1Who we are and scope
Data Fiduciary / Controller: CodingRoof. Product: Konnect. Website: https://codingroof.com/. Registered office: [Registered office address to be completed by CodingRoof].
This Policy applies to: (a) visitors to our marketing website and public pages; (b) business customers who create Konnect tenant accounts (owners, admins, office users); (c) employees and field workers who use the Konnect employee mobile app or employee web portal at their employer’s instruction; and (d) individuals whose contact details are entered into Konnect by a customer (for example customers, leads, vendors, and site contacts).
Related documents: our Terms of Service (/terms) and this Privacy Policy should be read together. You can submit privacy rights requests at /privacy-request.
2Roles: controller vs processor
CodingRoof acts as an independent controller (data fiduciary) for personal data we decide how to process for our own purposes, including: marketing-site interactions, demo and sales inquiries, SaaS account administration, subscription billing, product security, fraud prevention, and improving Konnect.
For most operational data that a business customer (tenant) stores in Konnect — including employee profiles, attendance, live location during jobs, job proofs, customers, leads, vendors, quotations, and job records — the tenant is typically the controller / data fiduciary, and CodingRoof processes that data as a processor / data processor on the tenant’s documented instructions to provide the service.
If you are an employee or field worker, your employer’s internal privacy notice and your employment relationship usually govern why your location and photos are collected. This Policy still explains how Konnect technically processes that data.
3Personal data we collect
Depending on how you use Konnect, we may process the following categories:
- Account and identity data: name/username, email address, phone number (including country code), password (stored as a secure hash), role, company and branch membership, account status, and profile photo.
- Organization data: company name, branch details, office coordinates or map links, logos, stamps, and subscription / plan identifiers.
- Employee and HR-operational data: employee code, joining date, role/type, address, emergency contact, skills, work schedule, and linked user account.
- Attendance data: check-in and check-out times, GPS coordinates, accuracy, address estimates, attendance photos, device information, and distance from office when configured.
- Field location / tracking data: live and historical location pings (latitude, longitude, accuracy), timestamps, battery level, network state, app state, tracking session metadata, and routes used for operational accountability during jobs or schedules configured by your employer.
- Job and proof-of-work data: job assignments, checkpoints, before/after/issue/other photos, signatures, optional GPS attached to proofs, and related notes.
- CRM and commercial operations data: customer, lead, vendor, and site-contact names, phone numbers, addresses, enquiry details, quotations, bills, warranties, and payment receipts (including payment method and reference snapshots).
- SaaS billing data: subscription status, plan, Razorpay order/payment/subscription identifiers, and related billing metadata needed to charge for ${LEGAL_PRODUCT_NAME}.
- Device and session data: IP address, user agent, push notification tokens (Expo), platform, and security/session metadata.
- Communications: emails, phone calls, or messages you send to us (for example demo requests or privacy requests).
- Cookies and similar technologies: consent preferences and strictly necessary storage used for authentication, security, and checkout helpers (see Cookies section).
4How we collect personal data
- Directly from you: when you create an account, update a profile, contact us, submit a privacy request, or configure company settings.
- Automatically: when you use the web or mobile apps (session metadata, security logs, and — for the employee app — location pings, attendance captures, and push-token registration after permissions are granted).
- From your employer / tenant administrators: when they invite you, create your employee record, assign jobs, or configure tracking and attendance rules.
- From payment processors: Razorpay returns payment and subscription status needed to activate or renew service.
- From device permissions you grant: camera, photo library, location (including background location where enabled for in-progress jobs), and notifications.
5Purposes of use
We (and, where applicable, tenants using Konnect) use personal data to:
- Provide, operate, secure, and support the Konnect service.
- Authenticate users, manage roles, and prevent unauthorized access or abuse.
- Enable field operations: job assignment, attendance, live employee tracking during work, proof of work, inventory movement, and related office workflows.
- Process SaaS subscriptions and invoices via Razorpay.
- Respond to support, sales, and privacy requests.
- Maintain logs for security, debugging, and service reliability.
- Comply with law, enforce our Terms, and establish or defend legal claims.
- Improve product features and documentation (using aggregated or de-identified insights where practical).
6Legal bases (GDPR) and DPDP notice
Where the GDPR or UK GDPR applies, we rely on one or more of the following bases: performance of a contract (to provide the service you or your employer signed up for); legitimate interests (securing and improving the service, preventing fraud, B2B marketing to business contacts in a proportionate way); consent (for optional cookies/marketing where required, and for certain device permissions); and legal obligation.
Where India’s DPDP Act applies, CodingRoof processes personal data for the specified purposes described in this Policy based on consent and/or legitimate uses recognized under the Act (including purposes connected with employment, where applicable for tenants). Consent, when required, must be free, specific, informed, unconditional, and unambiguous. You may withdraw consent for consent-based processing without affecting processing that relies on another lawful ground, though some features (for example background location) will stop working if required permissions are withdrawn.
Device permissions (location, camera, photos, notifications) are requested in-app and can usually be changed in your device settings. Withdrawing permission may limit or disable related product features.
8International transfers
Personal data may be stored or processed in India and in other countries where CodingRoof or its subprocessors operate (for example cloud regions used by Google Cloud, payment, or notification providers). Where required by applicable law, we use appropriate transfer mechanisms and contractual protections.
9Retention
We retain personal data only as long as needed for the purposes described in this Policy, including:
- Account and billing data: for the life of the customer relationship and a reasonable period afterward for audits, disputes, and legal compliance.
- Operational tenant data (jobs, proofs, attendance, tracking history, CRM records): according to the tenant’s retention needs and our backup/operations windows, until the tenant deletes the data or closes the account, subject to legal holds.
- Security and session logs: for a limited period needed for security investigation and service reliability.
- Cookie consent preferences: until you reset them or clear site storage.
- Privacy request records: as needed to demonstrate we handled your request.
When data is no longer required, we delete or de-identify it within a reasonable time, except where longer retention is required by law.
10Security
We implement technical and organizational measures appropriate to the risk, including access controls, hashed passwords, encrypted transport (HTTPS), session controls, and restricted access to production systems. No method of transmission or storage is 100% secure. Tenants are responsible for configuring user access carefully and for securing devices used by field staff.
If we become aware of a personal data breach affecting Konnect, we will take steps required by applicable law, which may include notifying regulators and affected individuals or customer tenants without undue delay.
12Your privacy rights
Depending on your location and role, you may have rights including:
- DPDP (India): right to access information about your personal data, correction and erasure of certain data, data portability of data provided by you (as applicable), withdraw consent, and grievance redressal; and the right to nominate (where applicable under rules).
- GDPR/UK GDPR: access, rectification, erasure, restriction, objection, portability, and the right not to be subject to certain automated decisions; and the right to lodge a complaint with a supervisory authority.
- CCPA/CPRA (California, if applicable): right to know/access, delete, correct, opt out of sale/sharing, limit use of sensitive personal information (where applicable), and non-discrimination for exercising rights.
To exercise rights, use /privacy-request or email privacy@codingroof.com. We may need to verify your identity (and, for employee data, may redirect you to your employer if they are the controller). We aim to respond within one month under GDPR and within 45 days under CCPA (extendable once with notice where permitted).
13Do Not Sell or Share; Global Privacy Control
CodingRoof does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are commonly defined under the CCPA/CPRA. If you still wish to record an opt-out preference, submit a request via /privacy-request?type=do-not-sell or email privacy@codingroof.com with the subject “Do Not Sell or Share.”
Where legally required, we will honor recognized browser opt-out preference signals such as Global Privacy Control (GPC) as an opt-out request for sale/sharing for that browser, to the extent such sale/sharing would otherwise occur.
14Children’s data
Konnect is a business operations product and is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact privacy@codingroof.com and we will take appropriate steps to delete it.
15Employee and field-tracking notice
The Konnect employee mobile app may collect precise location, including while the app is in the background or the screen is locked, when your employer enables tracking for in-progress jobs or configured work periods. The app may also access the camera and photos for attendance check-in and job proof uploads, and may register a push token for operational notifications.
- Location is used for operational accountability (who is on site, route history, attendance distance checks), not for selling location data.
- Background location is requested only when needed for the employer’s configured field workflows; you can deny or later revoke permission in system settings.
- Your employer should inform you about workplace monitoring and obtain any required consents under local employment and privacy law.
- Tracking outside authorized work contexts should not be enabled by tenants; tenants are responsible for lawful configuration.
16Tenant / employer responsibilities
Business customers using Konnect must:
- Provide their own notices to employees, customers, and other individuals whose data they upload.
- Have a lawful basis for processing, including for location tracking and workplace photos.
- Configure access roles carefully and delete or export data when no longer needed.
- Respond to individual requests where they are the controller, or cooperate promptly when we receive a request that relates to their workspace.
- Not use the service to monitor individuals unlawfully or outside disclosed, proportionate purposes.
17Changes to this Policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date and, for material changes, provide additional notice (for example a website banner, in-app notice, or email to account owners). Continued use of Konnect after an update becomes effective means the updated Policy applies to subsequent processing, except where consent is required.
18Grievance officer and complaints
For privacy grievances and DPDP-related communications, contact our privacy / grievance channel at privacy@codingroof.com (or hello@codingroof.com). We will acknowledge and work to resolve complaints in a reasonable time.
If you are in India, you may also have the right to complain to the Data Protection Board of India in accordance with the DPDP Act and rules. If you are in the EEA/UK, you may lodge a complaint with your local data protection authority. If you are in California, you may contact the California Privacy Protection Agency or the California Attorney General.
19Contact us
- Organization: CodingRoof
- Product: Konnect
- Privacy email: privacy@codingroof.com
- General email: hello@codingroof.com
- Phone: +91 9108623002
- Website: https://codingroof.com/
- Address: [Registered office address to be completed by CodingRoof]
- Privacy requests: /privacy-request