Privacy Policy

Smart LOTO — Digital lockout-tagout for industrial plants.

Effective date: 5 May 2026 · Last updated: 5 May 2026 · Version: 1.0

1. Who we are

Smart LOTO ("the App") is operated by Innvendt Insights Pvt Ltd ("Innvendt", "we", "us", "our"), a private limited company registered in India.

2. Scope and applicability

This policy describes how Innvendt collects, uses, stores, and shares personal data in connection with the Smart LOTO Android application (Google Play package com.innvendt.smartloto) and the related Smart LOTO web administration portal at smartloto.innvendt.com.

Smart LOTO is a workplace safety application provided to industrial plants under contractual agreements with their parent organisations (each a "Customer"). The App is not intended for general consumer use. End-users are plant workers who receive credentials directly from their employer (the Customer) and use the App as part of their employment to perform lockout-tagout (LOTO) safety procedures.

For the purposes of this policy:

• "You" means a plant worker, supervisor, administrator, or other end-user of Smart LOTO.
• "Your employer" or "Customer" means the industrial organisation that has contracted with Innvendt to deploy Smart LOTO at one or more of its plants.
• "Personal data" means any information relating to an identified or identifiable natural person, as defined under applicable data-protection law.

3. Personal data we collect

We collect only the data necessary to operate the lockout-tagout workflow and maintain a defensible safety audit trail required by industrial-safety regulations.

3.1 Account information

• Email address — your sign-in identifier and the identity recorded against permit audit entries.
• Display name — as provisioned by your employer.
• Role — Initiator (Performing Authority), Isolator, Technician, Custodian, Safety Officer, or Administrator.
• Plant assignment — the specific plant facility you are scoped to.
• Linked Permit-to-Work (PTW) user ID — issued by your employer's PTW system to map your activity to existing safety records.
• Encrypted password — managed by Firebase Authentication (we never see your plaintext password).

3.2 Operational data

• Permit activity records — every action you take on a permit (login, isolation-point QR scan, lock applied, lock removed, photo captured, work verified, etc.) is recorded with your email, role, and timestamp. This forms the safety audit trail required by industrial regulations.
• Photographs — when you place a smart padlock on equipment or remove one, the App captures a photo as evidence and uploads it to Firebase Cloud Storage. Photos are linked to the specific permit and isolation point.
• Smart padlock metadata — Bluetooth Low Energy MAC address of the padlock you bind, lock identifier, and the binding/unbinding timestamps.
• Face descriptor — for roles where worker check-in via face-ID is enabled by plant policy, a numeric face-feature vector ("descriptor") is computed on your device using face-api.js and stored against your account in Firebase Realtime Database. The descriptor is a one-way mathematical representation; it cannot be reversed into a face image. The App also performs an on-device liveness check (a brief head-turn challenge) to defeat photo-replay attacks; the liveness frames are processed entirely on your device and are not transmitted or stored.

3.3 Device data

• Push notification token — Firebase Cloud Messaging (FCM) assigns a token to your device so the App can deliver permit-state alerts.
• App diagnostics — minimal technical data, including app version, BLE bind logs, and Firebase Realtime Database connection status, used to debug failures and reconstruct safety incidents.

3.4 What we explicitly do NOT collect

• We do not collect or use your location. Bluetooth scanning uses Android's neverForLocation flag.
• We do not access your contacts, calendar, photos library, microphone, SMS, or call logs.
• We do not include any advertising SDKs, third-party analytics, or behavioural tracking tools.
• We do not collect biometric raw images. Only the on-device-derived face descriptor.
• We do not collect special category data as defined by GDPR Article 9 (race, ethnicity, political opinions, religious beliefs, trade-union membership, genetic data, sexual orientation, etc.).
• We do not collect financial information.
• We do not collect data from or knowingly direct services to children under 18.

4. How we use your data and lawful basis

We do not use your personal data for any purpose unrelated to the operation of the lockout-tagout workflow. We do not sell your data, share it for advertising, or use it to build advertising profiles.

5. Where your data is stored and processed

Your data is stored on Google Firebase services, operated by Google LLC and Google Cloud Asia Pacific Pte. Ltd., under Google's Data Processing Addendum. Specifically we use:

• Firebase Realtime Database — permit and audit records
• Firebase Authentication — sign-in identity
• Firebase Cloud Storage — placement and removal photos
• Firebase Cloud Functions — server-side workflow processing
• Firebase Cloud Messaging — push notifications

Data is processed primarily in Google's asia-south1 region (Mumbai, India). Encryption is applied in transit (TLS 1.2 or higher) and at rest (Google Cloud default AES-256 encryption for managed services).

Bluetooth communications between the App and a smart padlock occur locally between your device and the padlock; they do not transit the public internet.

6. Sharing and disclosure

We share your data only with:

• Your employer's authorised plant administrators and safety officers — to operate the LOTO workflow and conduct safety audits.
• Your employer's Permit-to-Work (PTW) system — only the permit-related fields necessary to keep PTW records aligned (we do not share face descriptors or photos with the PTW system).
• Google Firebase — as our infrastructure processor, bound by Google's Data Processing Terms.
• Legal and regulatory authorities — where required by valid legal process or to protect the safety of any person.

We do not sell your data, share it with advertisers, transfer it to data brokers, or use it for any purpose unrelated to the lockout-tagout workflow.

7. Retention

• Permit audit records: retained for as long as your plant requires for regulatory compliance (typically 5 years after permit closure).
• Face descriptors: retained for the duration of your active employment plus 90 days. Deleted when your account is deactivated by your employer.
• Photographs: retained alongside the permit audit record (typically 5 years).
• App diagnostics and BLE bind logs: retained for 90 days, after which they are aggregated or deleted.
• FCM push tokens: deleted when you sign out or your account is deactivated.
• Account information: deleted within 90 days of account deactivation, subject to retention obligations under industrial-safety law.

Where local law specifies a longer retention period for safety records, we follow the longer requirement.

8. Security

We implement industry-standard technical and organisational measures including:

• Encryption in transit: TLS 1.2+ on all Firebase requests.
• Encryption at rest: Google Cloud default encryption for managed services.
• Firebase Security Rules: cross-user and cross-organisation access restricted at the database layer.
• Append-only audit log: audit entries cannot be modified or deleted by application clients, preventing tampering.
• Authentication: passwords stored only as Firebase-managed bcrypt-equivalent hashes.
• Service-account least privilege: server-side Cloud Functions run with scoped credentials.
• Bluetooth scanning: configured with Android's neverForLocation flag so location cannot be inferred from BLE scans.

Despite these measures, no system is 100% secure. If a breach occurs that affects your personal data, we will notify you and the relevant supervisory authority within the timeframes required by applicable law (within 72 hours under GDPR; without unreasonable delay under DPDP Act 2023).

9. International data transfers

Smart LOTO is operated from India and processes data primarily in Google's asia-south1 (Mumbai) region. Some Firebase administrative services may be operated by Google LLC in the United States or other jurisdictions where Google maintains infrastructure.

Where personal data is transferred outside the European Economic Area (EEA), the United Kingdom, or other jurisdictions with similar data-export rules, we rely on:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission, included in Google Cloud's Data Processing Addendum;
• Google Cloud's adherence to the EU-US Data Privacy Framework for transfers between the EU/EEA and the United States; and
• Other safeguards required by applicable law.

Copies of these transfer mechanisms are available from Google Cloud's public documentation; we can also provide them on request.

10. Your rights

Subject to the data-protection law that applies to you, you have rights regarding the personal data we hold about you. These rights typically include the ability to:

• Access the personal data we hold about you and obtain a copy.
• Rectify data that is inaccurate or incomplete.
• Erase your data ("right to be forgotten"), subject to retention obligations under safety law and your employment contract.
• Restrict or object to processing in certain circumstances.
• Data portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent where processing is based on consent (for example, you may discontinue use of face-ID where your role permits a fallback workflow).
• Lodge a complaint with the relevant data-protection authority.
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, email contact@innvendt.com from the email address on your Smart LOTO account. We will respond within 30 days (extendable to 90 days for complex requests, with notification to you). We will verify your identity before fulfilling requests.

Note that some data is held by your employer as the data controller for permit-related processing. We will assist you in directing such requests to your employer where appropriate.

11. Region-specific provisions

11.1 European Economic Area (EEA), United Kingdom, and Switzerland — GDPR / UK GDPR

For users in the EEA, UK, or Switzerland, Innvendt acts as the data processor (or controller, depending on the activity, as described in section 2). Your rights under GDPR / UK GDPR include all those listed in section 10.

You may lodge a complaint with your local supervisory authority. A directory of EU/EEA supervisory authorities is available at edpb.europa.eu; the UK Information Commissioner's Office is at ico.org.uk.

Innvendt currently does not have an EU representative under GDPR Article 27, as Smart LOTO is not directed to the EU/EEA market. If we begin offering services to data subjects in the EU, we will appoint a representative and update this policy.

11.2 California, Colorado, Connecticut, Virginia, Utah (and other US states with comprehensive privacy laws) — CCPA/CPRA and similar

For users who are California residents, the categories of personal information we collect, the purposes for which we collect it, and the categories of third parties we share with are described in sections 3, 4, and 6 of this policy.

In the prior 12 months, we have not:

• Sold or shared your personal information for cross-context behavioural advertising or other commercial purposes.
• Used or disclosed sensitive personal information for purposes other than those permitted under California Civil Code §1798.121.

California residents may submit verifiable consumer requests by emailing contact@innvendt.com with the subject line "California Privacy Request". Authorised agents may submit requests on your behalf with documented authorisation. We will not discriminate against you for exercising your rights.

Residents of Colorado, Connecticut, Virginia, Utah, and other US states with comprehensive privacy laws have similar rights and may submit requests through the same channel.

11.3 India — Digital Personal Data Protection Act 2023 (DPDP Act)

For users in India, Innvendt is a Data Fiduciary in respect of certain limited operational data and a Data Processor for permit-related data processed on behalf of your employer.

Under the DPDP Act, you have rights of access, correction, erasure, and grievance redressal. To exercise these rights or file a grievance, contact our Grievance Officer:

If your grievance is not resolved within 30 days, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act.

11.4 Brazil — Lei Geral de Proteção de Dados (LGPD)

For users in Brazil, Innvendt is the data controller (controlador) for limited operational data. Your rights under LGPD include those listed in section 10. Requests may be sent to contact@innvendt.com. Complaints may be filed with the Autoridade Nacional de Proteção de Dados (ANPD).

11.5 Canada — PIPEDA

For users in Canada, we collect and use personal data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). You may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

11.6 Other jurisdictions

If you are located in a jurisdiction with data-protection law not specifically addressed above, you may still exercise the rights described in section 10 by contacting contact@innvendt.com. We will comply with applicable local law.

12. Children's privacy

Smart LOTO is not directed to children. The App is provided exclusively to industrial plant workers as part of their employment, all of whom are adults aged 18 or above. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that personal data of a person under 18 has been collected, we will delete it. Smart LOTO is not subject to the US Children's Online Privacy Protection Act (COPPA), the EU's GDPR provisions for children, or India's DPDP Act children's provisions, because the App is not directed to children and is not used by children.

13. Cookies and tracking technologies

The Smart LOTO mobile app does not use cookies, web beacons, pixels, or similar tracking technologies. The App relies on Firebase SDKs which use device-local storage to maintain authentication state and offline data; this is not used for tracking across apps or websites.

The Smart LOTO web administration portal at smartloto.innvendt.com uses minimal first-party storage for authentication and session continuity. It does not include any third-party advertising or analytics cookies.

14. Changes to this policy

We may update this policy as the App evolves, applicable law changes, or our processing practices change. Material changes will be communicated to you via the App and via the email registered to your account at least 30 days before they take effect, except where a shorter notice is required by law or to protect against immediate harm. The "Effective date" and "Last updated" dates at the top of this page reflect the most recent revision. Earlier versions are available on request.

15. Contact and grievance

For privacy-related questions, to exercise your rights, or to file a grievance:

We commit to acknowledging your request within 5 business days and substantively responding within the timeframes required by applicable law (typically 30 days, extendable to 90 days for complex matters).

This privacy policy is provided in English. Translations may be made available; in case of any conflict between translations, the English version prevails.