1. What we collect
Account details (name, email, WhatsApp number), your company's business data (leads, orders, payments, product catalogue), and — for salesman accounts during active working sessions only — GPS location and in-app camera photos attached to visit logs. Location is never captured outside field sessions and is visible only to the workspace owner and the salesman's own manager.
2. How we use it
Solely to run the service: routing and navigation, visit verification, order PDF generation, commission calculation and WhatsApp notifications (OTP, order shares, payment alerts). We never sell personal data, never show ads, and never use your business data to train models or share it across tenants.
3. Storage & security
Data is stored encrypted at rest in the ap-south-1 (Mumbai) region and moves only over TLS. Visit photos and PDFs live in access-controlled object storage behind signed, expiring URLs. Access inside our team is role-restricted and audit-logged.
4. Third parties
We share the minimum data needed with: payment gateways (Razorpay, Cashfree, Stripe, PayPal) for billing; the WhatsApp Business API for messages you trigger; and Google Maps for routing and geocoding. Each processor is bound by its own data-protection agreement.
5. Employee location & consent
Location tracking of salesmen is a tenant-controlled feature. Obtaining employee consent as required by local employment law is the workspace owner's responsibility; we surface in-app notices so every salesman knows when a field session is active.
6. Retention & deletion
Business data is retained while your workspace is active and for 30 days after cancellation, then permanently deleted. Individual users may request account deletion anytime (30-day grace, OTP-confirmed); owners can export or permanently delete the whole workspace from Settings.
7. Your rights
Access, correction, export and erasure — write to legal@salesmantracker.com from your registered email. We respond within 7 working days. Indian users are covered under the DPDP Act 2023; EU users under GDPR.