Privacy Policy

Last updated: August 2026

1. Introduction

CrewPilot Technologies (“we”, “us”, “our”) is committed to protecting the privacy of contractors and workers who use CrewPilot. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your data. This policy complies with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (India).

2. Data We Collect

Contractor Account Data

  • Mobile phone number (used for authentication via OTP)
  • Name, company/firm name, EPFO code (provided by you in settings)
  • Device information and IP address (for security purposes)

Worker Data (entered by contractor)

  • Name, mobile number, trade/skill, daily wage rate
  • Attendance records (present/absent/half-day per date)
  • Advance payment records
  • UPI ID (optional, for payment reference only)
  • UAN number (optional, for EPFO compliance)
  • Face recognition embedding (encrypted, only if enrolled via mobile app)

Usage Data

  • App usage logs and crash reports (collected via Firebase Crashlytics for debugging and improvement)
  • Payment transaction IDs (not card details — those go directly to Razorpay)
  • Push notification token and device identifier (used to deliver check-in alerts and service notifications)

3. How We Use Your Data

  • Service delivery: To provide attendance tracking, payroll calculation, and compliance report generation.
  • Authentication: To verify your identity via OTP and maintain session security.
  • Payments: To process subscription payments via Razorpay and maintain payment history.
  • Notifications: To send check-in alerts and important service updates via push notification.
  • Support: To respond to your queries and resolve issues.
  • Improvement: To analyse usage patterns and improve the Service (using anonymised data only).

We do not sell your data to third parties. We do not use worker data for any purpose other than providing the Service to you.

4. Biometric Data (Face Recognition)

Face recognition is an optional feature available on the mobile app. If you choose to use it:

  • We store only the mathematical embedding vector derived from the face image — not the photo itself.
  • This embedding is encrypted using AES-256-GCM before being stored on our servers.
  • The encryption key is derived from a PIN you set and is never stored on our servers.
  • You are responsible for obtaining explicit consent from each worker before enrolling them in face recognition.
  • Face data can be deleted at any time by removing the worker from the app or deleting your account.

5. Data Storage and Security

  • All data is stored on Google Firebase (Firestore) infrastructure hosted in the Asia South 1 (Mumbai) region.
  • Data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption by Google Cloud.
  • Access to your data is restricted to your contractor account. Other contractors cannot access your workers' data.
  • We conduct regular security reviews and follow security best practices.
  • In the event of a data breach, we will notify affected users within 72 hours as required by law.

6. Data Sharing

We share data only with:

  • Google Firebase: For data storage, authentication, and cloud functions (Google's privacy policy applies).
  • Razorpay: For payment processing (Razorpay's privacy policy applies). We share only the minimum required information.
  • Law enforcement: When required by a valid court order or applicable law.

7. Data Retention

  • Your data is retained as long as your account is active.
  • If you delete your account, all data (workers, attendance, advances, profile) is permanently deleted within 30 days. See our Account Deletion page for step-by-step instructions.
  • Payment records may be retained for up to 7 years as required by Indian accounting and tax laws.

8. Your Rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Update or correct your data via the app settings.
  • Erasure: Delete your account and all associated data from the app settings, or by following the instructions on our Account Deletion page.
  • Grievance redressal: Lodge a complaint with us or with the Data Protection Board of India.

To exercise these rights, contact us at support@crewpilot.co.in. We will respond within 30 days.

9. Children's Privacy

CrewPilot is not intended for use by persons under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related queries or to exercise your rights:

Email: support@crewpilot.co.in

Website: crewpilot.co.in