Privacy Policy

This Privacy Policy describes how Garuda Yantra Technologies ("we", "us", "our") collects, uses, and protects information when you use our applications and services — including ServiTrack, Garuda ERP, Garuda Hub, and Garuda Reserve (collectively, "Services"). The Garuda HCM employee mobile app has its own dedicated policy: see the Garuda HCM Privacy Policy (it differs from the below — e.g. it geo-tags attendance, including background location during an active duty or trip).

1. Information we collect

Information you provide:

• Account information: name, email address, phone number
• Business information: company name, address, GST/tax number, UPI ID
• Client data: names, phone numbers, email addresses, locations you enter
• Job and invoice records you create within the app
• Photos you capture using the camera within the app

Information collected automatically:

• Device information: device model, operating system version, unique device identifier
• GPS location: only when you explicitly tap "Save Location" — never in the background
• Voice input: processed by your device's speech recognition engine — we do not record or store audio

2. How we use your information

• To provide and maintain the Services
• To process license activation and validate your subscription
• To sync data between team members (only if you use the Team edition)
• To generate invoices, quotations, and reports as you request
• To send notifications and reminders you configure
• To improve our Services and fix issues

3. Data storage

Local storage: All your business data (clients, jobs, invoices, photos) is stored locally on your device in an encrypted SQLite database. This data stays on your device unless you explicitly choose to back it up.

Backups: When you use the backup feature, your data is saved to your device's Downloads folder or Google Drive (your choice). Backups can be password-encrypted.

Server: Our license server stores only your license key, device identifier (anonymous hash), team membership (if applicable), and sync data (if using Team edition). We do not store your client data, job details, invoices, or photos on our servers unless you use Team sync.

4. Data sharing

We do not sell, rent, or share your personal data with third parties, except:

• Payment processors: When you purchase a license, payment is processed by Razorpay (India) or Google Play Billing (international). We do not store your payment card details.
• Google services: If you use Google Drive backup or Google Sign-In, data is shared with Google per their privacy policy.
• Legal requirements: We may disclose data if required by law or to protect our rights.

5. Permissions we request

• Camera — to take photos of jobs, receipts, and invoices (only when you tap the camera button)
• Contacts — to import client information (only when you tap "Import from Contacts")
• Location — to save client/job GPS coordinates (only when you tap "Save Location")
• Microphone — for voice-to-text input (processed locally by device speech recognition)
• Storage — to save and restore backups from your device
• Biometric — for fingerprint/face lock on app launch (optional)
• Notifications — to deliver job reminders you set

All permissions are optional. The app functions with reduced features if you decline any permission.

6. Data security

• Local data is stored in SQLite with optional AES encryption for backups
• The APK is built with code obfuscation (Flutter obfuscation + R8/ProGuard)
• Server communication uses HTTPS (TLS 1.2+)
• License server uses JWT authentication with optional TOTP two-factor authentication
• Passwords are hashed using bcrypt
• Device binding prevents license sharing

Reporting a vulnerability: if you believe you have found a security issue in any Garuda Yantra service, email [email protected] — see our security.txt for our disclosure policy. We do not pursue legal action against researchers who report in good faith.

7. Data retention

• Your local data remains on your device until you delete it or uninstall the app
• Audit logs are automatically purged after 60 days
• Server-side license records are retained for the duration of your subscription
• Team sync data is retained while your team is active
• You can delete your account and all server-side data by contacting us

8. Children's privacy

Our Services are not intended for children under 13. We do not knowingly collect information from children.

9. Your rights

• Access your data (it's all on your device)
• Export your data via the backup feature
• Delete your data by clearing app data or uninstalling
• Request deletion of server-side data by emailing us
• Opt out of any data collection by disabling permissions

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or our website. Continued use of the Services after changes constitutes acceptance.

11. Contact us

12. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, the contact details of our Grievance Officer are published below. Any complaint about how we collect, use, store, or delete your personal data — or about this policy — can be raised directly with them.