Privacy Policy

1. Who this policy covers

Staff app users — municipal employees onboarded by PCMC to use the app as part of their employment: sanitation workers, drivers, Sanitary Inspectors, Zonal Heads, Commissioners, and administrators.

Citizen app users — members of the public who register with a phone number to report complaints, view nearby sanitation vehicles, and track municipal cleaning activity.

2. Information we collect

Account & identity information

Staff app: full name, username, phone number, email (optional), employee ID, designation, and assigned ward/zone.

Citizen app: phone number (used as your login identity) and full name, collected on first sign-in.

Authentication data

Staff passwords are stored as an irreversible cryptographic hash — we never store or can see your actual password. Both apps use one-time passcodes (OTPs) sent by SMS to verify your phone number during login or password recovery; codes are short-lived, single-use, and hashed at rest, never stored in plain text.

Biometric data — Staff app only

For attendance verification, the Staff app captures facial images and derived facial-recognition data ("face embeddings") for enrolled employees, captured during a supervisor-administered enrollment process and used to confirm identity at check-in.

• Enrollment is administered by a supervisor — it is not self-service.
• Encrypted at rest before storage.
• Processed entirely on our own servers — facial data is never sent to a third-party facial-recognition service.
• The enrollment reference photo is retained for up to 730 days (2 years) specifically so embeddings can be regenerated if our recognition model is upgraded. When an employee's enrollment is deactivated, their embeddings and profile are permanently deleted within 730 days.

We treat this as sensitive personal data and apply additional access controls and tamper-evident audit logging to it, beyond what applies to other app data.

Location data

Staff app: GPS coordinates recorded during supervisor-mediated attendance check-in, vehicle/route tracking, and while photographing cleaning or inspection proof, to confirm work was performed at the correct site.

Citizen app: your approximate location, used with your permission to show nearby sanitation vehicles and toilet facilities, and to auto-fill your complaint's location.

Photos & content you or staff submit

Cleaning proof photos, toilet/road inspection photos, and employee profile photos (Staff app); photos and descriptions submitted with a complaint (Citizen app).

Device & usage information

Push notification tokens, if enabled; app action logs retained for security and audit purposes; and standard technical data (IP address, device/OS type, app version) for security and diagnostics.

3. How we use your information

• Authenticate you and maintain your session
• Operate core functionality: attendance, cleaning/inspection workflows, vehicle tracking, and complaint handling
• Verify staff identity during field work, to keep public-service delivery accountable
• Send login and account-recovery OTPs
• Maintain audit trails required for municipal oversight
• Diagnose and fix technical issues
• Comply with applicable law and lawful requests from public authorities

We do not use your data for advertising, and we do not sell personal data.

4. Who we share information with

We share limited data with service providers, solely to operate the app:

We may also disclose information where required by law, or to protect the rights, safety, or property of PCMC, our users, or the public. Biometric data is shared only with our storage provider, strictly for encrypted storage — never with any of the other categories above.

5. Data security

• Biometric data encrypted at rest
• Passwords and OTP codes stored only as hashes, never in readable form
• Access scoped to what each staff role needs — e.g. a ward supervisor cannot see another ward's data
• Audit logging of sensitive actions, with tamper-evident records for biometric events
• Rate limiting on authentication and OTP requests to reduce abuse

No system is 100% secure, and we cannot guarantee absolute security — but given the sensitivity of biometric and location data here, we treat these as first-class obligations, not afterthoughts.

6. Data retention

• Account data: retained while your account is active, and briefly after for legal/audit purposes.
• Biometric data: enrollment photo up to 730 days; embeddings hard-deleted within 730 days of deactivation.
• OTP codes: expire within minutes and are not retained beyond validity.
• Location data: retained as part of attendance, cleaning-proof, and complaint records for audit and service-quality purposes.
• Complaint photos/content: retained for the life of the complaint record and any associated municipal reporting requirements.

7. Your rights and choices

Citizens may request access to, correction of, or deletion of their data by contacting us below. Deleting your account removes your ability to sign in; some records tied to municipal recordkeeping may be retained as permitted by law.

Staff accounts and biometric enrollment are administered by PCMC as part of employment — direct questions to your administrator, or to us below.

Location and notification permissions can be turned off at any time in your device settings; some features will not function without them.

8. Children's privacy

The Staff app is for PCMC employees only. The Citizen app is intended for general public use and is not directed at children under 18; we do not knowingly collect data from children. If you believe a child has provided us data, contact us below and we will act on it.

9. Changes to this policy

We may update this policy as the platform evolves. We'll update the date at the top when we do, and for material changes, provide notice within the app.