1. Who we are, and what this covers
Zuuvy is a business software platform operated from Bangalore, Karnataka, India. This policy covers our website at zuuvy.in and these four Android applications:
| App | Package name | Who uses it |
|---|---|---|
| Zuuvy HQ | in.zuuvy.main.admin_app | Business owners and office staff |
| Zuuvy Fleet | in.zuuvy.main.salesman | Field salesmen employed by the business |
| Zuuvy Warehouse | in.zuuvy.main.stockman | Warehouse staff employed by the business |
| Zuuvy Partner | in.zuuvy.main.partner_app | Trade customers of the business |
There is one copy of each app on Google Play, and it is the same copy whichever business you work for or buy from. Zuuvy is used by more than one business; which one you belong to is decided by the account you sign in with, not by the app you installed. Your data is held separately from every other business on the platform, and businesses never see each other's records.
Every account is created by the business that subscribes to Zuuvy — for its own staff, or for a shop that buys from it. There is no public registration. If you are using one of these apps, a business gave you the login.
That relationship shapes everything below. The subscribing business decides what data goes into the system and why; we hold and process it on their instructions. Where the law distinguishes a data fiduciary (or controller) from a data processor, the business is normally the first and Zuuvy the second. For our own website and our direct dealings with you, we are the fiduciary.
2. The short version
- We collect what the job needs — who you are, what you sold or bought, what you owe — and not much else.
- We do not sell your data. We do not share it with advertisers, data brokers, or anyone else for their own purposes.
- Location is collected by Zuuvy Fleet only, and only for a salesman on duty. It stops when the shift ends.
- Zuuvy HQ writes contacts to your phone. It never reads them. Your personal address book is not uploaded, indexed or looked at.
- Everything travels over HTTPS, and photographs of staff are never publicly readable.
- You can ask for your account and data to be deleted at any time — here is how.
3. What each app collects
Read the column for the app you use. A blank cell means that app does not collect that kind of data at all.
| Data | HQ | Fleet | Warehouse | Partner |
|---|---|---|---|---|
| Name, mobile number, username | Yes | Yes | Yes | Yes |
| Email address | Yes | Yes | Yes | Yes |
| Profile photograph (optional) | Yes | Yes | Yes | Yes |
| Business records — orders, sales, stock, payments, outstanding balance | Yes | Yes | Yes | Yes |
| Precise location, continuously while on duty | — | Yes | — | — |
| Location at a single moment, when you ask for it | — | Yes | — | Yes |
| Attendance photographs at check-in and check-out | — | Yes | — | — |
| Camera access, for setting a profile photograph | Yes | Yes | Yes | Yes |
| Writing business contacts into your phone | Yes | — | — | — |
| Device push token, for notifications | Yes | Yes | Yes | Yes |
| Crash and diagnostic information | Yes | Yes | Yes | Yes |
Location, in detail
Zuuvy Fleet records where a salesman is while they are checked in for a shift, at short intervals, including when the app is in the background. This is what makes a day's round reviewable and a sale attributable to the place it happened. It exists because the alternative — a salesman writing down where they went — is not a record anyone can rely on.
- Collection starts when you check in and stops when you check out. It does not run on a day you have not started.
- Android asks separately for background location, and shows a persistent notification while it is being used. You can refuse; attendance still works, the route does not.
- Location is visible to your employer's administrators. It is not shared outside the business.
Zuuvy Partner uses location only when you actively use a map — marking where your shop is, or getting directions. It does not track you.
Photographs
Attendance photographs in Zuuvy Fleet are taken at check-in and check-out and are stored privately: they are served only through short-lived signed links to people in your own business who are entitled to see them. Profile photographs, in all four apps, are stored so that the apps can display them, and are not private in the same way — anyone with the link can load one.
Contacts — one direction only
Zuuvy HQ can write your business's shops and staff into your phone's address book, so that a call from a customer shows a name. It reads nothing out of your address book. The only thing it looks up is the handful of contacts it created itself, so that a second sync updates them instead of making duplicates. Your personal contacts are never uploaded to us.
4. Why we collect it
| Purpose | What it uses |
|---|---|
| Signing you in and keeping your session secure | Username, mobile number, password, one-time codes |
| Running the business features you were given the app for | Orders, sales, stock movements, payments, balances |
| Attendance and field-sales records | Check-in and check-out times, photographs, location while on duty |
| Telling you something happened — an order, a delivery, an offer | Push token, mobile number for WhatsApp messages |
| Producing receipts, invoices and statements | Name, business name, address, the transaction itself |
| Keeping the service working and diagnosing failures | Crash reports, error logs, device and app version |
| Meeting tax and accounting obligations | Transaction records |
We do not use any of it for advertising, profiling, or training machine-learning models, and we do not enrich it with data bought from anyone else.
5. Permissions, and what each is for
| Permission | Apps | Why |
|---|---|---|
| Camera | All four | Taking a profile photograph; in Fleet, also the attendance photograph at check-in and check-out |
| Location (precise and approximate) | Fleet, Partner | Attendance route and sale locations; map and directions |
| Background location | Fleet | Continuing to record the round when the phone is in a pocket. Requested separately, and refusable |
| Notifications | All four | Order updates, delivery confirmations, new offers |
| Read and write contacts | HQ | Writing the business address book into your phone. Nothing is read out of it except the contacts the app itself created |
| Biometric / fingerprint | HQ | Unlocking the app with the fingerprint your phone already holds. We never receive the fingerprint itself |
| Photos and files | Fleet | Choosing an existing picture instead of taking a new one |
Every one of these can be refused in Android's settings. Refusing a permission disables the feature that needs it and nothing else — the app does not stop working.
6. Who your data is shared with
We do not sell personal data, and we never have. It is shared in exactly three situations.
With your own business
Administrators at the business that gave you your login can see your records in it — a salesman's route and attendance, a shop's orders and outstanding balance. That is the purpose of the product. Businesses cannot see each other's data.
With the services that run the platform
| Service | What it handles | Where |
|---|---|---|
| Amazon Web Services | Servers, database and file storage — where the data actually lives | India |
| Google Firebase Cloud Messaging | Delivering push notifications to your device | Google infrastructure |
| Google Sign-In | If you choose to sign in with Google, we receive your name, email address and profile picture from Google | Google infrastructure |
| Twilio | Sending WhatsApp messages — one-time codes, order and delivery updates | Twilio infrastructure |
| SendGrid | Sending email where email is used instead of WhatsApp | Twilio infrastructure |
| Calendly | The “book a walkthrough” calendar on this website only. If you book a time, the name and email you type into it go to Calendly. It is not part of any of the apps, and no customer, order or location data reaches it | Calendly infrastructure |
Each of these gets only what it needs to do its job, and is contractually bound to use it only for that.
When the law requires it
If we receive a valid legal order, we will comply. Where we are permitted to tell you, we will.
7. How long we keep it
| What | Kept for |
|---|---|
| Your account and profile | As long as the account exists, then removed on deletion |
| Attendance photographs and location history | 24 months, then deleted |
| Orders, invoices, payments and other financial records | 8 years, because Indian tax and company law requires books of account to be kept that long. These survive account deletion — see below |
| One-time codes | 5 minutes, then unusable |
| Crash and diagnostic logs | 90 days |
If your business bought goods and was invoiced, that invoice is the subscribing business's accounting record and the law requires them to keep it. What we do on deletion is detach it from you: your name, phone number, email and photograph go, and the transaction remains as a numbered record. It cannot be traced back to you through our systems.
8. How it is protected
- Everything between the apps and our servers travels over HTTPS. There is no plain-text path.
- Passwords are stored only as salted hashes. Nobody at Zuuvy can read yours.
- One-time codes are stored hashed, expire in five minutes, allow five attempts, and are spent the moment they are used.
- Attendance photographs are private and reachable only through short-lived signed links.
- Each business's data is separated in the data layer itself rather than by each screen remembering to filter — and an automated test walks every endpoint on every build to prove no route can return another business's rows.
- Access to production systems is limited to people who need it, and is logged.
No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your data, we will tell you and the relevant authority without undue delay. More detail is on the security page.
9. Your rights
Under India's Digital Personal Data Protection Act, 2023 — and as a matter of course for everyone, wherever they are — you can:
- Ask what we hold about you, and get a copy of it.
- Correct anything wrong. Most of it you can edit in the app; write to us for the rest.
- Have your account and data deleted — see Delete your account.
- Withdraw a permission at any time in Android's settings.
- Nominate someone to exercise these rights if you die or become incapacitated.
- Complain — to us first at rishav@zuuvy.in, and to the Data Protection Board of India if we have not resolved it.
Write to rishav@zuuvy.in and we will answer within 7 days. Because your account was created by a business, we may need to involve them — for instance, an employer is entitled to their own attendance records even if the employee would rather they were erased.
10. Children
These are workplace applications. They are not directed at children, they are not designed for or advertised to anyone under 18, and no account can be created without a business issuing it.
We do not knowingly collect data from a child. If you believe a child's data has reached us, write to rishav@zuuvy.in and we will delete it. See also our child safety standards.
11. Changes to this policy
When this policy changes we update the date at the top of the page. If a change materially affects what we collect or who we share it with, we will say so in the apps before it takes effect, rather than relying on you to re-read the page.
Earlier versions are available on request.
12. Contact us
Questions, requests and complaints about privacy all go to one place.
Rishav
Founder — Zuuvy
rishav@zuuvy.in
Bangalore, Karnataka, India
We answer within 7 days.