Privacy Policy

1. Who we are and what this covers

SiteMetrics is software for builders and contractors, made and run by TechHive LLP, a limited liability partnership registered under the Limited Liability Partnership Act, 2008, Ahmedabad, Gujarat, India ("TechHive", "we", "us"). This policy explains how personal data is handled:

• on this website, and when you contact us; and
• in the SiteMetrics app that a firm ("your firm" or "the Customer") uses for its staff, sites and vendors.

Each firm's app may carry the firm's own name and logo, for example "Acme Ops". It is still SiteMetrics, and this policy applies to it.

2. Who decides about your data

• In the app, your firm is the Data Fiduciary under the Digital Personal Data Protection Act, 2023: it decides who is added, which features are used, and what its records are for. TechHive is its Data Processor: we host and run the app for your firm, and process the data only on its instructions and to keep the service working and secure.
• On this website, and for our own customer contacts, TechHive is the Data Fiduciary.

Your firm is responsible for having a lawful basis for the personal data it puts in the app, including its vendors' and contractors' contact details, and for telling its staff how the app uses their data. If you are a member of staff using the app, your employer's own policies also apply. For questions about why something is recorded or how your employer uses it, ask your firm's administrator first. We will help your firm answer.

3. This website

• No accounts, forms, cookies or analytics. We don't run tracking scripts or advertising on this website.
• Hosting logs. Our host, Microsoft Azure, receives your IP address, browser details and the pages requested, as any web server does, and may keep them briefly for security and to keep the website running.
• Fonts. The website's fonts are loaded from Google Fonts, so Google receives your IP address and browser details when you load a page. See Google's privacy policy.
• When you contact us. If you email, call or message us, we receive your name, contact details, firm and what you write. We use them to reply, to arrange a demo and to prepare a quotation, and keep them while we are in discussion or you are a customer, and for up to 3 years after, unless you ask us to delete them sooner.

4. Data in the SiteMetrics app

4.1 Your account

• Your name, work email address, phone number (if your firm adds it), role, the sites you are assigned to, and your language choice.
• Sign-in. If you sign in with Google, we receive your verified email address from Google to match it to the account your firm created. We never receive your Google password. If you sign in with an email code, the code is stored only in a scrambled (hashed) form and expires after 10 minutes.

4.2 Work records

• Purchase requests, orders, deliveries, budgets and payments, and who created or changed each one and when.
• Photos and files you add, such as delivery challans, bills and site photos.
• Daily site reports, including labour counts, work done, photos and issues.
• Chat messages and files, notices, and whether you have read them.
• Business contact details of your firm's vendors and labour contractors, such as names, phone numbers, emails, addresses and GSTINs, entered by your firm.

4.3 Attendance and leave

Check-in and check-out times and places, step-outs and their reasons, reasons for leaving early, location checks, and leave requests with their reasons and decisions. See section 5.

4.4 Your device

• Phone notifications. If you turn them on, the address your browser's push service gives for your device, the keys to encrypt messages to it, and which kinds of notification you have muted. It is removed when you sign out, and is never used once your sign-in ends.
• Diagnostics. Page loads, performance and errors in the app, with your device type, operating system, browser, screen size and language, tied to an internal user number and your role, not your name or email. We use these to find and fix problems.
• IP address. Our servers see the IP address of each request and use it to limit repeated sign-in attempts and to detect abuse. It is not used for tracking or advertising.
• Server logs. Our servers log requests and errors to keep the service running. By our own rule these logs do not contain email addresses, phone numbers, sign-in codes, tokens, GSTINs or exact locations.

5. Location and attendance

• Only while the app is open. The app reads your location only while it is open on your screen and you have allowed location access. It does not track you in the background or when the app is closed.
• A notice first. Before your first check-in, the app shows you a notice explaining how location is used.
• Check-in and check-out. When you check in or out, the time, your location and its accuracy are saved with that day's attendance record, so your firm can see you were at the site. These stay as part of your firm's attendance records.
• Readings during the day. While you are checked in, the app records your location when it opens and when it answers a location check, to tell whether you are still on site and which site you are at. These readings are deleted automatically after the period your firm chooses, at most 120 days.
• Who sees it. Your firm's administrators see attendance, who is on site and the day's timeline. Other staff don't see your location.
• Checked on the server. Whether you are inside a site's area is worked out on our server, not just on your phone.

You can turn location off for the app in your phone's settings at any time. Check-in then won't work, and your firm may ask you to explain an absence another way.

6. How the data is used

• To provide the app's features to your firm: requests, orders, deliveries, budgets, payments, attendance, leave, site plans, reports, notices, chat and analytics.
• To sign you in, keep your account secure, and prevent misuse, for example by limiting repeated sign-in attempts.
• To send the emails and notifications described in section 7.
• To back up, support, monitor and fix the service, and to answer your firm's requests.
• To meet legal obligations and enforce our terms.
• To improve the service using anonymised, aggregated statistics that do not identify any firm or person.

We do not sell personal data, use it for advertising, or use one firm's data for another firm. We do not use the data in the app to train AI models.

7. Emails and notifications

• Emails are sent under your firm's name through Microsoft Azure Communication Services, with data kept in India: sign-in codes, notifications about requests, orders, deliveries, leave and payments, daily summaries, and reminders such as the evening check-out reminder.
• Purchase orders are emailed to your firm's vendors only when someone at your firm chooses to send them.
• Phone notifications are sent through your browser's push service (for example Google's for Chrome on Android, or Apple's on iPhone). Their content is encrypted, so the push service can't read it. You can mute most kinds of notification in your profile; attendance reminders stay on.
• We do not send marketing emails to app users.

8. Cookies and browser storage

• This website sets no cookies.
• The app keeps your sign-in, your language and theme, and any half-filled forms in your browser's storage on your device, so you stay signed in and don't lose work. Half-filled forms are cleared when you sign out.
• The app's diagnostics (section 4.4) use two cookies, ai_user and ai_session, from Microsoft Application Insights, to count sessions and connect errors to them. They are not used for advertising.

9. Who it is shared with

Inside your firm, what each person sees depends on the role and sites your firm gives them. These permissions are checked on our server for every request.

Outside your firm, we share personal data only with the service providers we need to run SiteMetrics, and only what they need:

These providers process data on our behalf under their own privacy and security commitments, and are bound by contract to protect it. Some, such as Google and the push services, may process data outside India, subject to the safeguards and restrictions set under Indian law.

We may also disclose data when the law requires it, for example to a court or a government authority with a valid order, or where needed to protect the rights, property or safety of TechHive, our customers, their staff or the public, including to prevent fraud. We will tell your firm unless the law prevents it. If TechHive's business is transferred to a successor, the data would pass to it under the same protections, and we will tell each firm.

10. Where it is stored and how it is protected

• Each firm's app data is stored in its own database and file storage on Microsoft Azure in India, separate from every other firm's.
• Data is encrypted in transit (HTTPS, TLS 1.2 or higher) and at rest.
• The database accepts connections only from the app's server and from our deployment process. Files can be opened only through short-lived links the app creates for signed-in users.
• There are no passwords to leak: sign-in is through Google or a one-time email code. Deactivating a person signs them out on every device.
• Access by TechHive staff is limited to running, supporting and fixing the service, or doing what your firm asks.
• Changes to records are logged with who made them and when, and sign-ins and security events are monitored.

No system is perfectly secure. If a breach affects personal data, we will tell the affected firm without undue delay and help it inform the Data Protection Board of India and the people affected, as the law requires.

11. How long it is kept

When a person leaves, your firm deactivates their account. Their past records stay part of the firm's records. Ask your firm's administrator if you want something about you corrected or removed.

12. Your rights

Under the Digital Personal Data Protection Act, 2023 and its rules, to the extent they are in force, you have the right to:

• get a summary of your personal data being processed and who it has been shared with;
• have inaccurate or incomplete data corrected or completed, and data no longer needed erased;
• withdraw consent where processing is based on consent;
• have a complaint handled through the grievance process below, and then by the Data Protection Board of India;
• nominate someone to exercise your rights if you die or cannot do so.

For data in the app, send your request to your firm, which is the Data Fiduciary. If you write to us instead, we will pass it to your firm and help it respond. For website enquiries and customer contacts, write to us directly. We may need to check your identity before acting on a request.

13. Lawful basis

Your firm decides the lawful basis for the data in its app. Typically that is a legitimate use for the purposes of employment, which the Digital Personal Data Protection Act, 2023 allows (for example, attendance and site records), or your consent. TechHive processes the data only on your firm's behalf, under its agreement with us.

For website visitors and enquiries, TechHive relies on your consent, which you give freely when you contact us and can withdraw at any time, on performing our agreement with your firm, on legal obligations, and on legitimate uses such as keeping the website and service secure.

14. Children

SiteMetrics is for businesses and their staff. It is not meant for anyone under 18, and we do not knowingly process children's personal data. If you believe a child's data has been added, tell the firm or us and it will be removed.

15. Changes to this policy

We may update this policy as the service or the law changes. The date at the top shows the latest version. For material changes we will tell each firm's administrators in advance, so they can tell their staff. Where the law requires fresh consent for a change, we or your firm will ask for it. Otherwise, continuing to use the website or the app after a change means accepting it.

16. Contact and Grievance Officer

Grievance Officer

In line with the Information Technology Act, 2000, its rules, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:

The Grievance Officer will acknowledge a complaint within 24–48 hours and resolve it within 30 days, as the law requires.