Privacy Policy

1. 1Your organisation decides which business records to enter and which available workflows to use. UPGEAR handles those records to provide the service.
2. 2Customer databases are hosted on Microsoft Azure in India. Enabled AI and other integrations can process information outside India.
3. 3UPGEAR Mitra collects recurring location updates after Start Day, including in the background. There is no automatic stop at the end of a shift.
4. 4Photo Attendance uses server-hosted face matching. Its current access and participation limits are explained below.
5. 5Some records have automatic deletion periods; others currently require manual action. Subscription expiry blocks login but does not automatically delete records.

This policy covers the UPGEAR website, business platform, UPGEAR Mitra app, and our sales, billing and support interactions.

For enquiries, account administration, invoices issued by UPGEAR and our own communications, Upgear Technologies LLP determines how information is used.

For records entered into a customer's workspace, the customer organisation normally determines the purpose of processing. This includes information about its customers, technicians, employees, suppliers and service sites. UPGEAR handles these records on the organisation's behalf to operate, maintain and support the purchased service, subject to applicable law and the governing agreement.

The organisation must provide appropriate notices and establish a lawful basis for its use of personal information. Accepting a subscription does not give consent on behalf of every employee or other person in its records. UPGEAR remains responsible for its own processing and applicable obligations.

If your information is in an employer's or service provider's workspace, that organisation is usually the first contact for record access and correction. You may also contact our privacy contact, particularly if you cannot identify the organisation or your concern relates to UPGEAR's handling of information.

The information involved depends on the purchased modules, settings, permissions and records supplied. The following categories are not collected from every person.

Do not enter unnecessary sensitive information. Information sent to support should be limited to what is needed to understand the issue. Do not send passwords, OTPs or full payment-card details.

Location in UPGEAR Mitra

Recurring location collection begins when a technician taps Start Day. While that day remains active, the app collects location approximately every six minutes, including when the app is closed. Background collection requires the Android location permission Allow all the time; the app presents a disclosure before requesting it.

The recurring collection stops when the technician taps End Day, logs out or removes the location permission. If End Day is forgotten, collection can continue beyond the intended shift. There is currently no automatic shift-end cutoff.

Individual location points are also recorded for check-in, check-out and visit completion. Logging in through the website does not collect device location. Removing location permission can affect attendance, visit verification and route-related functions.

The customer organisation uses these records for field activity, attendance, visit verification and operational reporting. It must explain the tracking to its workforce and use the information lawfully. Device permission alone does not replace an employer's notice or other applicable requirements.

Photos, signatures and service evidence

Customer organisations can collect photographs, signatures and documents through service workflows. They must have an appropriate reason to collect them and avoid unnecessary images or information about other people at a site.

Photo Attendance and face matching

Photo Attendance is an optional, paid add-on enabled at company level. Without it, the normal Start Day attendance workflow uses time and location without an attendance photograph. Once the add-on is enabled, every employee in that organisation must take a photograph; an individual alternative is not currently available within that enabled workflow.

Face matching runs on models hosted on UPGEAR's Azure server in India, without an external face-recognition API. An attendance photo is compared with the employee's profile photo, and a numeric face template is stored against the user. If there is no profile photo, the first attendance photo becomes that profile photo. A failed match does not itself block attendance; it is sent for supervisor review.

Customer administrators who manage users can access profile photos and templates. Managers can view their team's attendance photos. The Attendance Photo dashboard currently has no separate permission gate: any signed-in user within the same customer organisation can open it. UPGEAR personnel with server access can also access the stored photos and templates.

Before enabling this workflow, the organisation must assess the lawful collection and use of biometric information, explain who can see the records, and address participation and accommodation requirements. The add-on's existence does not establish that it is appropriate for every workforce or jurisdiction.

External AI assistance

AI features can send information beyond the customer's database to the configured provider.

Provider retention and use differ. Google's Gemini terms distinguish paid and unpaid API services: unpaid services can use submitted content to improve products and models; paid services have different restrictions and still allow safety-related processing. Do not assume paid-service protections apply unless UPGEAR has confirmed the paid configuration for your deployment. We do not give a blanket no-training assurance across AI features. Do not submit confidential or personal information through an unpaid Gemini configuration.

Anthropic's commercial API policies generally exclude model training without permission and ordinarily remove API inputs and outputs within 30 days, with exceptions for particular features or models, safety enforcement, contractual arrangements and legal requirements. This is not a UPGEAR zero-retention agreement. See its commercial training policy, retention policy and API data arrangements.

DeepSeek's published privacy policy describes processing in China and uses that can include model improvement. We do not offer an API-specific no-training or fixed-retention assurance for DeepSeek. Its public policy does not resolve every detail of processing for a developer's downstream users.

Ask us which Assist provider and Gemini billing configuration apply before sending sensitive business or personal information. Do not assume that enabling one AI feature means every feature has the same provider or data terms.

UPGEAR's own Assist logs

Assist questions and answers are retained on UPGEAR's server without a fixed automatic deletion date. The user is represented by a code in these logs, and strings recognised as API-key shaped are masked. This does not anonymise the question, answer or business records within them, or guarantee that every secret is removed.

Face processing and OCR

Face matching uses the server-hosted process described above. PAN/Aadhaar and purchase-invoice OCR runs in the user's browser without an external OCR service. Extracted fields or files submitted to the workspace can subsequently be stored in the customer database or upload folder. Browser-based recognition does not mean the resulting business record stays only on the device.

Providers receive information needed for an enabled function. Some are selected and contracted directly by the customer; others support UPGEAR's service.

Only configured functions apply; the table does not mean every customer uses every provider. Ask us to identify the providers applicable to your workspace. Customer-selected providers also have their own agreements and privacy policies.

We do not sell personal information. We may disclose information where legally required, to respond to lawful authorities, or as necessary to establish or defend legal claims. If a business reorganisation affects personal information, applicable legal and contractual protections continue to apply.

Customer databases and server-hosted face processing are on Azure in India. This does not make the whole service India-only.

External processing includes Anthropic in the United States, DeepSeek in China, Google's global services, Photon in Germany, Nominatim in Europe, and the relevant messaging and push networks. Information sent through integrations may be handled in other countries under the applicable provider arrangements.

Transfers must meet applicable legal requirements and any restrictions in the governing customer agreement. This policy does not replace an existing requirement for written permission or provide retroactive consent for a transfer.

The current operational periods below describe live records. They are not a reason to retain information after its lawful purpose has ended. Where automatic deletion is absent, a request and manual review may be needed.

Daily backups are taken. A restoration exercise has not yet been performed, and we do not publish a fixed backup retention commitment. Do not assume that deleting a live record immediately removes every backup copy. We explain relevant backup and preservation limits when handling a deletion request.

Expiry is neither an immediate deletion request nor a promise of indefinite storage. Request exports and any deletion you need before the term ends where possible. Post-expiry export assistance requires contact with UPGEAR; there is no fixed automatic access window. Available formats and assistance are described in the Terms.

Current controls include HTTPS on customer sites, a separate database for each customer, role-based permissions, change history on key records, and attendance-photo storage outside the public web folder.

Customer databases share one Azure virtual machine; a separate database does not mean a separate physical server. UPGEAR personnel with server access can access tenant information for service administration and support.

Some integration credentials remain visible to users authorised to open the relevant settings. Product audit history can be modified by designated users and is not an immutable record. The special attendance-photo access limit is explained in section 3.

No system guarantees absolute security. The Trust page explains current controls, recovery limits and how to raise a security concern. This policy does not assert an independent security certification or audit.

You can contact us to request access or correction, ask for deletion, withdraw consent where processing relies on it, or raise a concern. The rights available, exceptions and responsible organisation depend on the applicable law and processing involved. Withdrawal does not invalidate earlier lawful processing and may affect a function that requires the information.

Email connect@upgearcrm.com with Privacy request or Privacy complaint in the subject. Our privacy and grievance contact is Vinnay Kulkarni. Include your contact details, the organisation involved and a brief description. Do not include unnecessary identity documents or confidential records in the first message.

We may request limited information to verify identity or authority and locate the relevant records. Where the customer organisation controls them, we coordinate with that organisation rather than disclosing another person's records without authority.

We respond within the period required by applicable law, including the one-month grievance period where the Indian sensitive-personal-data rules apply. If information must be retained or a request cannot be fulfilled, we explain the applicable reason and any available next step. Statutory complaint routes remain available.

Customer support operates Monday to Friday, 10 am to 6 pm IST. These hours do not change a legally required response or reporting deadline.

Cookies and communications

The website uses Google Analytics to understand website activity. It can use cookies and similar technologies for that purpose. You can manage cookies through your browser and review Google's information about partner-site data. Blocking cookies can affect website functions.

You can ask us to stop optional marketing communications using an available unsubscribe route or the contact email. Necessary subscription, billing and service communications may continue.

UPGEAR is a business service and is not intended for children to register or use independently. Customer organisations must assess any information about children or other third parties they enter; a business account does not remove applicable protections.

We update this policy when the described practices change and identify the review date. Material changes are communicated through an appropriate customer channel where required by law or contract. A revised notice does not remove the need for consent, instructions or contractual permission where those are required.

Questions about this page?

Upgear Technologies LLP · LLPIN ADA-7865 · Head office: Mumbai, Maharashtra · Registered office: 1560, Ayodhya Nagar, Kadgaon, Gadhinglaj, Kolhapur – 416502, Maharashtra, India