Privacy Policy

Last updated: 30 October 2026

MeraTheka is a product of Mahavijay Solutions Private Limited ("we", "us", or "our"), a private limited company registered in India with its registered office at H No-191, Behind Master Public School, Jairajpuri, Amausi, Sarojini Nagar, Lucknow, Uttar Pradesh 226008, India, and the data fiduciary for the platform at app.meratheka.com. This Privacy Policy explains what personal data we collect, why we collect it, how it is used, and the rights available to you. We are committed to protecting personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian laws.

By using the Platform, you consent to the practices described in this Policy.

1. Data We Collect

1.1 Account Data (Firm Owners & Managers)

When you sign in via Google, we receive from Google:

• Name — displayed in the platform UI.
• Email address — used as your unique identifier and for account communications.
• Profile picture — displayed in the platform UI.
• Firebase UID — a unique token used to securely associate your session with your account.

We do not receive or store your Google password.

1.2 Worker Data (Collected by Firm Owners)

Firm Owners add worker profiles to the Platform. This may include:

• Name, mobile number, address, trade and Aadhaar number.
• Worker documents (e.g., ID proofs, labour cards) — stored privately and shown only to signed-in users of the firm.
• Face data (biometric) — a face photo taken at enrolment and a numerical face encoding derived from it. The encoding is used only for face-recognition attendance matching; the photo is shown on the worker's profile so the firm can recognise them.
• Payment details (UPI ID, UPI QR code, bank account) and photos of payment receipts and bills.
• Attendance records, wage history, payments, advances and rewards.

1.3 Job & Activity Data

When a manager submits a job progress log, we collect:

• A photograph taken at the time of submission.
• GPS coordinates and accuracy — to geotag the log entry.
• Timestamp and submitting user's email.

This location is used solely to record the physical location of the work log.

1.3a Team Activity Log (Managers & CEOs)

For audit and accountability on behalf of the Firm Owner, every request a Manager or CEO makes on the Platform is recorded: each change they save (including attempts that fail) and each page they open. Each record contains:

• The person, their role, the date and time, and the action and project.
• The values entered in the form. Passwords, security tokens, Aadhaar numbers and face data are never recorded; uploaded files are recorded by name and size only, and very long text is shortened.
• The device's location: GPS coordinates, accuracy in metres and how recent the reading is, or a note that location was refused or unavailable.
• IP address and browser type.

While a Manager or CEO has the Platform open, the browser reads the device's location and sends the latest reading with each request. Location is read only while the Platform is open and is stored only together with a recorded action; it is not collected in the background or after the Platform is closed. Location access is required to save changes. Only the Firm Owner of that firm can view these records. They are kept for as long as the firm account remains open, as part of the firm's records, and are used only for audit, accountability and resolving disputes about work done for the firm.

1.4 Financial & Project Records

Records created within the Platform — vendor bills, payments, contracts, invoices, purchase orders — are stored and associated with your firm account.

1.5 Usage & Technical Data

We may collect standard server logs including IP addresses, browser type, and pages visited. This data is used for security monitoring, debugging, and improving platform performance. It is not used for advertising.

2. How We Use Your Data

• Platform operation: To provide attendance tracking, project management, invoicing, and related features.
• Authentication: To verify your identity and maintain secure sessions via Firebase.
• Face recognition attendance: To match a worker's live scan against stored face encodings for shift check-in.
• Communication: To send account-related notifications (e.g., invite links, support responses). We do not send marketing emails without explicit opt-in.
• Legal compliance: To comply with applicable laws, respond to lawful requests from authorities, and enforce our Terms.

3. Biometric Data (Face Data)

Face data is a sensitive category of personal data under the DPDPA. We treat it with the highest level of care:

• Face encodings are stored encrypted in the database. Face matching runs on our own server; face data is not sent to any outside face-recognition service.
• They are transmitted only over encrypted (HTTPS) connections.
• They are used exclusively for attendance matching within the enrolled worker's own firm.
• They are never shared with third parties, used for marketing, or used to identify individuals outside the Platform.
• A Firm Owner can permanently remove a worker's face data (the encoding and the face photo) from the worker's edit page at any time, using Remove face data. Removal is immediate and irreversible.

Firm Owners are responsible for obtaining appropriate worker consent before enrolling face data. See our Terms of Use §4 for details.

4. Data Sharing

We do not sell, rent, or trade your personal data. Data may be shared only in the following limited circumstances:

• Service providers: We use third-party infrastructure services that process data on our behalf: our cloud hosting provider, Google Firebase (sign-in), Google Maps (project locations) and Hostinger (email delivery, including reports that contain worker pay data sent to the Firm Owner).
• Payment processors: If you initiate a payment, transaction data is shared with PhonePe or other authorised payment gateways. Card numbers, UPI PINs and bank passwords are entered only on the payment partner's secure pages — we never see or store them. These providers have their own privacy policies.
• Legal obligations: We may disclose data if required by a court order, government request, or applicable law.
• Business transfer: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify you in advance.

5. Data Retention

• Account data is retained for as long as your account is active.
• Firm and project data is retained for as long as the firm account remains open.
• Face data is retained until the Firm Owner removes it or the worker record is permanently removed.
• Attendance, wage and payment records are kept as long as labour law requires the employer to keep them, even after a worker leaves; a worker who has such records is deactivated rather than deleted. On an erasure request, the personal details are removed and the wage records kept.
• Upon account closure, data will be retained for 30 days to allow export, then permanently deleted.
• Server logs are retained for up to 90 days for security and debugging purposes.

6. Data Security

We implement industry-standard technical and organisational measures to protect your data:

• All data in transit is encrypted via TLS/HTTPS.
• Worker ID documents and job photos are stored privately and shown only to signed-in users of the firm.
• Payment receipts, bill photos, payment QR codes and worker face photos are currently stored at unlisted, random web addresses that are not published anywhere. We are moving them behind sign-in.
• Face encodings are encrypted in the database. Database records are protected by role-based access controls, and the server's disks are encrypted by the hosting provider.
• Aadhaar numbers are shown masked (only the last 4 digits) on printed gate passes.
• Authentication is managed by Google Firebase, which provides brute-force protection and secure token issuance.
• Application-level security controls include role-scoped data access and obfuscated record identifiers.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

Under the DPDPA and applicable law, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Withdraw consent: Where processing is based on consent, withdraw it at any time (this will not affect prior processing).
• Grievance redressal: Lodge a complaint with us or with the Data Protection Board of India.

To exercise any of these rights, contact us at support@meratheka.com. We will respond within 30 days.

8. Cookies

The Platform uses session cookies to maintain your login state. For Managers and CEOs, a further cookie (mt_loc) holds the device's latest location reading so that it is sent with each request for the Team Activity Log (section 1.3a). These are strictly necessary for the Platform to function and do not track you across other websites. We do not use advertising or analytics cookies.

9. Children's Privacy

The Platform is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Third-Party Services

The Platform integrates with the following third-party services, each governed by their own privacy policies:

• Google Firebase — authentication and identity management.
• PhonePe — payment processing.
• Google Maps — maps and project locations.
• Hostinger — email delivery.
• Meta Platforms, Inc. / WhatsApp LLC — WhatsApp Business Platform, for sending and receiving WhatsApp messages.

11. WhatsApp Communications

We use the WhatsApp Business Platform, provided by Meta Platforms, Inc. and WhatsApp LLC, to send project updates, reminders and notifications to clients, firm members and workers who have shared their phone number with us or with their firm.

What we process: your WhatsApp phone number, your WhatsApp profile name, the content of messages we send you and messages you send us, and delivery and read status.

Why: to share project status, attendance, payment and task updates, and to answer your questions. We do not use WhatsApp for advertising unless you have separately agreed to receive promotional messages.

Meta as service provider: Meta processes these messages on our behalf to deliver them, under the WhatsApp Business terms. Meta's handling of your data is described in the WhatsApp Privacy Policy.

Consent and opt-out: we message you only when you, or the firm you work with, have provided your number for this purpose. Reply STOP to any message to stop receiving WhatsApp updates. You can also ask us to delete this data — see our Data Deletion page.

Retention: WhatsApp message records are kept for as long as your account or the related project is active, then deleted within 30 days unless the law requires us to keep them longer.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will update the "Last updated" date and, for material changes, notify you via the Platform or by email. Continued use of the Platform after changes constitutes acceptance of the revised Policy.

13. Contact Us

For privacy-related queries, data access requests, or complaints:

• Company: Mahavijay Solutions Private Limited
• Address: H No-191, Behind Master Public School, Jairajpuri, Amausi, Sarojini Nagar, Lucknow, Uttar Pradesh 226008, India
• Email: support@meratheka.com
• Phone: +91 78803 23333
• Grievance Officer: Saurabh Singh Chauhan, Director — complaints are acknowledged within 48 hours and resolved within 15 days.

See also our Contact Us page.