Workforce hiring privacy terms for Labor App users

Introduction and Scope of This Privacy Policy

1. What Information We Collect and Why

• Account Registration Information: your mobile phone number, full name, city, selected role (worker or employer), preferred app language, and email address where you choose to provide one. Your mobile number is your login identity and is verified using a one-time password (OTP) sent over SMS.
• Worker Profile Information: work type and skill categories, years of experience, daily or monthly wage expectation, preferred payment mode, availability, preferred work locations, gender, age, and profile photograph.
• Identity Verification (KYC) Information — workers only: your Aadhaar number, photographs of the front and back of your Aadhaar card captured through the app, and the identity details read from that card, which may include your name, father's or guardian's name, date of birth, gender, and address. This is used solely to verify that you are a real, uniquely identified person, to prevent fake or duplicate accounts, and to give employers confidence when hiring. It is never used for advertising, profiling, or credit assessment.
• Employer and Business Information: company or contractor name, worksite names and addresses (including map coordinates you select), job post details such as skills required, wage offered, headcount, and dates, and your contact details used to support hiring workflows.
• Location Information: with your permission, the app reads your device's location while you are using it, in order to show nearby jobs and workers and to help you place a worksite on the map. Coordinates may be converted into a readable address using Google's mapping services. We do not collect your location in the background or when the app is closed.
• Camera and Photo Information: with your permission, the app uses your camera to take your profile photograph and to capture your identity document, and can access photos you specifically choose from your device when you pick a profile picture. We access only the images you capture or select — never your wider photo library.
• Reviews, Ratings, and Hiring Activity: job applications, invitations, accepted engagements, completion status, and the star ratings and written reviews exchanged after a job. Ratings and reviews are visible to other users of the Platform.
• Communications and Support Data: support requests raised in the app, call-back requests, and service-related correspondence, retained so we can resolve issues and maintain a service history.
• Device, Log, and Diagnostic Data: IP address, device model and operating system version, app version, language and region settings, crash reports, error logs, limited performance traces, and interaction logs. This is used for security, fraud prevention, debugging, and product improvement.
• Push Notification Token: if you allow notifications, a device-specific push token is generated so we can send you job alerts, application updates, and account notices.
• We do not collect payment card or bank account details, we do not collect health data, and we do not collect biometric identifiers such as fingerprints or iris scans.

2. Summary of the Data We Collect

• Contact and identity details (name, phone number, email, address) — for account creation, authentication, and hiring communication. Shared with our SMS provider to deliver OTPs; profile name is visible to other users.
• Government identity document (Aadhaar number and card images) — for worker identity verification and fraud prevention only. Shared with our identity verification provider. Never shown to employers or other users.
• Other personal details (gender, age, date of birth, father's or guardian's name) — for profile display and identity matching. Age and gender are visible to employers; the remaining details are not.
• Precise and approximate location — for nearby job and worker discovery and worksite mapping, collected only while the app is in use. Coordinates are shared with mapping services to resolve addresses.
• Photos (profile photograph and identity document images) — for profile display and identity verification. Stored with our hosting and content-delivery providers. Only the profile photograph is visible to other users.
• User content (job posts, profile text, ratings, reviews, support messages) — to operate hiring workflows and support. Job posts, profiles, ratings, and reviews are visible to other users; support messages are not.
• App activity, diagnostics, and crash logs — for security, debugging, and reliability. Shared with our crash-monitoring provider.
• Device identifiers (push notification token) — to deliver notifications. Shared with our push delivery provider.
• Across every category: data is collected to operate the Platform, is encrypted in transit, is never sold, is never used for advertising or for tracking you across other companies' apps and websites, and can be deleted on request.

3. How We Use Your Personal Data

• Create and maintain your account and authenticate you using an OTP sent to your mobile number.
• Verify a worker's identity through the Aadhaar-based KYC flow described above, and reduce fake, duplicate, or impersonated profiles on the Platform.
• Match labourers with employers using skills, wage expectations, availability, and location.
• Display job listings to workers, and worker profiles — including name, photograph, skills, wage, gender, age, rating, and work area — to employers who are hiring.
• Share the details necessary to complete a hiring interaction, such as a worksite address with a worker who has been engaged for that site.
• Send transactional SMS, push notifications, and in-app alerts about OTPs, job matches, applications, invitations, engagements, and account activity.
• Publish and moderate the ratings and reviews that workers and employers give each other.
• Respond to your support requests and call-back requests.
• Detect, investigate, and prevent fraud, abuse, misuse, and security incidents, and comply with legal obligations.
• Diagnose crashes and errors and analyse aggregate usage trends to improve reliability, performance, and user experience.
• Identity documents and the details taken from them are used only for identity verification, fraud prevention, and legal compliance. They are not shared with employers, other workers, or any other user of the Platform.

4. Our Legal Basis for Processing

• Your consent: for identity verification, and for access to your device location, camera, photos, and notifications. You may withdraw consent at any time as described in Section 9.
• Performance of our agreement with you: to create your account, operate hiring workflows, and provide support under our Terms of Service.
• Legitimate interests and platform integrity: to keep the Platform safe, prevent fraud and impersonation, and debug and improve the service, balanced against your rights.
• Legal obligation: to retain records or disclose information where applicable law, a court, or a competent authority requires it.

5. Data Sharing, Disclosure, and Third-Party Access

• Between Users, for Hiring: a worker's profile information — name, photograph, skills, wage, gender, age, rating, and general work area — is shown to employers on the Platform. Employer, job post, and worksite details are shown to workers. Direct contact details are exchanged only where a hiring interaction requires it.
• Identity Verification Provider: your Aadhaar number and identity document images are shared with our identity verification partner (Didit) purely to confirm that the document is genuine and matches the number you entered.
• SMS Delivery Provider: your mobile number is shared with our SMS gateway (Fast2SMS) so OTPs and transactional messages can be delivered to you.
• Maps and Location Services: coordinates and place search text are sent to Google Maps Platform to render maps, suggest addresses, and convert coordinates into readable addresses.
• Hosting, Storage, and Media Delivery: profile photographs, identity document images, and platform data are stored with our cloud hosting and content-delivery providers, including Bunny CDN.
• Mobile App Infrastructure: Expo services are used to deliver app updates and to route push notifications to your device push token.
• Diagnostics and Crash Monitoring: crash reports, error details, and limited performance traces are processed by Sentry to help us fix defects. This is configured not to send personally identifying request data.
• App Distribution Platforms: Google Play and the Apple App Store handle app downloads, updates, and any store-level reporting under their own privacy policies. They do not receive your Labor App account data from us.
• Legal Compliance and Safety: data may be disclosed where required by law, court order, or a lawful government or regulatory request, or where necessary to protect the rights, safety, and property of Labor App, our users, or the public.
• Business Transfers: if our business is reorganised, merged, or acquired, data may transfer as part of that transaction, subject to this Privacy Policy continuing to apply.

6. No Advertising, No Cross-App Tracking, No Sale of Data

7. Device Permissions the App Requests

• Location while using the app (Android: approximate and precise location; iOS: Location When In Use) — to show nearby jobs and workers and to set a worksite on the map. We never request or use background or always-on location.
• Camera — to take your profile photograph and to capture your identity document during verification.
• Photos — to let you pick an existing image from your device as your profile picture. Only the image you select is accessed; we do not read your photo library.
• Notifications — to deliver job alerts, application updates, and account notices.
• We do not request access to your microphone or audio recording, your contacts, your call logs, your calendar, your files, your health data, or your SMS inbox. OTPs must be entered by you; the app does not read your messages. Where your device offers to fill in your own phone number for you, that number reaches us only if you choose it.

8. Data Retention Policy

• Account Information: retained while your account remains active, and for a limited period after deletion where operationally or legally necessary.
• Identity Verification (KYC) Data and Document Images: retained while your account is active so your verified status can be maintained and misuse investigated, and thereafter only for the period required by applicable law. Access is restricted to authorised personnel on a need-to-know basis.
• Profile and Job Data: retained while relevant to active hiring workflows, or until removed, updated, or lawfully deleted.
• Ratings and Reviews: may be retained after an account is closed in order to preserve the integrity of other users' rating history, disassociated from your profile where feasible.
• Support Communications: retained for a reasonable period to handle repeat issues, quality assurance, and compliance needs.
• Technical Logs and Diagnostic Data: retained for a limited period for security monitoring, debugging, and abuse prevention.
• Inactive Accounts: where an account remains unused for an extended period, we may notify you and then close it and delete the associated data.

9. Your Data Rights and Choices

• Right to Access: request a copy of the personal data Labor App holds about you.
• Right to Correction: request correction of inaccurate or incomplete information. Most profile details can also be edited directly in the app.
• Right to Deletion: delete your account and associated personal data, as described in the next section.
• Right to Restrict or Object: object to, or ask us to restrict, certain processing activities where applicable law provides for it.
• Right to Data Portability: request your account data in a structured, commonly used format where technically feasible.
• Right to Withdraw Consent: revoke camera, photo, location, or notification permissions at any time in your device settings, and withdraw consent for other optional processing by writing to us. Withdrawing consent does not affect processing already carried out lawfully.
• Right to Complain: raise a grievance with our grievance contact below. Users in India may also approach the Data Protection Board of India, and users elsewhere may approach their local supervisory authority.
• Indian Users: users in India have rights under the Digital Personal Data Protection Act, 2023. To raise a request, email us with the subject "Data Rights Request".

10. Account and Data Deletion

• From inside the app: open your Account screen, choose the account deletion option, and confirm. This is available to every registered user on both Android and iOS.
• By email or phone: write to us at baljinder@dofin.co from the address linked to your account, or mention your registered mobile number, using the subject line "Data Deletion Request". You may also call the number listed at the end of this policy. Use this route if you no longer have the app installed.
• What is deleted: your account and login credentials, profile details, profile photograph, work or business details, worksites, saved preferences, identity verification data and document images, support history, and your device push token.
• What may be retained: records we are required to keep by law, information needed to resolve an ongoing dispute or to investigate fraud or abuse, and ratings you have given to others, retained in a form disassociated from your profile so that other users' rating history remains accurate.
• Timeline: in-app deletion takes effect immediately, with residual copies removed on our normal backup rotation. Emailed requests are verified as coming from the account holder and then actioned within 30 days.
• Simply deleting the app from your device does not delete your account — use one of the routes above.

11. Data Security and Protection Measures

• Encrypted HTTPS/TLS transmission for all communication between the app and our servers.
• Session and login tokens stored in the secure, operating-system-protected storage on your device rather than in plain application storage.
• Identity documents held in restricted storage, with internal access to sensitive information limited to authorised personnel on a need-to-know basis.
• Short-lived OTPs, rate limiting, and abuse controls on authentication and other sensitive endpoints.
• Operational monitoring, crash reporting, and technical controls intended to protect account and platform integrity.
• Periodic review of infrastructure, workflows, vendors, and security practices.

12. Cookies, Local Storage, and Tracking Technologies

13. Children's Privacy

14. International Data Transfers

15. Grievance Redressal and How to Reach Us

16. Changes to This Privacy Policy