This Privacy Policy explains how SmartFacilityLabs Pvt Ltd ("SFL", "we", "our", "us") collects, uses, discloses, stores and protects personal data in connection with the SFL platform — our web applications, our control panel, our Android and iOS mobile applications, and our website at smartfacilitylabs.com (together, the "Platform").
It is written to comply with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 ("DPDP"), the Information Technology Act, 2000 and the rules made under it, and the Google Play Developer Program Policies.
Please read Section 2 carefully. It explains who is legally responsible for your data, which is different depending on who you are.
SmartFacilityLabs Pvt Ltd
HSR Layout, Bangalore, Karnataka 560102, India
Grievance Officer (as required under the DPDP Act and the IT Act):
Email: support@smartfacilitylabs.com
Phone: +91-7338662091
We acknowledge every grievance within 72 hours and aim to resolve it within 30 days.
General privacy queries: support@smartfacilitylabs.com
Under the DPDP Act, the entity that decides why and how personal data is processed is the Data Fiduciary. An entity that merely processes data on the Data Fiduciary's instructions is a Data Processor. Our role changes depending on who you are:
Your employer — the facility management company, property owner or association that engages you and subscribes to SFL — is the Data Fiduciary. They decide what is collected, why, for how long, and who sees it. They are also responsible for obtaining any consent required under employment law and for telling you what they will do with your data.
SFL acts as a Data Processor. We process your data only on your employer's documented instructions, under a written agreement with them. We do not decide the purposes of that processing, we do not use it for our own purposes, and we do not sell it.
If you want your data corrected or deleted, or you want to know why something is being collected, speak to your employer first. We will support them in responding to you. You may also contact our Grievance Officer, and we will route your request appropriately.
SFL is the Data Fiduciary. We decide why and how we process your data, and you may exercise all your rights (Section 9) directly with us.
We collect only what the Platform needs to function. We do not collect data for advertising, and we do not build behavioural profiles for marketing.
Two categories of data we handle deserve special attention, and we treat them with heightened care.
What we do: The app captures a photograph of your face when you mark attendance. It is stored against that attendance record and shown to your supervisor so they can confirm attendance was marked by the right person.
What we do not do: Except where expressly stated below, we do not run automated facial recognition, we do not generate a mathematical face template or faceprint, we do not match your face against any database, and we do not use your image to identify you anywhere else.
If your employer enables automated facial recognition attendance (a feature some customers use in place of, or alongside, the selfie), then a mathematical representation of your face is generated and compared against a stored template in order to identify you. This constitutes biometric data. Where this feature is enabled:
If you are not sure whether facial recognition is enabled for you, ask your employer, or contact our Grievance Officer and we will tell you.
If you use the voice messaging feature in the in-app chat, your recording is converted to text (and, where you have selected a different reading language, translated) so that colleagues who speak other languages can understand you. Processing is carried out by a speech-processing provider under contract to us. Recordings are used only to produce the message you sent, are not used to train any model without a separate agreement, and are retained in accordance with Section 8.
Some SFL customers enable route tracking for staff who travel between multiple sites during their working day — field officers, auditors, supervisors and area managers. This section is written to be read on its own, and it is the disclosure we present to you in the app before tracking begins.
GPS coordinates (latitude, longitude and accuracy), together with the time of each reading, the battery level of your device, and whether the device was moving. Readings are taken periodically — typically every one to five minutes — while tracking is active.
Field officers keep their phone in a pocket or bag while travelling between sites, with the screen off and the app closed. If the app could only read your location while it was open on screen, the recorded route would have a gap every time you locked your phone, and the feature would not work. Access to location in the background is therefore necessary for this feature to function at all.
Your location readings are used to construct a record of your working day: the places you stopped, when you arrived and left, and how long you stayed. Where a stop falls within a site your employer has registered, it is labelled with that site's name. Where it does not, it may be labelled using a mapping service, or left as an unnamed location with coordinates only.
Your route is visible to authorised managers within your employer's organisation, for operational oversight. You can see your own route in the app. It is not visible to other employers, to other customers of SFL, or to the public.
If tracking is not recording — because location is switched off, permission has been withdrawn, or your device has stopped the app — the app tells you so on screen, and the gap is shown honestly to your manager as a period with no data. We do not present an incomplete route as though it were complete.
Route tracking is a feature your employer chooses to enable. Any question about whether you are required to use it, and any consequence of declining, is a matter between you and your employer under your contract of employment and applicable labour law. SFL does not make that decision and cannot answer it for you. We provide the technical means to decline, and we record honestly when tracking is off.
| Purpose | Data used | Basis |
|---|---|---|
| Operating the Platform for your employer | Identity, attendance, operational | Employment / contract, on your employer's instruction |
| Recording attendance and calculating pay | Attendance, selfie, punch location | Employment / legitimate use |
| Route tracking | Background location | Your consent, given in the app |
| Facial recognition attendance (where enabled) | Biometric face template | Your separate explicit consent |
| Reporting and analytics for your employer | Operational, attendance | Employer's instruction |
| Security, fraud prevention, audit trails | Device, technical, logs | Legitimate use / legal obligation |
| Sales, demos, marketing | Website enquiry data | Your consent |
We do not use your data for any purpose beyond those listed above without telling you first and, where required, obtaining fresh consent.
We do not sell personal data. We have never sold personal data. We do not share personal data with advertisers or data brokers.
We disclose personal data only as follows:
Personal data is primarily stored and processed in India. Some sub-processors — in particular certain AI model providers — process data outside India. Where this occurs, we transfer only what is necessary, under contractual safeguards, and in accordance with Section 16 of the DPDP Act. We do not transfer data to any country that the Central Government has restricted.
We retain personal data only for as long as it is needed for the purpose it was collected for, or for as long as your employer instructs us to, or as required by law — whichever is longer.
When your employer's account with us is terminated, we return or delete their data in accordance with our agreement with them.
Under the DPDP Act you have the following rights. If SFL is the Data Fiduciary (Section 2.2), exercise them with us directly. If your employer is the Data Fiduciary (Section 2.1), address them to your employer — and if you cannot get a response, contact our Grievance Officer and we will help.
We will respond to any verified request within 30 days.
We implement reasonable security safeguards appropriate to the sensitivity of the data, including:
No system is perfectly secure, and we do not claim otherwise. In the event of a personal data breach, we will notify the affected individuals and the Data Protection Board of India in the form and within the timelines required by the DPDP Rules, and we will notify CERT-In where required.
The Platform is a workplace tool and is not directed at children. We do not knowingly collect personal data of any individual under 18 years of age. If we become aware that we have done so, we will delete it. Where a customer's operations may involve individuals under 18, that customer is responsible for obtaining verifiable parental consent as required under the DPDP Act, and must tell us in advance.
Our website uses essential cookies necessary for the site to function, and analytics cookies to understand how the site is used. You can control cookies through your browser settings. Our mobile applications do not use advertising identifiers and contain no advertising SDKs.
The Platform generates AI-assisted summaries, reports, alerts and insights from facility and operational data. These are decision-support tools presented to human managers. SFL does not make automated decisions about your employment, pay or discipline. Any such decision is made by your employer, by a person, and any question about it should be raised with them.
We may update this Policy. Where a change is material — in particular, where we begin collecting a new category of data or processing it for a new purpose — we will notify affected users in the app or by email, and, where the law requires it, seek fresh consent before the change takes effect. The version number and date at the top of this page always reflect the current version.
SmartFacilityLabs Pvt Ltd
HSR Layout, Bangalore, Karnataka 560102, India
Privacy queries: support@smartfacilitylabs.com
Grievance Officer: support@smartfacilitylabs.com
Phone: +91-7338662091
If you are not satisfied with our response, you have the right to complain to the Data Protection Board of India.