Privacy policy

1. Who we are

The data fiduciary (the company responsible for your data) is:
Phytotron Agro Products India Pvt. Ltd.
Phytotron Research Center, No. 1 Thirumenahalli
Jakkur Post, Yelahanka
Bengaluru 560064, Karnataka, India
GSTIN 29AABCP2726Q1ZW · phytotron.com

This policy covers Phytotron HQ wherever you use it: in a browser at phytotron-hq.vercel.app, as the Android app and the iPhone app (com.phytotron.hq, native apps), and in a browser at the same address. Where the phone apps and the browser behave differently, this policy says so.

2. What we collect and why

Your account

Your name, mobile number, email address (if the office adds one), role, designation, territory, reporting manager and HQ town. The office enters these when it creates your login. The temporary PIN the office issues is shown once, and you replace it with your own PIN (or, for office roles, a password) the first time you sign in. We never store a PIN or password as typed, only a one-way scrypt hash of it, so nobody at Phytotron can read it.

Why: to sign you in and show each person only the parts of the app their role needs.

Sign-in and security records

When you sign in we record the session (start, expiry after 30 days, when it was last used), your browser or phone model, and the IP address. We also record each sign-in attempt (mobile number, time, success or failure, IP address) and keep an audit log of changes made in the app: who did what, and when.

Why: to keep accounts secure, stop misuse and know who changed a record.

Location

The app reads your phone's location only at these moments:

• While your work day is running (field staff, phone app). When you tap Start day the app first explains route recording, then your phone asks for permission. From then until you tap Finish day it records your route, also when the app is closed or the phone is locked. It keeps a point about every 50 metres or once a minute, at high accuracy. Points wait on the phone when there is no signal and are sent to our servers in batches. While it records, Android shows a notification (“Recording your route until you finish the day”) and iPhone shows the blue location indicator. It stops when you tap Finish day. If you allow location only while using the app, it records only while the app is open on screen.
• While your work day is running (field staff, in a browser). The page records your route while it is open on the screen. It keeps a point when you have moved about 25 metres, or once a minute, and drops readings that are less accurate than 100 metres. Points are sent to our servers in small batches. If you turn on Keep screen on while riding on the day card, the app keeps the screen awake while the day runs, and lets go after 20 minutes without movement. It is off unless you turn it on. When the phone is locked or the app is closed, recording stops.
• When you start or finish the day, one reading marks where the day began and ended.
• When you log a visit, the visit screen takes one reading so the visit shows where it happened and how far it was from the dealer's shop (it also pins the shop if it had no pin yet). This happens even if you log a visit on a day you have not started.
• When you pin a dealer's shop during onboarding (only when you tap the pin button).
• When you check in or out for your shift (factory and office staff). One reading checks that you are within your site's fence (its radius plus up to 100 metres for GPS accuracy). The point is stored with the check-in or check-out time. A site without a fence takes no check.

Background location is used only while a work day you started is running. You can refuse it: the day then has no route, or a route recorded only while the app is open. If you block location altogether you can still use the app; your day and visits are saved without a location, with a note saying why, and the office can mark your attendance by hand.

Why: to show the day's route and kilometres for the travel allowance, to confirm visits to dealers and farmers, to help your manager plan the territory, and to record attendance at your site. Who sees it: you, your reporting manager, office administrators and the directors.

Shift, attendance and leave (all staff)

Your check-in and check-out times, the site and the one location reading checked against the site's fence, and the status worked out from your shift (on time, late, half day), with any correction the office makes and who made it. Your shift and roster. Leave you apply for (dates, type, half day, and a reason if you give one: please don't include medical details), its decision, and your leave balances. Which announcements you have read, and the tasks and checklist items you tick.

Why: attendance, payroll and leave, which we must keep under employment and labour law. Legal ground: employment (DPDP Act section 7(i)). Who sees it: you, your manager, the office and the directors.

Work you record

Visits (purpose, outcome, notes, crop, products discussed, next steps), orders, payments collected (amount, mode, reference, a photo of the cheque), travel and expense claims (amounts, kilometres, odometer readings, receipts), demo plots (photos, videos, results), beat plans and targets.

Why: these are Phytotron's business records. They are needed for billing, collections and paying your claims.

Materials you open or share

When you open, download or share an item from the Materials library, the app records which item, who and when. The office uses this to see which leaflets, videos and price lists are used. It is our own record, kept in our database; no outside analytics tool is involved.

Photos, videos and documents

You choose what to attach: a photo taken with the camera, or a photo, video or PDF from your phone. Photos are made smaller on the phone before they are uploaded. Files are stored privately and opened only through links that expire after a short time.

Information about dealers

Firm name, owner's name, phone and WhatsApp numbers, email, address, the shop's location, GSTIN, PAN, fertiliser and pesticide licence numbers, KYC documents (GST certificate, PAN card, licence, shop photo, cancelled cheque), credit limit and terms, orders, and amounts billed and owed.

Why: to onboard and approve dealers, set credit, bill them and meet GST rules. Dealers give this information to us when they apply to become a dealer.

Information about farmers

Name, mobile number, village, taluka, district, crops, acreage, preferred language, notes from visits and demo plots, and how the farmer agreed to hear from us (spoken consent at a visit, a signed form, a WhatsApp opt-in or an event register). Field staff may add farmer contacts in three ways: by ticking them in the phone book, from a file they choose (.vcf or .csv; Excel in the browser), or by pasting numbers. The phone app reads the phone book only when you choose Your phone book, after a notice that explains it and the phone's own permission prompt. It reads names and numbers on the phone; only the contacts you tick are uploaded, and the rest never leave the phone. Before an upload, staff must confirm that the farmers agreed to be contacted. The app also shows, read-only, farmers who wrote to MitrAI, Phytotron's own WhatsApp crop advisory service.

Why: to follow up on crop advice and demo plots, and to tell farmers who agreed about our products.

Questions to Ask the Board (directors only)

The Board has an assistant that answers the directors' questions about company figures; today only the Managing Director uses it. It uses Anthropic's Claude API, a third-party AI service in the United States. Field and office staff cannot use this feature.

Permission first. Before the first question, the app shows what is sent and what never is, and asks the director to allow it. Nothing is sent to Anthropic until the director taps Allow and continue, and the server refuses every question until then. The choice is kept with the director's account, so it applies on every device, and the audit log records when it was given or withdrawn. The director can withdraw it at any time at the foot of the Ask the Board screen.

What is sent: the question as the director types it, the recent conversation, a summary of the Board's figures, and the results of read-only database queries the assistant writes. Those queries can read only a fixed list of business tables and columns: sales, vouchers and outstanding amounts, products, stock, plan and territory figures, counts, and business names: party names as Tally holds them (usually dealers' firm names), and staff names with each person's role, designation and HQ town; and staff work records by person: work-day dates, start and finish times, kilometres and odometer readings, visits and demo plots (when, crop, acreage, products, and which dealer or farmer by its record number in the app), beat-plan dates, orders, collections, expense claims, and which materials they opened or shared. For farmers it can read only taluka, district, crops, acreage and language, never a name or number. What is never sent: any query that touches phone numbers, email addresses, home or shop addresses, Aadhaar, PAN, GSTIN, licence or bank details, PINs, sign-in records, the audit log, GPS points and routes, KYC files, free-text notes, or farmers' names and numbers is refused before it runs (the one exception reads only whether a login is a test login, never the number itself). As a second check, phone numbers, email addresses, Aadhaar numbers, tax and bank IDs and map coordinates found inside any text in the results are removed before they are sent. We keep the first 200 characters of each question in the audit log.

Notifications

The phone app can send you notifications, such as “A new order is waiting” or “Your leave is approved”, if you allow them. To do that we store your phone's push token (an address for notifications, issued by Apple or Google) with your account. Notifications go through Expo's push service and then Apple or Google. They say only what kind of item is waiting, never a person's name, a phone number or an amount; you open the app to see the detail.

On your phone

Phone app: it keeps your sign-in key in the phone's secure storage (Keychain on iPhone, Keystore on Android). It also keeps on the phone: work not yet sent (route points, visits, orders, claims), form drafts and their photos, a copy of your dealer and farmer lists so forms open without signal, materials you save for offline use, and your settings. Signing out removes the sign-in key, your cached profile and the push token; the other copies stay on the phone until they are sent, replaced at your next sign-in, or the app is removed. If you switch on Face ID or fingerprint unlock, the phone checks it; Phytotron never receives it.

In a browser: one sign-in cookie (hq_s, valid for 30 days). The app also stores a few things on the phone: your light or dark theme, the haptics and Keep screen on while riding switches, your materials language, and work that has not been sent yet (route points, and an outbox of visits, orders and claims saved while you had no signal). These stay on the phone until they are sent. A farmer contact list that failed to upload is kept in that browser tab until it is sent or the tab is closed. We use no advertising cookies and no third-party analytics or tracking tools.

3. Our legal grounds

• Staff: we process your data for employment purposes, which the DPDP Act allows as a legitimate use (section 7(i)). We also process it to meet our legal duties, such as tax and company records.
• Dealers: your consent, given when you apply to become a Phytotron dealer, for that purpose: onboarding, credit, billing and service. Some records must also be kept under GST and accounting law.
• Farmers: your consent, which you can withdraw at any time (see section 8).

4. Who can see it, and who we share it with

Inside Phytotron, access depends on your role. Field staff see their own work and their customers. Managers see their team. The office sees what it needs for approvals, billing and claims. The directors see everything. Every colleague can see your name, role, designation, site or territory, manager and work mobile number in the staff directory.

These service providers process data for us, on our instructions:

Some outside services take part when you use certain screens. When you open a map, your phone loads map images from OpenStreetMap, which sees your IP address. When you play a training video, it plays from YouTube in privacy-enhanced mode. When you share material or the office sends you a PIN on WhatsApp, WhatsApp handles that message. You or the office choose to do that.

We do not sell personal data. We share it with authorities only when the law requires us to.

5. Where your data is stored

The app's servers run in India (Mumbai). The database, files, notifications and the Ask the Board service can be processed outside India, as the table above shows. The DPDP Act allows this unless the Government of India restricts a country. We will follow any such restriction.

6. How we protect it

• HTTPS for every connection. The phone app sends a signed sign-in token over HTTPS; a browser sends the sign-in cookie.
• PINs and passwords are stored only as one-way hashes. The sign-in cookie cannot be read by scripts.
• Our servers reach the database only through a gateway that checks a signature on every request.
• Files are uploaded and opened only through signed links that expire: 10 minutes for an upload, a few hours at most to view.
• Role-based access, and an audit log of every change.

If a personal data breach happens, we will tell the people affected and the Data Protection Board of India, as the DPDP Act requires.

7. How long we keep it

Some of the limits below are plans, not yet automatic: nothing in the app deletes old records on a schedule today. Where a row says so, we are building the automatic clean-up, and until it runs that data is kept longer, with the same access controls.

Data we erase can remain in the database's automatic backups for up to 30 days before it is gone for good.

8. Your rights

Under the DPDP Act you can:

• Get a summary of the personal data we hold about you and how we use it.
• Correct, complete or update it. Most profile details are changed by the office on request.
• Have it erased when it is no longer needed, apart from what the law makes us keep. Staff can start this in the app with Delete my account (see Delete your account for what is erased and kept).
• Withdraw consent where we rely on it (farmers: say so to your Phytotron contact or write to us).
• Nominate someone to use these rights for you if you die or cannot act yourself.
• Raise a grievance with our Grievance Officer (below).

To use a right, write to admin@phytotron.com from the email address we have for you, or give us your registered mobile number so we can confirm it is you on that number. We reply within 30 days, and resolve grievances within the time the DPDP Rules set. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

9. Grievance Officer

Grievance Officer
Phytotron Agro Products India Pvt. Ltd.
Phytotron Research Center, No. 1 Thirumenahalli
Jakkur Post, Yelahanka
Bengaluru 560064, Karnataka, India
Email: management@phytotron.com

10. Children

Phytotron HQ is for adult employees and is not meant for anyone under 18. We do not knowingly collect personal data about children. Farmer contacts must be adults. If we learn that we hold a child's data, we delete it.

11. Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use your data, we will tell staff in the app before it applies.

12. Contact

Questions about this policy: admin@phytotron.com or management@phytotron.com. Help with the app: Support.