Privacy Policy

Information we collect

• Account information — name, email address, phone number, organization name, and login credentials you provide when you create or are added to an account.
• Business data you enter — information you add to the Services to run your operations (e.g. projects, contacts, invoices, attendance). This data belongs to you; we process it on your behalf.
• Photos, files, and documents — images and files you choose to attach from your device, such as project documents or a profile photo. These are uploaded and stored as part of your organization's data. We access your camera or file storage only at the moment you choose to attach something.
• Location — if you choose to set a project's location on the map, the mobile app requests your device's precise location to centre the map on where you are. This happens only while that screen is open and only after you grant permission. We do not collect location in the background, we do not track your movements, and we do not use location for advertising. You can decline the permission and enter a location manually instead.
• Push notification identifier — when you enable notifications, a device token issued by Google Firebase Cloud Messaging is stored so we can deliver alerts about your work (for example a task assigned to you). The token is removed when you sign out.
• Usage and device data — our servers record the requests our apps and website make to them, including device type and operating system, so we can keep the Services secure and reliable. The mobile app itself carries no analytics or crash-reporting software, and does not track how you use it.

We do not collect your contacts, your call or SMS history, or the other apps installed on your device.

How we use information

• To provide, operate, and maintain the Services.
• To authenticate users and secure accounts.
• To process subscriptions, billing, and related account administration, and to issue invoices and tax documents.
• To respond to support requests and communicate important updates.
• To improve performance, reliability, and features.
• To comply with legal obligations.

How we share information

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share information only with service providers who process it on our behalf under confidentiality and security obligations, or where required by law.

The providers we rely on are:

• Google LLC — Firebase Cloud Messaging, to deliver push notifications to your device. This receives the notification token described above.
• DigitalOcean, who host the servers that store and serve the Services. Your data is stored in their Bangalore, India data centre region and is not transferred outside India for storage.
• Cloudflare, which routes and protects traffic to our domains.
• Razorpay, who process subscription payments. They receive the billing details needed to take a payment; we do not store your full card number.

Data security

We use industry-standard technical and organizational measures — including encryption in transit and access controls — to protect your information. No method of transmission or storage is completely secure, but we work continuously to safeguard your data.

Data retention

We retain your information for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

When an organization's subscription ends or an account is deleted, we delete or irreversibly anonymize the associated personal data within 90 days, except where we are required to keep records for longer — for example invoices and payment records retained for statutory accounting and tax periods. Backups are purged on their normal rotation.

Your rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may:

• ask for access to the personal data we hold about you, and a summary of how it is processed;
• ask us to correct, complete, or update inaccurate personal data;
• ask us to erase your personal data — see Account & Data Deletion;
• nominate another person to exercise these rights on your behalf in the event of death or incapacity;
• raise a grievance with our Grievance Officer, named below, and escalate to the Data Protection Board of India if it is not resolved.

To make a request, write to mail@kivotech.in. We respond within 30 days. Because Constro is used by organizations, requests about business data your organization holds may need to be directed to that organization; we will tell you if that is the case.

Account and data deletion

You can ask us to delete your account and the personal data associated with it at any time. Full instructions, including what is deleted and what we must keep, are on our account deletion page.

In short: email mail@kivotech.in from the address on the account. We verify the request, delete the account and its personal data within 90 days, and confirm when it is done.

Constro accounts belong to an organization, so it is worth being clear about who can ask for what. An individual user may request deletion of their own account and personal data. The business data belonging to the organization — projects, invoices, attendance and the rest — is deleted on the instruction of that organization's account owner, not by an individual user, because it is the organization's record rather than yours alone.

Children's privacy

The Services are intended for business use by adults and are not directed to children. We do not knowingly collect personal data from anyone under 18, the age at which a person ceases to be a child under India's Digital Personal Data Protection Act, 2023. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date.

Contact us