Legal

Privacy Policy

Effective date: 31 August 2026

Applies to the VSquare ERP web application (erp.vsquareinfra.com) and the VSquare ERP Android application (package com.vsquare.erp).

1. Who we are

VSquare ERP is an internal enterprise resource planning platform operated by V Square Infra (“we”, “us”, “our”). The application is provided to employees, contractors, project managers and authorised site personnel of V Square Infra and its client projects to manage day-to-day construction site operations, stock, procurement, daily progress reports (DPRs) and billing.

VSquare ERP is not a consumer product. Accounts are created only by administrators; there is no public sign-up.

2. Information we collect

2.1 Information you provide

  • Account details: employee ID, full name, mobile number, email address, role (Admin, Project Manager, QS, Store, Site Engineer, Contractor, etc.) and assigned project(s). Provided by your organisation’s admin.
  • Authentication credentials: a password you set. We store only a bcrypt hash — never the plain-text password.
  • Operational data you enter: daily progress reports (pipeline, manhole, machine hole, HSC, rectification), material requests, dispatch and receive entries, stock counts, procurement orders, QS sheets, contractor bills and remarks.

2.2 Information collected from the device

  • Camera / photos: the app captures site photographs that you attach to DPRs, material receipts, dispatches and image gallery entries. Photos are uploaded only when you submit the associated form. We do not scan your device gallery in the background.
  • Approximate / precise location: collected in two situations, and only these two:
    • Single-fix tagging — when you tag a site check-in, geo-locate an on-site entry, or attach location metadata to a submission. One location reading is taken at the moment you submit the form.
    • Live delivery-journey tracking (drivers only) — when you have accepted an active delivery in the app, VSquare ERP shares your device’s GPS position (latitude, longitude, accuracy, speed and timestamp) with your organisation’s dispatch and project-management team so the vehicle can be shown on the live fleet map, compared against the planned route, and matched against depot / site geofences. Fixes are sampled roughly every 10 seconds while the vehicle is moving and every 45 seconds while it is stationary. Tracking runs as an Android foreground service, so it continues while the app is in the background or your phone is locked — an ongoing “Delivery tracking active” notification is displayed on your device for the entire duration. Recording starts only when a delivery has been assigned to you and you accept it, and stops automatically the moment the delivery is submitted as complete, cancelled, closed by dispatch, or you sign out. Location is not collected outside of an active delivery, and non-driver roles are never tracked.
  • Device identifiers & push token: a Firebase Cloud Messaging (FCM) registration token so we can deliver in-app notifications (approvals, stock alerts, assignments) to your specific device.
  • Diagnostic data: non-personal error logs, HTTP status codes and timing data used to debug outages and improve reliability.

2.3 Information we do NOT collect

  • Contacts, SMS, call logs, or microphone audio.
  • Health, financial (card / UPI), or biometric data.
  • Advertising identifiers — the app carries no ads.
  • Browsing history outside the application.

3. How we use your information

  • Authenticate you and enforce role-based access control.
  • Record and attribute operational entries (DPRs, dispatches, stock movements, approvals) to the correct user, project and timestamp.
  • Send transactional push notifications about work assigned to you or awaiting your approval.
  • Show the live position of vehicles on active deliveries to your organisation’s dispatch team and project managers, alert on route deviations and geofence entries/exits, and produce planned-vs-actual trip reports for those journeys.
  • Maintain audit trails required by internal governance and client reporting obligations.
  • Detect abuse, debug failures, and improve system reliability and security.

We do not sell your data, and we do not use it for advertising or profiling.

4. Legal basis

We process personal data on the basis of (a) the employment or contractual relationship between you and V Square Infra or the project you are assigned to; (b) our legitimate business interests in operating and securing the platform; and (c) compliance with applicable law (including audit and tax record-keeping obligations).

5. Sharing and disclosure

Your data is shared only with:

  • Authorised personnel of V Square Infra and the specific project(s) you are assigned to, on a role-based need-to-know basis.
  • Infrastructure sub-processors that host or transmit the data on our behalf:
    • Microsoft Azure — application & database hosting (region: India).
    • Google Firebase Cloud Messaging — delivery of push notifications to Android devices.
    • Google Play Services — Android app distribution and integrity checks.
  • Government or law-enforcement authorities when we are legally required to disclose (e.g. valid court order).

We do not sell, rent, or trade personal data to third parties.

6. Data security

  • Transport encryption (HTTPS / TLS) for all traffic.
  • Passwords stored only as bcrypt hashes.
  • Role- and project-scoped access enforced on every API request.
  • Short-lived JWT sessions (1 hour expiry with 30-minute refresh) delivered via HTTP-only cookies.
  • CSRF, rate-limiting and content-security-policy protections on write endpoints.
  • Encrypted backups of the operational database.

No system is perfectly secure. If you suspect a breach or a compromised account, contact us immediately at infodesk@vsquareinfra.com.

7. Data retention

Operational records (DPRs, stock ledgers, procurement, billing) are retained for the life of the project plus the period required for audit, tax and statutory compliance under Indian law — typically not less than eight (8) years.

Account credentials are retained while your account is active. Deactivated accounts are archived; the login is disabled immediately, but the identifying fields are preserved so that historical entries remain attributable in the audit trail.

Diagnostic logs are rotated automatically and retained for a maximum of 90 days.

Delivery-journey location traces are retained alongside the dispatch record they belong to, for the same operational and audit lifecycle described above. Low-accuracy or duplicate GPS fixes are discarded at ingest and are never stored.

8. Your rights

Subject to applicable law, you may:

  • Request a copy of the personal data we hold about you.
  • Request correction of inaccurate personal data.
  • Request deletion of your account and personal data, subject to the retention obligations described in Section 7 (audit records tied to project work cannot be deleted until their statutory retention period expires; they can be de-linked from your identifiers).
  • Withdraw consent to push notifications at any time.
  • Raise a complaint with the applicable data-protection authority.

To exercise any of these rights, email infodesk@vsquareinfra.com from the address on file with your organisation. We aim to respond within 30 days.

9. Permissions used by the Android app

  • CAMERA — capture site photographs for DPRs, stock receipts and dispatches.
  • ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION — tag on-site check-ins, geo-locate site entries at the moment of submission, and — for drivers only — share the vehicle’s live GPS position while an accepted delivery is in progress.
  • ACCESS_BACKGROUND_LOCATION — allows the delivery-journey tracker to keep sending GPS updates while the app is in the background or the phone is locked, for the duration of an active delivery only. Not used at any other time and never used for non-driver roles.
  • FOREGROUND_SERVICE / FOREGROUND_SERVICE_LOCATION — required by Android to run the delivery-tracking foreground service. While tracking is active, a persistent notification is shown on your device for the entire duration.
  • READ_MEDIA_IMAGES / storage — allow you to attach existing photos from your device to a submission.
  • POST_NOTIFICATIONS — display push notifications for approvals, assignments and stock alerts.
  • INTERNET / ACCESS_NETWORK_STATE — communicate with the VSquare ERP server and handle offline behaviour.

You may revoke any of these permissions at any time from your device Settings; the corresponding feature will stop working until the permission is granted again.

10. Children's privacy

VSquare ERP is intended solely for adult professional users (18 years or older). We do not knowingly collect personal data from children.

11. International transfers

Data is hosted in India. Push-notification metadata may transit through Google’s global infrastructure for delivery. Where data is transferred outside your country, we rely on the sub- processor’s standard contractual safeguards.

12. Changes to this policy

We may update this policy from time to time. The “Effective date” above always reflects the current version. Material changes will be communicated in-app or by email to registered users.

13. Contact

V Square Infra
67/77, Sarvamangala Colony,
Ashoka Colony, Ashok Nagar,
Chennai — 600 083,
Tamil Nadu, India
Email: infodesk@vsquareinfra.com