This Privacy Policy explains how Stitchfloor (“Stitchfloor”, “we”, “us” or “our”) collects, uses, shares and protects personal data in connection with stitchfloor.com, the Stitchfloor web application, the Stitchfloor mobile applications and related services (together, the “Service”). By using the Service you acknowledge this Policy. Capitalised terms not defined here have the meaning given in our Terms of Service.
1. Our role
Stitchfloor is business software provided to organisations. Where an organisation (our “Customer”) uses the Service, the business records and other data it and its users enter (“Customer Data”) are processed by us on the Customer’s behalf and on its instructions. For that data the Customer is the Data Fiduciary and we are its Data Processor under the Digital Personal Data Protection Act, 2023. If you use the Service through your employer or another organisation, questions and requests about that data should be directed to that organisation first.
For personal data we collect for our own purposes, such as account administration, billing, sales enquiries and visits to our website, we are responsible for it as described in this Policy.
2. Information we collect
- Account information: your name, email address, mobile number, role and organisation, and sign-in identifiers, including where you sign in with a third-party account such as Google or Apple.
- Customer Data: business records entered into a workspace, which may include personal data of workers, customers, suppliers and other individuals, such as names, contact details and wage or payment information.
- Usage and device information: records of actions taken in the Service and when, a description of the device and browser used, an identifier generated by the app, IP address, and server and error logs.
- Voice input: where a user chooses to use voice entry, the audio recorded for that entry and the text produced from it, used to complete the form on screen.
- Files and images: photographs, documents and other files a user chooses to upload.
- Communications: information you provide when you contact us, request a demonstration or ask for support.
- Website information: information about visits to our website, such as the pages viewed, the referring site, and the approximate country, device type and browser.
The mobile applications access the microphone only when a user starts voice entry, and the camera or photo library only when a user chooses to attach an image. They do not request access to your device’s location or contacts.
3. How we use information
We use personal data to:
- provide, operate, maintain and support the Service;
- authenticate users and secure the Service, and detect and prevent fraud, abuse and security incidents;
- communicate with you about the Service, your account, billing and changes to our terms or policies;
- improve and develop the Service, including in aggregated or de-identified form;
- respond to enquiries and send information you have asked for;
- comply with legal obligations, resolve disputes and enforce our agreements; and
- for any other purpose with your consent or as otherwise permitted by law.
We process personal data on the basis of consent, for legitimate uses permitted under applicable law, and, for Customer Data, on our Customer’s instructions.
4. How we share information
We do not sell personal data. We may share it with:
- Service providers that process data on our behalf to operate the Service, such as providers of cloud hosting and infrastructure, authentication and messaging, speech recognition and language processing, and GST Suvidha Providers and related integration partners where a Customer files documents with government systems through the Service. They are permitted to use the data only to provide their services to us.
- The Customer organisation: administrators and other users of a workspace can see data within that workspace, including information about who entered a record.
- Platforms you connect: where a Customer connects a third-party service, such as a WhatsApp Business account, data is shared with that service as needed to carry out the actions the Customer requests. That service’s own terms and privacy policy apply.
- Authorities and others where required: where we believe disclosure is required by law, regulation or legal process, or is necessary to protect the rights, property or safety of Stitchfloor, our Customers or others.
- In a business transfer: in connection with any merger, acquisition, reorganisation or sale of all or part of our business or assets.
Our service providers may store or process data outside India, in accordance with applicable law.
5. Cookies and similar technologies
Our website uses analytics that do not rely on cookies to count visits. Our sign-in pages use Google reCAPTCHA to protect against automated abuse; reCAPTCHA may set cookies and collect device and usage information, and its use is subject to Google’s Privacy Policy and Terms of Service. The Service may also use cookies and local storage that are necessary for sign-in and for it to function.
6. Retention
We retain personal data for as long as necessary for the purposes described in this Policy, including for as long as a Customer’s subscription continues, and for any longer period required or permitted by law, for example for tax, accounting or dispute resolution purposes. Customer Data is retained in accordance with our agreement with the Customer. When personal data is no longer needed it is deleted or de-identified; copies in backups are overwritten in the ordinary course.
7. Security
We maintain reasonable security practices and procedures designed to protect personal data against unauthorised access, alteration, disclosure and destruction. No method of transmission or storage is completely secure, and we cannot guarantee the security of any data. You are responsible for keeping your sign-in credentials confidential.
8. Your rights
Subject to applicable law, you may request access to a summary of your personal data, its correction, completion, updating or erasure, and you may withdraw consent where processing is based on consent, and nominate another person to exercise your rights in the event of death or incapacity. Where your data forms part of Customer Data, please direct your request to the organisation that gave you access; we will assist it as required. We may need to verify your identity before acting on a request, and we may decline or limit a request where the law permits or requires us to retain the data.
How to have an account and its personal data deleted is set out on our account and data deletion page.
9. The public demo
The public demo contains fictional sample data and stores what you enter on your own browser or device. Do not enter real business or personal information into it.
10. Children
The Service is intended for business use and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from them.
11. Third-party services
The Service may link to or integrate with websites and services operated by third parties. We are not responsible for their privacy practices, and their own policies apply.
12. Changes to this Policy
We may update this Policy from time to time. The updated Policy will be posted on this page with a new “Last updated” date and takes effect when posted. Your continued use of the Service after that constitutes acknowledgement of the updated Policy.
13. Grievance Officer and contact
Questions, requests and complaints about this Policy or our handling of personal data may be sent to our Grievance Officer at hello@stitchfloor.com.