Privacy Policy

ProofIt is a mobile application developed and operated by BHive Technologies, a company registered in India. ProofIt helps contractors, business owners, and field service teams capture GPS-stamped before/after photos of completed jobs and share work completion reports to customers.

This Privacy Policy explains how BHive Technologies collects, uses, stores, and protects your personal information when you use the ProofIt app (Android and iOS) and website (proofit.in).

By using ProofIt, you agree to the practices described in this policy. If you do not agree, please do not use the app.

We collect the minimum data necessary to operate ProofIt. Here is exactly what we collect and why:

We use your data solely to provide and improve the ProofIt service:

• Authenticate your identity through Google Sign-In and maintain your logged-in session
• Display your work reports, job assignments and attendance history in the app
• Stamp GPS coordinates, timestamp, your name and job title permanently into work photos
• Show your organisation's owner your real-time location on the live map (staff role only)
• Generate PDF work completion reports that owners can share with customers
• Send push notifications about new job assignments, report submissions and account alerts
• Calculate and display working hours, job streaks and performance statistics
• Detect fraudulent GPS locations and flag suspicious reports to protect owners
• Manage subscription plans and payment status
• Provide customer support when you contact us

ProofIt uses Google Sign-In for authentication and Google Drive for photo storage. This is important to understand:

Google Sign-In: When you sign in with Google, we receive your name, email address, profile photo URL and a unique Google ID. We do not receive your Google password. Your Google account credentials are managed entirely by Google. We store only the information Google provides us and a session token for your ProofIt account.

Google Drive: Photos taken in the ProofIt app are uploaded to your personal Google Drive account — not to our servers. Specifically:

• Photos are saved under a folder called ProofIt in your Google Drive
• The folder structure is: ProofIt → Organisation Name → Date → photo files
• We store only the Google Drive file ID in our database — not the photo itself
• When you view photos in the app, the app fetches them from Google Drive using your authenticated session
• When generating PDF reports, our backend uses a service account to read the photos from Drive temporarily for PDF creation only
• We do not retain copies of your photos on our servers

You can revoke ProofIt's access to your Google account at any time by visiting myaccount.google.com/permissions. Revoking access will log you out of ProofIt and may affect app functionality.

ProofIt uses your device's GPS for two purposes:

Photo stamping: When you take a before/after photo in the app, we capture your GPS coordinates at the exact moment of capture. This location data is permanently burned into the photo pixels as a visible watermark. It is also stored with the work report in our database. This is the core feature of ProofIt — the proof of where work was done.

Live location (staff only): While you are checked in and the app is open or running in the background, your location is shared with your organisation's owner in real time. This shows your pin on the owner's live map. Location sharing stops when you check out or close the app.

Check-in/check-out: When you check in or check out, your GPS location is recorded and stored as an attendance record accessible to your owner.

We do not share your location data with any third parties outside of your organisation. We do not use location data for advertising or profiling.

On Android, the app requests ACCESS_FINE_LOCATION and ACCESS_BACKGROUND_LOCATION permissions. On iOS, it requests Location When In Use and Location Always permissions. You can manage these in your device settings.

Every photo taken through ProofIt contains:

• Date and time of capture
• GPS address and coordinates
• Staff member's name
• Job title
• ProofIt watermark

This data is permanently embedded in the image pixels and cannot be removed by editing the photo. This is intentional — it is what makes ProofIt reports tamper-proof.

Work reports (job title, notes, GPS address, submission time, before/after photo file IDs) are stored in our database and are accessible to:

• The staff member who submitted the report
• The owner of the organisation the staff member belongs to
• BHive Technologies engineers for support purposes only (subject to strict internal access controls)

When an owner exports a PDF and shares it with a customer, the customer receives only the PDF file. The customer does not get access to the app, your account, or any other data.

We share your data with the following third-party services that are essential to operate ProofIt. We do not sell your data to anyone.

We may also disclose your data if required by law, court order, or government authority in India. We will notify you of such requests where legally permitted to do so.

ProofIt's backend servers are hosted on Hostinger KVM2 servers located in India. Our database (MongoDB) is secured with authentication and bound to localhost — it is not directly accessible from the internet.

We implement the following security measures:

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
• JWT tokens with 30-day expiry are used for session management
• API rate limiting prevents brute force attacks
• Nginx reverse proxy with strict security headers
• MongoDB access restricted to localhost only — no external database access
• Regular automated backups stored securely
• Strict internal access controls — only authorised engineers can access production data

Photos are stored in your Google Drive account — Google's security infrastructure protects your photos. We do not store photos on our servers.

We retain your data for as long as your account is active or as needed to provide the service. Specific retention periods:

When you delete your account, all personal data linked to your account (name, email, GPS records, reports, attendance) is permanently deleted from our servers within 30 days. Payment records required by law are retained for 7 years but are not linked to your identity after account deletion.

You have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@proofit.in:

• Right to access: Request a copy of all personal data we hold about you
• Right to correction: Request correction of inaccurate or incomplete data
• Right to deletion: Request deletion of your account and all associated personal data (except legally required financial records)
• Right to data portability: Request your work reports and attendance records in a machine-readable format (JSON or CSV)
• Right to restrict processing: Request that we stop using your data for certain purposes while retaining it
• Right to object: Object to any use of your data that you believe is not lawful or necessary
• Right to withdraw consent: Revoke Google Drive access at any time via Google account settings

We will respond to all privacy requests within 30 days. If we cannot fulfill a request, we will explain why.

ProofIt is designed for business use by working adults. The app is not intended for use by anyone under the age of 18.

We do not knowingly collect personal information from children under 18. If you believe a child under 18 has created a ProofIt account, please contact us at privacy@proofit.in and we will delete the account and all associated data immediately.

ProofIt uses Firebase Cloud Messaging (FCM) to send push notifications to your device. The types of notifications we send:

• New job assigned to you (staff)
• New work report submitted by staff (owner)
• Flagged location report alert (owner)
• Draft report reminder at 6 PM if unsent (staff)
• Subscription plan expiry warnings (owner)
• Broadcast messages from your organisation owner (staff)

You can disable push notifications at any time through your device settings (Android: Settings → Apps → ProofIt → Notifications; iOS: Settings → ProofIt → Notifications). Disabling notifications will not affect your ability to use the app.

We do not send marketing push notifications. All notifications are strictly operational — related to your work activity in the app.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes:

• We will update the "Last Updated" date at the top of this page
• We will send a push notification to all app users informing them of the update
• For material changes that affect how we use your data, we will request your acknowledgement before you can continue using the app

Your continued use of ProofIt after any changes to this policy constitutes your acceptance of the updated terms. If you do not agree to the updated policy, you may delete your account as described in Section 10.

We recommend reviewing this policy periodically. You can always find the most current version at proofit.in/privacy.

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

We aim to respond to all privacy requests within 30 days. For urgent data breach concerns, we will respond within 72 hours.