1. Who decides about your data

SiteSync is construction-site software operated by SiteSync. The company that subscribes to it — usually your employer or principal contractor (the "Customer") — decides what data is recorded and why. Under the Digital Personal Data Protection Act 2023 that company is the Data Fiduciary and we are its Data Processor. We act for our own purposes only for the account, billing and enquiry details of Customer representatives.

This covers two groups: people with a SiteSync account, and people recorded in it without an account — site workers, contractors, drivers, vendor and subcontractor contacts.

2. What is recorded

• Account details: name, phone and/or email, role, designation, company and project assignment.
• Work records: attendance and clock-in/out times, progress and approvals, material receipts, machinery hours and fuel, safety checks, non-conformance reports, and who made each entry and when.
• People without an account: names, trades and attendance of workers; vehicle numbers and driver details on delivery documents; vendor and subcontractor contacts.
• Photographs, stamped with date, time and a short label. Location is not stamped on them, and location data inside the camera file is removed.
• Location: at clock-out the app checks whether you are inside the site boundary and stores only on-site or off-site, not your coordinates. Coordinates are stored when a user tags where a delivery or stock pile was unloaded, and during an optional material-tracking session.
• We do not collect salary or payroll details, Aadhaar, PAN, passport or any other identity document, or biometrics. No facial recognition is run on any photograph.

3. Why

To run the Customer's projects: record and report work, materials, equipment, manpower and safety; produce the reports the Customer issues; keep the service secure; and keep an audit trail of who did what.

4. Who it is shared with

We do not sell or rent personal data. Inside SiteSync, data is visible only to the people the Customer gives access to — including vendor or designer users the Customer invites. We use these service providers to run SiteSync:

• Supabase — database and file storage, in India (Mumbai).
• Cloudflare — hosting and delivery; storage of fabrication drawings.
• Google Firebase — sign-in (your phone number or email).
• Google Gemini — reading packing lists, meters and drawings, rewording updates, and the in-app assistant. The complete image is sent, and assistant answers about people can include names and working hours. We use Google's free Gemini tier, under whose terms Google may use submitted content to improve its services and human reviewers may read it. We do not train any model of our own on your data.
• Sentry (United States) — error reports, carrying only an internal account id, role and company; no name, email or phone.
• OpenWeather — project site coordinates only.
• Browser push services — for notifications you allow.
• We may also disclose data where the law, a court or a regulator requires it.

5. Data on your device

SiteSync works offline, so it keeps data on your device: entries waiting to upload (with their photographs) for up to 7 days, recently viewed project data for up to 24 hours, and up to 300 site photographs. All of it is cleared when you sign out — so sign out on a shared phone. We keep small preferences in browser storage and, if you allow notifications, a notification address. We use no advertising or tracking cookies.

6. How long, and how it is protected

Data is kept while the Customer subscribes and for the export and deletion periods in its agreement, after which it is deleted, except what the law requires us to keep, routine backups until they expire, and the audit log, which is append-only and cannot be edited.

Access is limited by role and company at the database itself; files are private and reached only through short-lived links; data is encrypted in transit and at rest by our hosting provider; sign-in uses Google or a one-time SMS code, so we store no passwords. No system is perfectly secure; if a breach affects your data, the Customer will inform you, with our help, as the DPDP Rules 2025 require.

7. Your rights and complaints

Under the DPDP Act 2023 you may ask for a summary of your data and who it was shared with, have it corrected, completed or erased when no longer needed, withdraw consent where processing relies on consent, and nominate someone to act for you. If you are a worker, driver or vendor contact, ask the company that recorded you. If you hold an account, ask your administrator first, or write to us and we will pass your request to the right Customer.

Grievance Officer: [email protected]. We acknowledge within 48 hours and resolve within 30 days. If your grievance is not resolved, you may complain to the Data Protection Board of India.

SiteSync is workplace software and is not meant for anyone under 18.