Privacy Policy
Effective 30 September 2026 · Beta 0.9
In short
This app is for Ritwik Finance staff to record field trips and claim travel reimbursement. We collect only what that needs: your work profile, your location while a trip is running, odometer and visit photos, the customers you visit and your claims. We don't sell data, show ads or use tracking cookies. You can see your data, ask us to correct it and raise a grievance at any time.1. Who we are
Ritwik Finance (“we”) is the Data Fiduciary for personal data processed in Ritwik Finance Field Operations (“the app”), under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The app is an internal tool. Only employees and managers added by an administrator can sign in.
2. What we collect and why
| Data | Why we need it | Where it comes from |
|---|---|---|
| Name, work email, employee ID, designation, branch, reporting managers | Sign-in, routing claims to the right approver, reports | Your administrator |
| Vehicle registration, make, model and type | Applying the correct per-km rate | Your administrator |
| GPS location (latitude, longitude, accuracy, time) — only during an active trip | Measuring the distance travelled; verifying trip start, end and visits | Your phone, after you allow location access |
| Odometer photos with a geo-stamp, and the km reading | Proof of distance; cross-checking the GPS distance | You, using the in-app camera |
| Customer visits: customer name, mobile number, remarks, location photo | Proof of field work | You, at the customer location |
| Expense claims (food, toll, parking, other): amount, merchant, date, receipt photo | Reimbursing expenses | You |
| Travel claims without a trip (bus, train, cab): from/to, date, amount, purpose, ticket/PNR number, ticket photos or PDFs | Reimbursing travel | You |
| Bank name, account number, IFSC | Paying approved amounts from your wallet | You or your administrator |
| Approvals, remarks, wallet ledger, payouts | Running and auditing reimbursement | Generated by the app |
| Problem reports and ideas you send (message, screen, linked trip, device type) | Fixing problems and improving the app | You, via “Report a problem” |
| Sign-in records, IP address, browser/device type, security audit log | Keeping accounts secure; investigating misuse | Generated by the app |
We don't collect your location when no trip is active, and we don't read contacts, messages, files or other apps on your phone.
3. Legal basis
We process employee data for employment purposes, which the DPDP Act treats as a legitimate use (Section 7(i)). Location access is also controlled by you through your phone's permission prompt, and tracking only runs after you tap Start trip. Customer details you record are processed for the legitimate purpose of verifying field visits. Only record what the visit requires.
4. Automated checks (AI)
When you photograph an odometer, the image is sent to Google's Gemini AI on Vertex AI, in Google Cloud's Mumbai region, to suggest the km reading and check that the photo shows an odometer. Google processes the photo in India only to answer and does not use it to train its models. The result is advice only. You confirm the reading, and a human approver makes every decision. Approvers can see when the AI reading and your reading differ.
5. Who we share data with
Inside Ritwik Finance: your reporting managers (RM1/RM2) and administrators, only as far as their role needs. Outside, we use these service providers (“Data Processors”) under contract:
| Provider | What it receives | Purpose | Where |
|---|---|---|---|
| Google Cloud (hosting, database, file storage) | All app data, photos and receipts, encrypted in transit and at rest | Running the app | India (Mumbai) |
| Google Vertex AI (Gemini) | Odometer photos | Suggesting the km reading (see section 4) | India (Mumbai) |
| Mailgun (Sinch) | Your email address and one-time sign-in codes | Sending sign-in codes and notifications | United States |
| Google Maps Platform | Map display requests; trip GPS points when road-snapping is on | Showing routes and measuring road distance | Google servers, may be outside India |
| Sentry (Functional Software, Inc.) | Technical error reports: error message, the screen or API route, browser/device type and a code stack trace. No request contents, cookies, IP addresses or your personal details | Finding and fixing bugs | United States |
Some providers may process data outside India. We only transfer data to countries the Government of India has not restricted. We never sell personal data or use it for advertising.
6. How long we keep it
We keep data only as long as needed for its purpose and for the periods Indian law requires, for example 8 years for financial records under the Companies Act, 2013. See Data We Store & Retention for each category.
7. Security
- HTTPS everywhere; photos are stored privately and opened only through short-lived signed links.
- Passwordless sign-in with one-time email codes; sessions end after inactivity and can be revoked.
- Role-based access: employees see their own data, approvers see the people they approve for, administrators see everything.
- Money records and the audit log are append-only in the database. Nobody can quietly edit them.
If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Rules require.
8. Your rights
- Access: see a summary of your data and how it is processed. Most of it is visible in the app (Trips, Wallet, Profile).
- Correction and erasure: ask us to correct inaccurate data. You can also ask us to erase data we no longer need, unless the law requires us to keep it.
- Withdraw consent: where we rely on consent (e.g. location permission), you can withdraw it in your phone's settings at any time. Trips can't be tracked without it.
- Nominate: name someone to exercise your rights if you die or become incapacitated.
- Grievance: complain to our Grievance Officer. If you're not satisfied, you can complain to the Data Protection Board of India.
9. Contact
- Grievance Officer: Grievance Officer — TO BE CONFIRMED
- Email: privacy@ritwikfinance.com (we respond within 30 days)
- Company: Ritwik Finance, Registered office address — TO BE CONFIRMED
10. Changes
While the app is in beta, this policy may change more often. We'll show a notice in the app when anything important changes.