Privacy Policy
This Privacy Policy explains how Litair Technologies collects, uses, stores, and protects personal information when you use the Litair Management mobile application (Package ID: com.litair.management) and associated workforce web platforms.
Encrypted at Rest
Phone numbers & sensitive identifiers are encrypted with AES-256 and blind-indexed.
No Background Tracking
Location is only checked on-demand when you explicitly clock in or out for work.
Internal Company Use
We never sell or rent user data to third-party advertisers or data brokers.
Account Deletion
Simple, transparent account and personal data deletion requests upon verification.
1. Overview & Scope of Application
Litair Management is an internal workforce operations and enterprise resource management application designed exclusively for authorized employees, contractors, plant managers, and field staff of Litair Technologies.
This application facilitates company communication, attendance logging, work schedules, manufacturing plant inspections, task assignments, document sharing, and expense management. This policy governs how information is handled across the Android mobile application, web dashboard, and server infrastructure.
2. Information We Collect
We only collect information strictly necessary to provide workforce management services and verify corporate operational compliance:
A. Personal & Account Identifiers
- Full Name, Username, and Work Email Address: Used for account creation, team directory, and identification.
- Mobile Phone Number: Used as the primary login credential via One-Time Password (OTP) verification.🔒 Security Guarantee: Mobile phone numbers are cryptographically encrypted at rest using AES-256 (GCM), blind-indexed with HMAC-SHA256 for secure searching without exposing raw numbers, and masked in all UI views and system logs.
- Role & Plant Assignment: Used for Role-Based Access Control (RBAC) to ensure you only access data relevant to your plant and duties.
B. Location Data (Foreground Geolocation)
The application requests access to precise and coarse location permissions (ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION):
- Purpose: Location is solely collected to verify that an employee is physically present within designated plant boundaries or authorized work sites when submitting an attendance clock-in, clock-out, or location verification update.
- No Continuous Background Tracking: Geolocation is sampled strictly on-demand at the moment you tap the attendance button. The application does NOT continuously track, monitor, or record your physical movements or background GPS when the app is inactive or closed.
C. Push Notification & Device Information
- Firebase Cloud Messaging (FCM) Tokens: Registered to dispatch critical company alerts, clock reminders, shift announcements, and direct messages.
- Device Hardware UUID & Platform: Generated locally to maintain session state across app restarts and prevent duplicate push deliveries across multiple devices.
- Technical Logs: IP address, user-agent, and error logs recorded to prevent brute-force attacks, debug system crashes, and ensure infrastructure integrity.
D. Workplace Operational & Activity Content
- Attendance logs, shift durations, overtime approvals, and leave balance requests.
- Task assignments, workflow stage approvals, and operational comments.
- Quality validation records (e.g. PCB model, remote model, test parameters).
- Expense claim entries, category budgets, and uploaded receipt images.
- Workplace messages, group announcements, and uploaded corporate documents.
3. How We Use Collected Information
We process collected data exclusively for corporate and workforce functions:
- User Authentication: Verifying registered employee phone numbers via secure OTP.
- Attendance & Payroll Accuracy: Logging verified clock-in times, workplace locations, and shift calculations.
- Operational Communication: Transmitting real-time task updates, management announcements, and emergency notices.
- Security & Audit Logging: Detecting unauthorized login attempts, session anomalies, and enforcing corporate data policies.
- Compliance with Legal Obligations: Fulfilling mandatory labor, safety, and corporate reporting requirements.
4. Third-Party Service Providers (Sub-Processors)
To operate reliably, the application integrates with select, enterprise-grade third-party infrastructure providers who adhere to strict data security standards:
Google Firebase
PrivacyFirebase Phone Authentication (SMS OTP verification), Firebase Cloud Messaging (push notifications), and Firebase Analytics for crash diagnostics.
AWS SNS & Twilio
Telephony GatewaysHigh-priority transactional SMS delivery for user verification codes and security OTPs when logging in.
pCloud & Cloud Storage
Document VaultEncrypted corporate file storage for company policies, shared documents, and expense receipt attachments.
Enterprise PostgreSQL
Data InfrastructureSecure relational database hosted in protected cloud infrastructure with strict access control and encrypted backups.
5. Data Security Measures
We employ industry-leading technical and administrative security measures to protect company and employee data:
- Encryption in Transit: All communications between mobile apps, web clients, and servers utilize TLS 1.3 / HTTPS encryption.
- Encryption at Rest: Sensitive PII (including phone numbers) is encrypted using AES-256-GCM. Passwords are never stored in plain text and use salted cryptographic hashes.
- Blind Indexing: Phone searchability is powered by irreversible cryptographic HMAC hashes, preventing database administrators or compromised stores from exposing plain phone numbers.
- Role-Based Access Control (RBAC): Strict permission boundaries guarantee that employees only view data pertinent to their specific job role and facility.
- HTTP-Only Session Tokens: Authentication tokens are stored in secure, SameSite, HTTP-only cookies and short-lived JWTs to prevent XSS and CSRF attacks.
6. Data Retention & Account Deletion (Google Play Compliance)
Litair Technologies retains employee operational data during your period of active employment or service engagement. Historical attendance, payroll logs, and quality validation records are retained in accordance with statutory labor and corporate auditing standards.
How to Request Account & Personal Data Deletion
If you have left the organization, are no longer an active contractor, or wish to request the deletion of your account and personal identifiers, you have the right to request deletion at any time:
- Method 1 (In-App / Administrator): Contact your plant manager or system administrator, who can deactivate your account and trigger data purge from the administrative dashboard.
- Method 2 (Direct Email Request): Send an email to our Data Protection team at privacy@litair.site or admin@litair.site with the subject
"Account Deletion Request".
7. Children's Privacy
Litair Management is strictly an enterprise business and manufacturing operations tool. It is not designed for, marketed to, or intended for use by children. We do not knowingly collect personal information from individuals under the legal working age (under 18 years of age, or under 13/16 where applicable). If we learn that personal data of a minor has been mistakenly submitted, we will immediately delete that information.
8. Changes to this Privacy Policy
We may occasionally update this Privacy Policy to reflect modifications in software features, regulatory requirements, or Google Play Developer Program policies. Any revisions will be published on this page with an updated “Last Updated” date. Material modifications will be announced internally via the app's broadcast notification channel or corporate communication.
9. Contact Us
If you have any questions, inquiries, or concerns regarding this Privacy Policy, your personal information, or Google Play data disclosures, please reach out to our team:
com.litair.management)