Privacy Policy

1. Who is responsible for your data

Vasgi Staff is sold to businesses ("employers"). An employer installs the app on its employees' phones, with the employees' knowledge, and views the results on the Vasgi Staff dashboard.

• For employees' data, your employer is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). Your employer decides why and how your data is used, for example which working hours are set, when they change, and who in the business may use the dashboard. Your employer is responsible for having a lawful basis for this, such as your consent or another use the law permits, and for telling you about it.
• Aalaap Jewellers is a Data Processor for that data. We store and process it only on your employer's behalf and on its instructions, to provide Vasgi Staff to your employer. We do not use it for any purpose of our own.
• For business owners' own account data (section 5), and for messages sent to us, Aalaap Jewellers is the Data Fiduciary.

Each employer is responsible for using Vasgi Staff lawfully and fairly. If you work for a business that uses Vasgi Staff, your employer should be your first contact about how your data is used. You can also contact us.

2. What the app collects

The Vasgi Staff Android app collects only the location points, device details and status events described below. Your employer adds a few details of its own in the dashboard.

Location points, from Start work to End work

The app records location points only after you tap Start work, and only until you tap End work or your working hours end. Each location point contains:

• latitude and longitude: where the phone is. The app asks Android for precise location, which is usually accurate to within a few metres;
• accuracy: how precise the reading is, in metres;
• fix time: when the reading was taken;
• battery percent and a charging flag (whether the phone is charging), which help explain gaps such as a flat battery;
• a mock-location flag: whether Android reported that the location came from a mock-location (fake GPS) app.

Our server also notes the time each point arrived, and does the same for the start and stop records described below.

Device and enrolment record

When the app is set up on a phone, our server creates an enrolment record that links the phone to the employee. It contains:

• the device model (for example "SM-A155F"), the Android version and the app version;
• a random device ID, and a secret key that lets the app upload data (our server keeps only a hash of the key, not the key itself);
• when the phone was enrolled, when it last contacted our server during working hours (the employer sees this on the dashboard), and, if it has been removed, when that happened.

The one-time setup code that the employer shows as a QR code is valid for 24 hours, works only once, and is stored only as a hash.

Start and stop records

The app records when you tap Start work, with its time. When sharing stops normally, it records when and why: you tapped End work, your working hours ended, a permission was turned off, or location was switched off or could not be found. If sharing ends in another way, for example because the phone restarts or its battery runs out, the app is updated, the app is closed by Android, by the phone's battery manager or with Force stop, or the phone is removed from the service, no stop is recorded. The app records these only when a sharing session starts or ends. It sends no other status events.

Information your employer enters

Your employer enters your name, your working hours and, if it chooses, your phone number in the dashboard. It can also deactivate you. That removes your phone from the service: the app stops sharing and deletes the readings it has not sent (section 13), and if you are reactivated, your phone needs a new setup code. It enters the names and locations of its branches.

Information worked out from the above

For each day, our server works out your check-in (your first Start work), your check-out (when your last sharing session ended) and your time on shift: the time from each Start work to the recorded stop that ended it, not counting breaks between End work and the next Start work. If a stop was not recorded, for example after a restart, and you tap Start work again, the time in between counts as time on shift, and the dashboard usually shows it as "no signal". If the day's last stop was not recorded, the dashboard may show you as on shift until your working hours end, then shows "Check-out not recorded" and counts that last session only up to the last location received. Our server also works out when you arrived at or left a branch by comparing your location points with the branch locations, and stores these as events. The dashboard shows a period without location points while you were checked in as "no signal". It shows a day without Start work as "Not checked in".

3. What the app never collects

The app has no access to, and never collects:

• contacts, call logs, SMS or chat messages;
• photos, videos, files or anything else stored on the phone;
• sound from the microphone or pictures from the camera;
• browsing history, which apps you use, or what you do in them;
• your location, or any status information, before you tap Start work, after sharing stops, or outside the working hours your employer has set. Outside working hours the app only contacts our server in the few cases section 4 lists.

To scan the setup QR code, the app uses Google's code scanner, which is part of Google Play services. The scanner gives the app only the text of the code. The app itself never has camera permission and never receives an image. Google's scanner may send Google diagnostic and usage information, including an identifier for the device or for this installation of the app (section 9).

The app asks for, or declares, these Android permissions: precise and approximate location, for which "While using the app" is enough (on Android 8 and 9, Android only asks whether to allow location); running a location service in the foreground, which lets sharing continue with the screen off; showing notifications; internet access and network status; and being told when the phone has restarted. It uses the last one only to set its daily reminder again and to show "Tap to start work again". It never starts sharing after a restart. The app does not ask for background location, the permission that Android shows as "Allow all the time". It also declares one internal permission that Android's support library adds. Only the app itself can use that permission, and it gives no access to anything on the phone. The app asks for no access to contacts, messages, call logs, storage, the microphone or the camera.

4. When location is collected

• Only after you tap Start work. The app never starts sharing by itself. It starts only when you tap Start work in the app, and you can do that only during the working hours your employer has set for you in the dashboard. At other times the button shows when your next shift starts. If no working hours are set, the app collects no location.
• Until End work or the end of your working hours. Sharing stops when you tap End work, in the app or on its notification, or when your working hours end, whichever comes first. It also stops if you turn off the app's location permission or switch off location on the phone.
• Your employer sets the hours and can change them. Working hours are a weekly schedule of up to 16 hours a day. Your employer can change them at any time, including adding days or making them longer. The phone picks up changed hours when you open the app, within minutes while you are sharing, and otherwise usually within an hour during working hours. If your employer changes today's hours while you are sharing, sharing follows the new hours once the phone has picked them up: it continues until the new end time, or stops straight away if you are now outside them. You can tap End work at any time. Each change is recorded in the audit log.
• Leave days and holidays. There is no separate setting for leave or public holidays. On a day off, do not tap Start work, and no location is shared. If that day is in your weekly hours, the phone still contacts our server when those hours start and then about once an hour until they end, so your employer can see when it last contacted our server (not where it was). The dashboard shows that day as "Not checked in". During a break you can tap End work, and tap Start work again when you are back.
• A reminder, never an automatic start. When your working hours start, the app may show a reminder, "Tap to start work". The reminder only opens the app. It does not start sharing.
• In the background, including when the app is closed. After you tap Start work, the app keeps collecting location while you use other apps, when the screen is off and when the app is closed. It does this as a location service that runs in the foreground with a notification, so it needs location permission only "While using the app". It does not ask for "Allow all the time".
• With a visible notification. While sharing, the app shows an ongoing notification saying that it is sharing your location, with an End work button. The app does not start sharing unless this notification can be shown. If you swipe the notification away, the app shows it again. If you turn off the app's notifications while it is sharing, it stops at its next check, normally within a couple of minutes (longer if your employer set a long location interval or Android holds the phone idle).
• After a restart. If the phone restarts, or the app is updated, while you are sharing, sharing stops. It does not start again by itself. If your working hours have not ended, the app shows a notification, "Tap to start work again". Sharing starts again only when you tap Start work.
• How often. By default the app records a location about every two minutes while sharing, and up to once a minute while the phone is moving. Your employer can change the interval to anything from 30 seconds to 1 hour. While the phone is moving, the app can record up to twice as often as the interval, for example about every 15 seconds at a 30-second interval. Your employer can also set how far the phone must move, from 0 metres to 1 kilometre, before such an extra reading is kept.
• A second safeguard. Our server discards any location point dated outside your working hours plus a 10-minute margin.
• Saved first, then sent. Points are saved on the phone and sent when there is an internet connection. Each point leaves the upload queue once our server confirms it has been received. Readings that cannot be sent before your working hours end wait on the phone until your next working hours, unless you tap Send now. The app keeps a copy of the points it has sent for about two days, so that it can show you what it sent today (this list has not yet been checked in a released version of the app).
• Contact with our server outside working hours. Outside working hours the app collects no location or status information. In the background, it contacts our server only during your working hours, from 10 minutes before they start to 10 minutes after they end, and for up to 10 minutes after sharing stops, so that the stop record can be sent. Outside those times it contacts our server only when you open the app, to fetch its settings such as your working hours, or when you tap Send now to send readings still waiting on the phone. Each contact tells our server that the phone is on and online. The last-contact time your employer sees on the dashboard counts only contacts during working hours, with the same 10-minute margin. Each contact also shows your phone's IP address, from which a rough area such as the city can be worked out. Our server uses the IP address only briefly, in memory, to limit how many requests one address can make, and does not store it. Our hosting provider also processes it (section 5).

5. What we collect from business owners

For each business that uses Vasgi Staff, we hold the business's name and time zone. For the people the business gives a dashboard account ("business owners"), the dashboard collects:

• email address, used to sign in and to contact you about the service;
• password hash: a one-way scrambled form of your password. We never store the password itself;
• sessions: when you sign in, the dashboard sets one cookie that keeps you signed in. It is needed for the dashboard to work and expires after 12 hours. We store only a hash of it, with its expiry time. We set no other cookies on the dashboard;
• an audit log of views and changes: which business owner viewed location data or made a change, such as adding staff, changing working hours, or enrolling or removing a phone, what it concerned, and when. It also records each sign-in and sign-out, with the IP address used to sign in.

We also keep the messages business owners send us, such as support requests.

For the app and the dashboard alike, our hosting provider, Cloudflare, processes technical details of each request, such as the time, the address requested, the response, the IP address, and an approximate location (such as the city and country) that it works out from the IP address, in order to deliver the service and protect it from attacks. Our server keeps no log of these requests: its request logging is switched off, it records only short error messages without request details, and it uses the IP address only in memory, briefly, to limit how many requests one address can make. The only IP address it stores is the one used to sign in to the dashboard, in the audit log (above). Cloudflare may keep security and traffic records of its own; we are confirming which ones and for how long, and will list them here. None of these records contain the location points the app sends.

6. This website

We set no cookies on this website, and it uses no analytics, advertising, trackers, third-party scripts or third-party fonts. Our hosting provider, Cloudflare, processes your IP address and basic request details in order to deliver the website and protect it from attacks. We keep Cloudflare's features that set cookies switched off for this website. If Cloudflare ever needs to check that a visitor is not an automated attack, it may set a strictly necessary security cookie for that purpose only. If you email us, we use your email address and message to reply to you.

7. How the information is used

Employees' data is used only to provide Vasgi Staff to their employer:

• to show the employer each employee's check-in and check-out times and time on shift, where staff are while they are sharing (and, after sharing stops, the last location recorded, with its time), each day's route, and arrivals at and departures from branches;
• to help explain gaps, for example a flat battery, location switched off, or a phone that has not contacted our server recently;
• to flag readings that may have come from a fake-location app;
• to show employees, in the app, what has been sent today;
• to keep the service working and secure, prevent misuse, and fix problems.

Business owners' data is used to create and secure their accounts, sign them in, keep the audit log, provide support, manage the service, and tell them about changes to the service or to this policy.

We may also use information where the law requires it.

8. What we never do with it

• We do not sell or rent personal data.
• We do not use it for advertising, and we do not share it with advertisers or data brokers.
• The app and the dashboard include no advertising SDKs and no analytics of our own. The only third-party diagnostics in the app are those of Google's code scanner, which it uses to scan the setup QR code (section 9).
• We do not use employees' data for any purpose of our own, and we do not combine it with other data to build profiles.
• Vasgi Staff does not score, rank or rate employees, and the dashboard does not treat "no signal" as absence.
• The app has no hidden mode. It never starts sharing by itself: only your tap on Start work starts it. It never starts collecting without showing its notification, it collects only during the working hours currently set for you in the dashboard, and it does not stop you from uninstalling it.

9. Who can see it and who we share it with

• Your employer. Only the people your employer gives a dashboard account, usually the owner and sometimes a manager, can see your data, and each of them can see all of the business's staff. The app gives you and your co-workers no way to see anyone's location: a phone's credentials can only send data and fetch the app's settings, never read anyone's location data.
• You. The app is designed to list the points it has sent today; this has not yet been checked in a released version of the app. Your employer can also show you your data on the dashboard, or you can ask us.
• Aalaap Jewellers. A small number of our people who run the service can access the systems that store the data, including directly through our hosting provider's tools. We access customer data only when needed to operate, secure or support the service, when the employer asks us to, or when the law requires it. This direct access is not recorded in the dashboard's audit log.
• Cloudflare, Inc. hosts the Vasgi Staff service, its database and this website, and runs cdnjs, from which the dashboard loads its map software.
• Google. On the phone, the app gets location readings from Google Play services, a Google component that comes preinstalled on most Android phones, and scans the setup QR code with Google's code scanner, which is part of it. Depending on the phone's own location settings (such as Google Location Accuracy), Google may receive Wi-Fi and mobile network information to work out the phone's location, under Google's own terms and privacy policy. When the app uses Google's code scanner (part of Google's ML Kit), the scanner may send Google, for diagnostics and usage analytics: an identifier for the device or for this installation of the app; the app's package name and version; the phone's maker, model and Android version; performance and error information; which scanner events happened, such as starting the scanner and detecting a code; and, because the app uses the scanner's automatic zoom, information about the scanning session, such as a session identifier, changes of zoom and where in the picture the code appeared. Google handles this under its own terms. The app itself sends Google none of the location points or events it collects. The app is set up to keep its data out of Android's backup and out of transfer to a new phone, but this has not yet been checked in a released version of the app. Until it has, if the phone's Android backup is on, Android may copy the app's stored data, including readings not yet sent and the app's settings, to the employee's Google account backup, and restore it on a new phone.
• A map provider. The dashboard shows maps from the OpenStreetMap Foundation's tile servers. When a business owner opens a map, their browser downloads map images for the area on screen, so the map provider receives the business owner's IP address and the area being viewed. It does not receive staff names or location records. We will name any replacement map provider here before we switch to it.
• When the law requires it. We may disclose information if we are legally required to, for example by a valid order of a court or government authority. Where we are allowed to, we will tell the employer concerned.

We do not share personal data with anyone else.

10. Where it is stored

Vasgi Staff and this website are hosted on Cloudflare's global network. Cloudflare operates in many countries, so your data may be stored or processed outside India.

11. How we protect it

Vasgi Staff is designed with these safeguards:

• All connections between the app, the dashboard and our servers are encrypted with HTTPS.
• Each business's data is kept separate. Our server works out which business a request belongs to from its own records, never from what the app or browser claims, and limits every database query to that business.
• A phone's credentials can only upload its own data and fetch its settings. They cannot read anything else from the server.
• Device keys, setup codes and session tokens are stored only as SHA-256 hashes. Passwords are stored as PBKDF2-SHA256 hashes with 100,000 iterations and a separate random salt for each user.
• Dashboard sessions expire after 12 hours and use a cookie that scripts cannot read and that is sent only over HTTPS.
• Setup codes work once and expire after 24 hours. Setting up a new phone for an employee removes their old one.
• Views of location data on the dashboard, and every enrolment or removal of a phone, are recorded in the audit log. The live map updates itself every minute, so while someone keeps it open it is recorded once every 15 minutes.

No system is perfectly secure. If we become aware of a breach affecting personal data, we will inform the affected employers without undue delay so that they can inform their staff, and we will inform affected business owners and the authorities where the law requires it.

12. How long we keep it

These are the periods for which we keep each kind of information.

After data is deleted, copies can remain in our hosting provider's recovery backups for up to 30 days before they expire.

Where the law requires us to keep information or logs for longer, for example security logs that must be kept for a minimum period, we keep them for that period and use them only for the purpose the law requires.

13. Deletion

• When an employer removes an employee from Vasgi Staff, we delete that employee's location points, events, working hours and their history, device records and staff record straight away. Audit log entries that mention the employee are kept for the audit log's retention period. For each of the employee's phones, our server keeps only the phone's random ID, a hash of its key and when it was removed, with nothing about the person, so that it can keep refusing that phone and tell the app that it was removed.
• When an employer deactivates an employee, or removes a phone, the phone can no longer send data. Reactivating the employee needs a new setup code for their phone. The employee's existing data on our server stays until the employee is removed.
• What the app does when its phone is removed. After an employee is removed or deactivated, or their phone is removed, the next time the phone contacts our server (within minutes while sharing, usually about once an hour at other times during working hours, and when the app is opened, if the phone is online), the app stops sharing, deletes the readings it had not yet sent, cancels its daily reminder and shows "This phone was removed". Its list of what was already sent stays on the phone, where only its user can see it, for up to about 2 days, and is then deleted.
• When an employer ends the service, we delete all of the business's data, including its employees' data and its owner accounts, within 30 days after it stops using Vasgi Staff. The only exception is audit log entries, which are kept for the audit log's retention period. The business's phones can then no longer send data to us. The app is not told about this in the same way. It keeps its setup and its daily reminder, and if the employee taps Start work it still shows its notification and saves readings on the phone until End work or the end of the working hours it last received, but it cannot send them and nobody sees them. The business should ask its staff to uninstall the app, which deletes them.
• Uninstalling the app deletes the data stored on the phone, including any points not yet sent. A copy may remain in the phone's Google account backup if Android backup is switched on (see section 9). Uninstalling does not delete data already on our server. To ask for that, see Your rights.

14. Your rights

Indian law, including the DPDP Act as its main provisions come into force, gives you rights over your personal data, including the rights below. Some of them apply only where your employer relies on your consent rather than on another basis the law allows. Whatever basis your employer relies on, we will help you and your employer with these requests now.

• access: get a summary of the personal data held about you, how it is processed, and who it has been shared with;
• correction and erasure: have inaccurate or incomplete data corrected, completed or updated, and have data erased when it is no longer needed, unless it must be kept by law;
• grievance redressal: have a complaint about how your data is handled dealt with;
• nomination: nominate another person to exercise your rights if you die or become unable to do so;
• withdraw consent, where the processing is based on your consent, as easily as you gave it (see below);
• complain to the Data Protection Board of India, once the DPDP Act allows it, if you are not satisfied with the response to your grievance.

How to use your rights

If you are an employee, contact your employer first. Your employer is the Data Fiduciary for your data and can see and correct your information in the dashboard. You can also email support@vasgi.net with your name, the business you work for and what you would like. We may need to confirm who you are with your employer. Because your employer controls your data, we will pass your request to your employer and help them respond, and we act on your employer's instructions unless the law requires otherwise.

If you are a business owner, email support@vasgi.net from the email address on your account.

Withdrawing consent

Employees: tell your employer that you withdraw your consent. You can also stop the app collecting at any time by tapping End work, turning off its location permission or uninstalling it. Your employer then decides what happens to the data already collected, for example by removing you from Vasgi Staff, which deletes it.

Business owners: email us from the address on your account to close it. We then delete your account data as section 13 describes.

Grievances

Our Grievance Officer is Akshay Kumar Vasgi, who can be reached at support@vasgi.net or at the address in section 17. We acknowledge each grievance and deal with it within one month of receiving it. If your employer needs to act on it, we tell you, pass it on and follow it up.

We do not charge for these requests.

15. Children

Vasgi Staff is meant for adults at work. It is not intended for anyone under 18, and employers must not install it on the phone of anyone under 18. If you believe it has been, contact us and we will work with the employer to stop collection and delete the data.

16. Changes to this policy

We may update this policy. The date at the top of this page shows when it last changed. Before a significant change takes effect, we will email the business owners who use Vasgi Staff; employers are responsible for telling their staff. If a change means the app would collect a new kind of data, we will update this policy first, and the app will explain the change on screen before it collects that data. Earlier versions of this policy are available on request.

17. Contact us

Privacy questions and requests

support@vasgi.net

Grievance Officer

Akshay Kumar Vasgi, support@vasgi.net

General enquiries

support@vasgi.net

Business

Aalaap Jewellers

If you are an employee, you may find it quicker to ask your employer first. You can also read our plain-language page for employees: Your employer asked you to install Vasgi Staff.