Data Security & Privacy

1. Data We Process

TeamTrail processes the following categories of data to deliver its field force management services:

• Account Data: Name, email address, phone number, company name, and login credentials of managers and administrators.
• Employee Profile Data: Name, employee ID, designation, and reporting manager details of field staff.
• Location Data (GPS): Latitude, longitude, accuracy radius, and timestamps — collected only during configured working hours.
• Attendance Data: Check-in/check-out times, selfie photos for verification, and duty status.
• Visit & Task Data: Client location, visit notes, check-in/out times, task completion status, and work photos.
• Expense Data: Amounts, categories, bill photos, and GPS-tagged timestamps.
• Device & Usage Data: Device model, OS version, app version, and usage logs for troubleshooting and security.

2. Why We Collect Data

We collect data for specific, legitimate business purposes:

• Service Delivery: To provide the core features of TeamTrail (attendance, tracking, reporting).
• Attendance Verification: To confirm field employees were at claimed locations during work hours.
• Operational Reporting: To generate attendance, visit, and expense reports for employers.
• Customer Support: To troubleshoot issues and respond to queries.
• Security & Fraud Prevention: To detect unauthorised access and prevent misuse.
• Legal Compliance: To meet applicable Indian legal and regulatory requirements.

We do not sell your data or use it for advertising purposes.

3. Access Controls

We enforce strict role-based access controls to ensure data is only visible to authorised individuals:

• Role-Based Access: Managers can only see data of their direct reports. Administrators have broader access based on company configuration.
• Employee Self-Access: Field employees can view their own attendance history, visit logs, and expense records — the same as their manager.
• Multi-Factor Authentication (MFA): Available for administrative access to enhance account security.
• Audit Logs: System activities are logged to track who accessed what and when.
• No Third-Party Access: We do not grant access to your data to any third party for marketing or unrelated purposes.

4. Working-Hours Location Policy

We understand that continuous location tracking can feel intrusive. That is why TeamTrail enforces a strict working-hours-only location policy:

• Location tracking is automatically disabled outside the configured shift hours set by the employer.
• Tracking starts when an employee checks in for duty and stops when they check out.
• Employees can see exactly when their location was tracked.
• Employers can configure tracking windows to match their business needs.

This policy ensures that employee privacy is respected outside of work hours.

5. Data Retention

We retain data only as long as necessary for the purposes described above:

• Account Data: Retained during the subscription period and deleted 3 months after termination.
• Location & Visit Data: Default retention is 12 months, configurable per customer agreement.
• Attendance & Selfie Records: 12 months unless the employer specifies otherwise.
• Expense Data: 12 months unless required longer for tax or legal purposes.
• Invoice & Billing Data: 8 years (as required by Indian tax law).

After the retention period, data is securely deleted or anonymised.

6. Hosting & Encryption

We take the security of your data seriously and implement the following measures:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2+ (HTTPS).
• Encryption at Rest: Data stored on our servers is encrypted using industry-standard AES-256 encryption.
• Hosting: Our infrastructure is hosted on reputable cloud providers with ISO 27001 and SOC 2 certifications.
• Backups: Regular encrypted backups are maintained to prevent data loss.
• Monitoring: Continuous monitoring for security threats and unauthorised access attempts.

Note: These claims are based on our current infrastructure. We verify and update them regularly.

7. Your Privacy Rights

Under India's Digital Personal Data Protection Act (DPDP Act) 2023, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure of your data (subject to legal retention requirements)
• Withdraw consent for marketing communications
• File a grievance with our Grievance Officer

To exercise these rights, please contact us using the details below.

8. Contact for Privacy Queries

For any questions, concerns, or requests regarding data security and privacy, please contact our Grievance Officer: