostHog is turned off. PostHog stores this data in the United States. PostHog uses cookies and/or browser local storage to recognize returning visitors via a randomly generated identifier and processes this data on our behalf as our processor. For details, see the PostHog privacy policy.

c. Google Analytics

We use Google Analytics to understand how visitors find our public website and which pages they use. Google Analytics uses cookies and collects usage information such as page views, referral sources and browser or device details. Google signals and advertising personalization are disabled in our website tag. We do not load this tag when your browser sends Do Not Track or Global Privacy Control. For more information, see Google’s privacy policy and the Google Analytics opt-out browser add-on.

d. YouTube

Our video pages play product videos through embedded YouTube players. When a video page opens, the player loads from YouTube (Google), which receives your IP address and browser details and may set its own cookies, under Google’s privacy policy.

e. Call back requests and Cloudflare Turnstile

When you ask us to call you back about a demo, we keep your mobile number, and your name and type of business if you give them, with the page you sent it from and any campaign tags in the link. We use them only to call you about the demo. We store the request with Cloudflare and copy it to the sheet our sales team works from, and we delete it from our website’s store after one year. The form uses Cloudflare Turnstile to check that a person, not a program, sent it. Turnstile reads browser and device signals for this check, under the Cloudflare Turnstile privacy addendum.

f. Your choices

These website analytics cookies are non-essential. By continuing to use our website you consent to their use; you can withdraw that consent at any time by declining or clearing cookies in your browser settings or by enabling your browser’s “Do Not Track” or global privacy control. Blocking these cookies does not affect your ability to use the website or the KaryaFlow product.

6. Your rights

Under India's Digital Personal Data Protection (DPDP) Act 2023 and applicable data protection principles, you have the following rights with respect to your personal data:

• Right to access: You may request confirmation of whether we hold your personal data and obtain a summary of what we hold.
• Right to correction: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to any overriding legal obligations.
• Right to grievance redressal: You have the right to raise a grievance regarding the processing of your personal data and receive a timely response.

Because technician accounts are created and managed by your employer (the service center), some requests — particularly for account deletion — should first be directed to your employer. We will cooperate with such requests in accordance with our obligations under the DPDP Act 2023.

If a service center messaged you on WhatsApp through KaryaFlow, you can stop those messages and ask us to delete your WhatsApp data. Our Data deletion instructions explain how.

To exercise any of the above rights, contact us at ritik@humanreasoninglabs.com.

7. Children's privacy

KaryaFlow is a business-to-business platform intended solely for use by adults employed at service centers. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor's data has been inadvertently collected, please contact us immediately so we can take corrective action.

8. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or product features. When we make material changes, we will update the effective date at the top of this page. Continued use of KaryaFlow after any such update constitutes your acknowledgment of the revised policy. We encourage you to review this page periodically.

9. Contact us and grievance officer

KaryaFlow is operated by Human Reasoning Labs Private Limited, the data fiduciary under the DPDP Act 2023. If you have any questions, concerns, or requests regarding this Privacy Policy, the handling of your personal data, or wish to exercise any of your rights under applicable law, please reach out to our designated Grievance Officer:

Grievance Officer — Human Reasoning Labs Private Limited

Name

Tulsi Prasad

Grievance email

ritik@humanreasoninglabs.com

CIN

U63990OD2026PTC052715

Location

Bhubaneswar, India

Response time

Within 30 days of receipt, as required under the DPDP Act 2023.

If you remain dissatisfied with our response to your grievance, you have the right to register a complaint with the Data Protection Board of India established under the Digital Personal Data Protection Act 2023.