Privacy Policy

Last updated: 25 October 2026

1. Introduction

IMAST Operations Private Limited (“IMAST,” “we,” “us,” “our”) is committed to the protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use any of our platforms, web applications, and mobile applications (collectively, the “Services”).

This Privacy Policy is our notice under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000 with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Where we rely on your consent, we ask for it separately and clearly, through a checkbox you tick yourself, and you can withdraw it at any time.

2. Data We Collect

2.1 Account Information

Name, email address, phone number, company name, job title, and billing information provided during registration or account setup.

2.2 Customer Data

Data you or your end-users input into the Platform — including loyalty transactions, distribution records, sales orders, leads, service tickets, reward redemptions, customer records, and visit reports. You retain full ownership of Customer Data.

2.3 Usage Data

Device information (model, OS version, unique device identifiers), IP addresses, browser type, pages viewed, features used, session duration, and interaction patterns.

2.4 Mobile Application Data

Our mobile applications may collect additional data depending on the features you use and the permissions you grant. This includes:

a) Location Data

• Precise GPS location is collected to enable features such as attendance marking, visit verification, geofence-based check-in/check-out, route tracking, and distance calculation.
• Background location may be collected during active work hours to track field routes and kilometres travelled, subject to configurable time-based cutoffs.
• Location data is transmitted to our servers and stored to generate visit reports, route trails, and travel summaries.

b) Camera and Photos

• The device camera (front and rear) is accessed for capturing attendance selfies, visit photos, audit evidence, expense receipt images, and event documentation.
• Photos are uploaded to our servers and stored for record-keeping, verification, and reporting purposes.

c) Biometric Data

• Facial recognition is used for identity verification during attendance marking. Facial feature embeddings (mathematical representations) are generated on-device and stored securely on our servers.
• Biometric data is used solely for identity verification and is never shared with third parties.
• You may request deletion of your biometric data at any time by contacting us.

d) Microphone and Speech

• The microphone is accessed when you use voice-to-text features for note entry, remarks, or search. Audio is processed on-device and is not recorded or transmitted to our servers.

e) Push Notifications

• Firebase Cloud Messaging (FCM) tokens are collected to deliver push notifications about approvals, alerts, and updates relevant to your work.

2.5 Cookies & Tracking Technologies

• Essential cookies for session management and authentication.
• Analytics cookies (e.g., Google Analytics) to understand usage patterns.
• Marketing cookies (only with your consent).

3. How We Use Your Data

• Delivering, operating, and maintaining the Services
• Verifying employee identity and attendance
• Tracking field visits, routes, and customer interactions
• Processing orders, expenses, and business transactions
• Providing customer support and resolving technical issues
• Processing payments and generating invoices
• Analysing usage to improve features and performance
• Ensuring security, detecting fraud, and preventing abuse
• Sending communications (updates, alerts, and marketing with consent)
• Meeting legal and regulatory obligations

4. Legal Basis for Processing

• Contract performance — to deliver Services you have subscribed to
• Legitimate interests — to improve Services, ensure security, and prevent fraud
• Consent — for marketing communications, non-essential cookies, and optional features (withdrawable at any time)
• Legal obligations — for tax, accounting, and regulatory compliance

5. Data Sharing

We may share data with:

• Service providers (e.g., cloud hosting providers, payment processors, email delivery services, mapping/geocoding services) under Data Processing Agreements with equivalent privacy protections
• Legal authorities when required by law, regulation, or legal process
• With your explicit consent for any purpose not covered above

We do not share biometric data, precise location history, or camera captures with any third party for advertising or marketing purposes.

6. Data Retention

Data Type	Retention Period
Active account data	Duration of subscription plus 90 days
Customer data after deletion request	Purged within 90 days; backups within 30 days
Billing and tax records	7 years (Indian tax law)
Location and visit history	Duration of employment/subscription plus 90 days
Biometric data (facial embeddings)	Until deletion request or account termination, whichever is earlier
Attendance and visit photos	Duration of subscription plus 90 days
Anonymised analytics	Retained indefinitely

7. Your Rights

You have the right to:

• Access your personal data we hold
• Rectify inaccurate or incomplete data
• Erase your data (subject to legal retention requirements)
• Export your data in standard formats (CSV, JSON, PDF)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Withdraw consent for marketing or optional features at any time
• Request deletion of biometric data at any time
• Nominate another person to exercise your rights in the event of your death or incapacity
• Grievance redressal by our Grievance Officer, and to complain to the Data Protection Board of India

To exercise any of these rights, contact privacy@imast.in. To withdraw consent, use imast.in/withdraw-consent; withdrawing is as easy as giving consent. We will respond within 30 days.

8. Website Forms and Your Consent

When you fill in a form on www.imast.in (contact, demo, pricing proposal or newsletter), the following applies.

• What we collect: your name, email address, mobile number with country code, company name, the product or plan you ask about and anything you write in the message. As proof of consent we also record the date and time, the page, your IP address and browser, and the exact consent text you were shown.
• Why: to respond to your request, including by phone call, email, SMS and WhatsApp, to prepare a demo or proposal, and to keep a record in our customer relationship system. Only if you tick the separate optional box do we send you product updates, offers and event invitations.
• How you consent: by ticking an unticked checkbox yourself. Forms cannot be submitted without the required consent, and marketing consent is always a separate, optional choice. Sales forms accept work email addresses only. We email you a copy of your consent.
• Your declaration: when you submit a form you confirm that the details are your own or that you are authorised to share them, that they are accurate, and that you are 18 or older. Under Section 15 of the DPDP Act you must not give false details or the details of another person without their authority.
• Proof of consent: consent and withdrawal records are stored in a tamper-evident, append-only log in India and kept for 8 years so that we can demonstrate them to a court or the Data Protection Board of India. Enquiry details are kept for up to 2 years from your last contact with us, unless you become a customer.
• Withdrawal: you can withdraw at any time at imast.in/withdraw-consent, by replying to any email from us, or by writing to privacy@imast.in. Withdrawal does not affect processing done before it.

9. Mobile App Permissions Summary

Our mobile applications request only the permissions necessary for their features:

Permission	Purpose	When Used
Location (precise)	Attendance geofencing, visit verification, route tracking	During active work sessions
Location (background)	Route trail and distance calculation	During active work hours only (configurable cutoff)
Camera	Attendance selfies, visit/audit/expense photos	When capturing photos within the app
Biometric / Face Recognition	Identity verification	During attendance check-in
Microphone	Voice-to-text for notes and remarks	When speech input is activated by user
Internet	Data sync, API communication	Always
Notifications	Work alerts, approval updates	Always (can be disabled in device settings)
Storage	Offline data caching, photo storage	Always

You may revoke any permission at any time through your device settings. Revoking certain permissions may limit the functionality of the app.

10. International Data Transfers

Primary data storage is on Mumbai, India. For users in the EU/EEA, data transfers are protected by Standard Contractual Clauses (SCCs) and Transfer Impact Assessments.

11. Children’s Privacy

Our Services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected such data, we will delete it promptly.

12. Security Measures

We implement industry-standard security measures including:

• AES-256 encryption at rest
• TLS 1.2+ encryption in transit
• Managed encryption keys with 90-day rotation
• Multi-factor authentication (MFA) for production access
• 24/7 Security Operations Centre (SOC) monitoring
• Quarterly penetration testing
• Role-based access control
• On-device biometric processing to minimise data exposure

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or an in-app notification at least 30 days before they take effect. Where a change affects processing that relies on your consent, we will ask for your consent again.

14. Grievance Officer

In accordance with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, our Grievance Officer is:

Rahul Dubey, Head, Internal Audit
Email: grievance@imast.in
IMAST Operations Private Limited, IMAST House, 1, Eastern Ring Rd, WB 74, Scheme No 94 Sector EB, Indore, Madhya Pradesh 452010, India

We acknowledge grievances promptly and resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

15. Governing Law and Jurisdiction

This Privacy Policy, and any consent you give on our website or Services, are governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Subject to your statutory right to approach the Data Protection Board of India or any other authority under law, the courts at Indore, Madhya Pradesh, India have exclusive jurisdiction over any dispute arising from them.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy:

Privacy Team: privacy@imast.in
Data Protection Officer: dpo@imast.in
Legal: legal@imast.in
Grievance Officer: Rahul Dubey, Head, Internal Audit, grievance@imast.in

IMAST Operations Private Limited
IMAST House, 1, Eastern Ring Rd, WB 74, Scheme No 94 Sector EB
Indore, Madhya Pradesh 452010, India