Privacy Policy
Mobile Application

About This Policy & Scope

This Privacy Policy ("Mobile Privacy Policy") applies specifically to the Servyn AI mobile application ("App"), available for download on the Google Play Store (Android) and Apple App Store (iOS). It governs how Servyn AI collects, uses, stores, shares, and protects personal data through the App.

This Mobile Privacy Policy supplements our Web Application Privacy Policy and should be read alongside it. Where this policy and the Web Privacy Policy overlap or conflict on mobile-specific matters, this Mobile Privacy Policy takes precedence.

This policy applies to:

• Field technicians using the App to receive, update, and close job assignments
• Managers and supervisors using the App to monitor operations on the go
• Company administrators accessing their organisation's ERP data via mobile
• Any individual accessing the App under an employer's Servyn AI subscription

By downloading, installing, or using the App, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree, please uninstall the App and contact your company administrator.

This policy complies with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act)
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)
• The Information Technology Act, 2000 (IT Act)
• Google Play Developer Policy and Apple App Store Review Guidelines

Who We Are — Data Fiduciary

Under the DPDP Act 2023, Servyn AI is the Data Fiduciary — the entity that determines the purpose and means of processing your personal data. Our details are:

Your employer (the company that has subscribed to Servyn AI) is also a Data Fiduciary in respect of data they enter about you into the platform. For employment-related data, your employer's own privacy policies may also apply.

Definitions

Personal Data We Collect

The App collects the following categories of personal data:

A. Data You Provide Directly

B. Data Collected Automatically

Sensitive Personal Data (SPDI)

Under the Information Technology (SPDI) Rules 2011, certain categories of data are classified as Sensitive Personal Data or Information (SPDI) and require additional protection.

The Servyn AI mobile app does not intentionally collect the following SPDI categories:

• Financial information (bank account, credit/debit card details, payment passwords)
• Physical, physiological, or mental health data
• Sexual orientation
• Medical records or history
• Biometric data (fingerprints, face recognition)

The only SPDI we process is your password, which is:

• Hashed using bcrypt with a cost factor of 12 before storage — never stored in plain text
• Never transmitted in readable form
• Never logged in any system
• Changeable by you at any time through your account settings

If the nature of the App's features changes in the future such that SPDI is collected, this policy will be updated and explicit consent obtained before such collection begins.

Device Permissions — Full Legal Basis

We follow a minimum permissions principle — we request only what is strictly necessary for specific features. Every permission has a documented lawful basis.

Permissions We Explicitly Do NOT Request

• ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION (GPS / location)
• READ_CONTACTS (address book)
• READ_CALL_LOG or READ_SMS
• RECORD_AUDIO (microphone)
• READ_CALENDAR or WRITE_CALENDAR
• BLUETOOTH or BLUETOOTH_SCAN
• USE_BIOMETRIC or USE_FINGERPRINT
• PROCESS_OUTGOING_CALLS

How to Revoke Permissions

• Android: Settings → Apps → Servyn AI → Permissions → Toggle off any permission
• iOS: Settings → Servyn AI → Toggle off any permission

Revoking a permission disables the related feature but does not delete any data already submitted. It does not affect your account.

Push Notifications

With your explicit permission, the App sends push notifications for the following purposes only:

• New job assignment alerts from your company admin or manager
• Job status changes (approved, in-progress, completed, rejected)
• Invoice and payment confirmations related to jobs you are assigned to
• Company-wide announcements from your administrator
• System alerts (scheduled maintenance, downtime warnings)
• Account security alerts (new login detected, password changed)

We do not send marketing, promotional, or advertising push notifications.

Push notifications are delivered via:

• Android: Firebase Cloud Messaging (FCM) by Google
• iOS: Apple Push Notification service (APNs) by Apple

Google (FCM) and Apple (APNs) receive only the minimum data required to route the notification to your device — specifically, a device token. They do not receive the notification content, your name, or any personally identifiable information beyond the token.

The push token stored by us is linked to your user account and company. It is deleted or invalidated when you log out, uninstall the App, or revoke notification permissions.

Managing Notifications

• Android: Settings → Apps → Servyn AI → Notifications → Enable/disable categories
• iOS: Settings → Notifications → Servyn AI → Toggle on/off

Offline & Local Device Storage

To provide a fast and reliable experience — including partial functionality when internet connectivity is unavailable — the App temporarily stores certain data locally on your device:

All locally stored data is:

• Encrypted using the device's built-in hardware-backed secure storage (Android Keystore / iOS Secure Enclave) where available
• Accessible only to the Servyn AI App — other apps on your device cannot read it
• Automatically cleared on logout
• Automatically cleared on App uninstall
• Never synced to your iCloud, Google Drive, or any personal cloud backup service
• Never shared with any third party

Crash Reporting & Diagnostics

When the App crashes or encounters an error, we may collect anonymous diagnostic data to help us identify and fix the problem. This may include:

• Stack trace (the sequence of code that led to the crash)
• Device model and OS version at the time of crash
• App version number
• Error code and message
• Time of occurrence

Crash reports are anonymous — they do not include your name, email, job data, company name, or any personally identifiable information. They are used solely for the purpose of diagnosing and fixing software defects.

We do not use any third-party crash analytics SDK (such as Firebase Crashlytics, Sentry, or Bugsnag). Crash data is collected internally through our own error handling infrastructure.

How We Collect Data

• Directly from you: When you log in, update job cards, upload photos, or contact support through the App.
• From your employer: Your company administrator creates your employee account, assigns your role, and enters your professional information (name, designation, department) into the platform on your behalf.
• Automatically: Device information, usage data, and push tokens are collected automatically when you install and use the App.
• From your device OS: When you grant permissions, the OS provides the relevant data (e.g., camera feed, photo library access) in response to a specific action you take.

Lawful Basis for Processing

Under the DPDP Act 2023 and SPDI Rules 2011, every act of processing personal data must have a lawful basis. The following table sets out our lawful basis for each processing activity:

Consent — Collection, Use & Withdrawal

How We Obtain Consent

• On first use of the App after account creation, you are presented with our Privacy Policy and Terms of Service and required to accept before proceeding.
• For device permissions (camera, photos, notifications), the operating system's native permission prompt is shown at the point the relevant feature is first used. We do not pre-request permissions on App install.
• Your acceptance is recorded with a timestamp and the version of the policy accepted.

What Happens if You Don't Consent

• Declining optional permissions (camera, photos, notifications) will disable those specific features but will not prevent you from using core App functionality.
• You cannot use the App without accepting the Terms of Service and Privacy Policy, as these govern the contractual relationship that underlies service access.

How to Withdraw Consent

• Device permissions: Revoke at any time through your device's app settings (see Section 6).
• Push notifications: Disable through device notification settings at any time.
• Account-level consent: Contact founder@servynai.in to request deletion of your personal data. Note that if your account is managed by your employer, your employer's instruction will also be required.

Purpose Limitation

Under the DPDP Act 2023, personal data must be used only for the specific, stated purpose for which it was collected. We commit to the following:

• Data collected for job management will not be used for marketing or profiling.
• Push notification tokens will not be used to send unsolicited commercial messages.
• Photos uploaded for job documentation will not be used for any purpose other than storing them against that job record.
• Device identifiers collected for security purposes will not be used for advertising targeting.
• If we wish to use your data for a new purpose not covered by this policy, we will seek fresh consent before doing so.

Data Processors & Third Parties

We share data with the following Data Processors — entities that process data on our behalf under our instructions. We do not sell, rent, or share your personal data with any party for their own commercial use.

All Data Processors are contractually bound to:

• Process data only on our documented instructions
• Implement appropriate technical and organisational security measures
• Not sub-process data without our prior consent
• Delete or return data upon termination of the processing relationship

We do not share data with advertising networks, data brokers, analytics companies (beyond those listed), or any government authority except where legally required.

App Store Platforms

The Servyn AI App is distributed through the Google Play Store and the Apple App Store. These platforms operate independently and have their own privacy practices:

Google Play Store (Android)

• Google collects data about app downloads, installs, crashes, and ratings as part of the Play Store.
• Google may use aggregated, anonymised data from our app listing for its own analytics and service improvements.
• We receive aggregated, anonymised statistics through the Google Play Console (installs, crashes, ratings) — we do not receive individual user data from Google.
• For Android 13+, we request the POST_NOTIFICATIONS runtime permission before sending any push notification.
• Refer to Google's Privacy Policy for how Google handles Play Store data.

Apple App Store (iOS)

• Apple collects data about app downloads, installs, crashes, and ratings through the App Store.
• We receive aggregated, anonymised analytics through App Store Connect — we do not receive individual user data from Apple.
• We comply with Apple's App Privacy "nutrition label" requirements — our declared data use is consistent with this policy.
• We do not use Apple's advertising attribution framework (SKAdNetwork) for advertising purposes.
• Refer to Apple's Privacy Policy for how Apple handles App Store data.

Cross-Border Data Transfers

Our primary data storage is located in India (AWS ap-south-1, Mumbai). However, some of our Data Processors operate infrastructure outside India:

• Vercel: Our API servers are hosted on Vercel's global infrastructure. API requests may pass through Vercel's edge network nodes outside India during transit. However, no personal data is permanently stored outside India in connection with Vercel's services — data is only in transit.
• Cloudinary: Media files (job photos) may be cached on Cloudinary's global CDN nodes for performance. Cloudinary's primary storage is governed by our configuration settings.
• Google FCM / Apple APNs: Push notification tokens and payloads are routed through Google's and Apple's global infrastructure for delivery. This is inherent to how push notifications work on Android and iOS globally.

Where data is transferred outside India, we ensure:

• Transfers are protected by contractual safeguards (Data Processing Agreements)
• Processors receiving data are bound by privacy obligations equivalent to Indian law requirements
• Transfers are limited to what is strictly necessary to provide the service

As the DPDP Act 2023 cross-border transfer framework is notified by the Government of India, we will update our practices to comply with any additional requirements introduced.

Data Storage & Security

We implement a layered security architecture to protect your personal data:

In Transit

• All communication between the App and our servers uses TLS 1.2 or higher (HTTPS) — data cannot be read in transit
• Certificate pinning is implemented to prevent man-in-the-middle attacks
• API authentication uses signed JWT (JSON Web Tokens) with HS256 algorithm

At Rest (Server)

• Database encryption at rest provided by Supabase on AWS ap-south-1
• Passwords hashed using bcrypt (cost factor 12) — never stored in plain text
• Role-based access control (RBAC) — users access only data relevant to their role
• Multi-tenant isolation — each company's data is logically separated at the database level

On Device

• Authentication tokens stored in Android Keystore / iOS Keychain (hardware-backed encryption where available)
• No personal data written to unprotected device storage
• App data is excluded from device backup (Android Auto Backup exclusion rules applied)

Organisational Measures

• Access to production data is restricted to Servyn AI's founding team
• No customer data is accessed for sales, marketing, or product demos without explicit written consent
• Regular security reviews of third-party dependencies

Security Incident & Breach Notification

In the event of a personal data breach that is likely to result in risk to the rights and freedoms of affected individuals, we will:

• Contain and investigate the breach immediately upon discovery
• Notify affected company administrators and users within 72 hours of becoming aware of the breach, where feasible
• Report the breach to the Data Protection Board of India (once constituted) as required under the DPDP Act 2023
• Report to CERT-In (Indian Computer Emergency Response Team) as required under IT Act regulations
• Provide information on: the nature of the breach, data affected, likely consequences, and measures taken or proposed
• Take remedial action to prevent recurrence

If you suspect a security breach involving your account, contact us immediately at founder@servynai.in with the subject line "Security Incident Report".

Data Retention

After the applicable retention period, data is permanently deleted from our active database and will be excluded from all subsequent backups. Deletion is irreversible.

Certain data may be retained for longer periods where required by Indian law (e.g., financial records under the Companies Act or GST Act). We will inform you of any such retention where legally permitted.

Your Rights as a Data Principal

Under the Digital Personal Data Protection Act 2023, you have the following rights in respect of your personal data:

We will respond to all data rights requests within 30 days of receipt. In complex cases, we may extend this to 60 days with prior notification.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act 2023.

Children's Privacy

The Servyn AI App is a professional business software tool intended exclusively for use by adults in an employment capacity. It is not directed at, designed for, or intended to be used by individuals under the age of 18.

Under the DPDP Act 2023, children are defined as individuals below 18 years of age. We do not knowingly process personal data of children. The App is listed on app stores with a business/professional category rating and is not available to child-directed accounts.

If we become aware that we have inadvertently collected personal data of a minor, we will:

• Delete such data immediately from all our systems
• Disable the associated account
• Notify the company administrator

If you are a parent or guardian and believe your child has accessed this App, please contact us immediately at founder@servynai.in.

Company administrators are responsible for ensuring that user accounts are created only for adult employees. Creating an account for a minor on this platform violates our Terms of Service.

Third-Party Links & Services

The App may display or link to third-party content or services in limited contexts, such as:

• Links to Google Maps or navigation apps when viewing a job site address
• Links to file sharing services if your company administrator shares external documents

When you follow such links or interact with third-party services, you leave the Servyn AI App environment. Servyn AI has no control over and assumes no responsibility for the privacy practices, content, or data collection of any third-party services.

We strongly recommend reviewing the privacy policies of any third-party service before interacting with it. The presence of a link in our App does not constitute our endorsement of that service's privacy practices.

Employees Using the App

If you are using the Servyn AI App as an employee of a company that has subscribed to the platform, the following additional considerations apply:

• Your employer (the company that subscribed to Servyn AI) is a joint Data Fiduciary in respect of the employment-related data they enter about you into the platform.
• Your employer can view all data you enter into the App in the course of your work, including job updates, photos, attendance records, and notes. This is inherent to the ERP nature of the platform.
• Your employer's company policies on data use may also apply to your use of this App. Refer to your employer for details.
• Your employer is responsible for informing you of your privacy rights in connection with the platform and for obtaining any consent required under applicable employment law.
• If you have concerns about how your employer is using data about you within the platform, contact your HR department or company administrator first.
• For concerns about how Servyn AI as a company handles your data, contact our Grievance Officer (see Section 26).

Governing Law & Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of India, including but not limited to:

• The Digital Personal Data Protection Act, 2023
• The Information Technology Act, 2000
• The Information Technology (SPDI) Rules, 2011
• Any rules, regulations, and guidelines issued thereunder

Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Mumbai, Maharashtra, India.

Before initiating legal proceedings, you agree to first attempt resolution by contacting our Grievance Officer and allowing 30 days for resolution.

Changes to This Policy

We may update this Mobile Privacy Policy from time to time to reflect changes in our practices, the App's features, or applicable law. When we make changes:

• The "Last Updated" date at the top of this page will be updated
• For material changes (changes that significantly affect your rights or how we use your data), we will:
  • Send an email notification to your registered address
  • Display a prominent in-app notification on your next login
  • Where required by law, seek fresh consent before the change takes effect
• For minor changes (corrections, clarifications, non-material updates), we will update the policy without individual notification

The latest version of this policy is always available at servynai.in/privacy-mobile and within the App under Settings > Legal.

Continued use of the App after the effective date of an updated policy constitutes your acceptance of the changes. If you do not agree with any changes, you must stop using the App and contact your company administrator.

Grievance Officer

As required under the Digital Personal Data Protection Act 2023 and the Information Technology (SPDI) Rules 2011, Servyn AI has appointed a Grievance Officer to address privacy-related complaints and data rights requests.

When submitting a grievance, please include:

• Your full name and registered email address
• Your company name (if accessing via employer account)
• A clear description of your grievance or data rights request
• Any relevant dates, screenshots, or supporting information

If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate your complaint to the Data Protection Board of India once constituted under the DPDP Act 2023.

Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data: