Privacy Policy

Vaptech Softwares Pvt Ltd ("VAP", "we", "us") builds VAP ERP: business software that grows with you, from a small team to a very large organisation, in hospitals, schools, IT companies, factories and more. We bring the discipline of mission-critical engineering to everyday operations, so the systems you depend on stay reliable and your data stays yours.

This policy covers our website (vaperp.com) and the VAP ERP mobile app. In the app and in your workspace, your organisation decides what is collected and why; we process that information on its behalf, to run the service. Where this policy says "your organisation", that is the company, hospital, school, factory or other body that gave you an account.

When you create a workspace, apply for a job, register interest or contact support, we collect what you type into the form: your name, email address, phone number, company details and your message. We keep technical records such as your IP address and browser type to keep the site secure and working.

What is collected depends on what your organisation has turned on for you and what you choose to do in the app:

• Your account: your email address and password to sign in. Sign-in tokens are kept in your phone's secure storage.
• A random install number the app creates for itself, used to recognise that session and, for inventory staff, to pair a label device. It is not your advertising ID and does not identify you outside VAP ERP.
• Parents and guardians: photos and PDF files you choose to send for your child's school records, and the result of checking an Aadhaar Secure QR code (see below).
• Staff: the work you do in the app, such as stock movements and codes you scan, attendance check-ins and check-outs, leave requests and missed-punch requests.
• Your organisation's own records that you are allowed to see, such as an employee or student record, a notice or an inventory list. The app shows them to you; it does not make them public.

The app asks for location permission only for attendance. When you tap Check in or Check out, after an explanation on screen, it reads your position once and sends the coordinates, how accurate they are, the time, and whether Android says the location was faked. Our server compares that to your workplace boundary and decides whether the punch counts; the app only shows you the server's answer.

We never read your location in the background or continuously, and we do not use it for advertising. The app does not keep your coordinates on your phone or in its logs. The attendance record that your organisation's HR team can see includes the coordinates and the outcome.

The camera is used only when you open a scanner (inventory codes, or the Aadhaar Secure QR code) or take a photo to send as a document. The app asks for access at that moment. Photos and files are used only when you pick or take them, and are sent to your organisation's workspace, where its authorised staff can review them.

Aadhaar: if you scan the QR code printed on an Aadhaar letter or card, the app sends the code to our server, which checks UIDAI's digital signature. We keep only the last four digits of the number and the fact that it was checked. The name in the code is compared with the student's name and then discarded; the photo, address and date of birth are never read or kept. Families can instead send a masked copy for the school to review.

We use information to provide and secure the service, to do what your organisation asks of it (for example record attendance, hold student documents or manage stock), to answer support requests, and to improve and fix the product. We do not sell your information, and the app contains no advertising and no third-party analytics or tracking tools.

Information in a workspace is visible to people your organisation has given access, according to their role. Other organisations cannot see it. Our own staff may access it only to provide support or keep the service running.

We share information only with service providers that host and deliver VAP ERP on our behalf (cloud hosting in India and network delivery), under the same duty to protect it, or where the law requires it. If our business is ever sold or merged, the information moves with the service under this same protection.

Traffic between the app and our servers is encrypted. Each organisation's data is kept separate from others', access is checked on the server for every request, and sign-in tokens live in secure storage on your phone. No system is perfectly secure, so we also limit what we collect and tell the affected organisation if we find a breach.

Your organisation decides how long its records are kept, and we hold them for as long as its account is active. When an organisation closes its account, or asks us to delete data, we delete or return it. To have your own information corrected or deleted, ask your school or employer first, or write to us at privacy@vaperp.com and we will act on it with them. Information we are legally required to keep is kept only for that period.

The app is for parents, guardians and staff, not for children. A school may hold information about its students, which is provided and managed by the school and by parents or guardians on the child's behalf. We do not knowingly collect information directly from children.

You can turn off the app's camera or location permission at any time in your phone's settings; the features that need them will then not work. Under Indian law, including the Digital Personal Data Protection Act, 2023, you may ask to access, correct or delete your personal data and withdraw consent, and you may complain about how it is handled. Use the contact below and we will respond within a reasonable time.

If we change this policy in a way that matters, we will update the date above and, for the app, say so in the release notes.