Privacy Policy

1. Scope, Applicability & Statutory Legal Framework

This Data Protection and Privacy Policy applies to all digital services, software products, mobile applications, and IoT equipment telemetry integrations provided by REACH INTERNATIONAL across web and mobile ecosystems:

• Enterprise Cloud Platform: The centralized cloud application accessible at www.reachinternational.co.in and associated APIs powering machine dispatch, maintenance tracking, and fleet analytics.
• Mobile Field Application: The hybrid and native mobile application (com.reachinternational.app) distributed on Google Play Store, Apple App Store, and internal enterprise distribution channels.
• Heavy Machinery Categories: Operational monitoring and operator safety telemetry for Scissor Lifts, Articulated Boom Lifts, Telescopic Boom Lifts, Rough-Terrain Forklifts, Mobile Cranes, and Material Handling Equipment (MHE).
• Covered Stakeholder Roles: Super Administrators, Service Managers, Field Operations Engineers, Heavy Machinery Operators, Base Yard Supervisors, and Corporate Client representatives.

This policy is drafted and enforced in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDPA), Section 43A of the Information Technology Act, 2000 (and the SPDI Rules, 2011), Google Play Developer Content Policies (Data Safety & Account Deletion Standards), and UIDAI statutory directives regarding identity masking.

2. Categories of Information We Collect

To coordinate machine custody, prevent workplace fatigue incidents, maintain equipment reliability, and verify statutory compliance, we collect the following categories of data:

3. Methods & Channels of Data Collection

Information collected by REACH INTERNATIONAL is gathered through direct, transparent, and operational interactions:

• Direct Input: Submitted intentionally by operators and engineers during onboarding, profile setup, daily meter log modal entry, and pre-shift checklist completion.
• Automated Engine Calculations: Operational metrics calculated automatically from opening/closing HMR deltas, shift timestamps, and automated shift overlap evaluation routines.
• Administrative Allocation: Project assignments, machine dispatches, and client yard locations configured by Service Managers or Fleet Administrators.
• Offline Queues & Background Sync: Data captured in remote or low-connectivity worksites is stored locally in encrypted storage (AsyncStorage / SQLite) and synchronized securely upon network reconnection.

4. Purposes & Legal Grounds of Data Processing

We process personal data and machinery telemetry strictly for legitimate industrial fleet management, workplace safety, and statutory compliance purposes:

• Equipment Custody & Operator Authorization: Verifying valid heavy equipment licences and qualifications prior to releasing custody of high-capacity aerial platforms.
• Shift Conflict & Fatigue Prevention: Monitoring daily shift allocations in real time to prevent operator exhaustion, double-booking, and dangerous shift overruns.
• Predictive Fleet Maintenance: Forecasting hydraulic fluid changes, load-cell calibrations, wire rope replacements, and engine servicing based on verified engine hours.
• Transparent Rental Billing: Supplying tamper-evident, verifiable operating hour logs for accurate equipment rental invoicing.
• Statutory Safety Audits & Investigations: Maintaining auditable historical records for industrial safety authorities, Directorate General of Factory Advice Service (DGFASLI), OSHA, and insurance compliance.
• Platform Integrity & Anti-Falsification: Detecting anomalous meter adjustments, preventing fraudulent hour alterations, and maintaining immutable audit records.

5. Data Security, Cryptographic Controls & Architecture

REACH INTERNATIONAL implements multi-layered enterprise cybersecurity controls to safeguard all platform records:

• PostgreSQL Row-Level Security (RLS): Data queries are partitioned at the database kernel level according to user role and tenant scoping. Operators only access their own shifts and assigned equipment.
• Role-Based Access Control (RBAC): System roles (super_admin, admin, manager, supervisor, hr, operator) possess strictly compartmentalized permissions. Sensitive personal KYC data is shielded from unauthorized peers.
• Encryption in Transit & at Rest: All network communication uses TLS 1.3 encryption with enforced HTTPS. Stored records, backup snapshots, and cloud document buckets utilize AES-256 encryption.
• Salted Passwords & Secret Isolation: User passwords utilize one-way salted cryptographic hashing managed by Supabase Auth; secrets are never stored in client bundles.
• Tamper-Evident Immutable Audit Trails: Modifications to machine hour readings, operator assignments, and account statuses produce immutable structured audit trails (logAudit) containing actor ID, timestamp, and IP address.

6. Third-Party Sub-processors & Zero Data Sale Guarantee

We contract exclusively with vetted, enterprise-grade cloud sub-processors operating under strict contractual data protection agreements:

• Supabase, Inc.: Provides SOC 2 Type II certified managed PostgreSQL database, authentication, and encrypted document storage.
• Expo / 650 Industries: Powers mobile application compilation, Over-The-Air runtime updates, and secure push notification gateway services.
• Vercel, Inc.: Delivers our web application and API infrastructure with global edge DDoS protection and SSL/TLS termination.

Statutory Disclosures: We may disclose personal data solely when legally compelled to do so by a valid judicial court order or an authorized governmental safety investigation regarding a worksite incident.

7. Data Retention & Archival Policies

Data retention periods are established based on operational necessity, heavy machinery warranty obligations, and statutory limitation acts:

• Active Account Records: Personal contact details, designated roles, and yard assignments are maintained for the duration of the operator’s active contract or employment.
• Statutory Heavy Equipment Safety Logs (Minimum 7 Years): In compliance with the Indian Factories Act and OSHA equipment lifecycle standards, machinery inspection records, Hour Meter logs, and signed delivery challans are retained for a minimum of seven (7) years to facilitate regulatory safety audits and insurance verification.
• Audit Trails & Mutation History: Cryptographic audit trails and system mutation logs are preserved in secure long-term archival storage.

8. User Rights & Google Play Account Deletion Policy

In full compliance with Google Play Developer Content Policies and the Digital Personal Data Protection Act, users hold comprehensive rights regarding their personal data:

• Right of Access & Portability: Users can request an export of their personal profile and historical shift records in CSV or PDF formats.
• Right of Rectification: Operators can update inaccurate contact numbers or submit licence renewal details via the in-app Edit Profile workflow.
• Right of Permanent Erasure: Complete account deletion and purging of personal identity records.

9. Cookies & Local Session Storage Policy

Our web application utilizes strictly necessary cookies and browser storage keys solely to maintain authenticated sessions and UI theme preferences:

• Authentication Session Cookies: sb-access-token and sb-refresh-token are essential for encrypted JWT session validation.
• Theme & Display Preferences: Stores user theme mode (light, dark, or system).
• Zero Behavioral Tracking: Reach International does not deploy third-party advertising cookies, retargeting scripts, Facebook Pixels, or cross-site marketing trackers.

10. Working Age & Operator Eligibility (Minors Policy)

Reach International serves commercial industrial fleets and heavy machinery operations. Operating heavy machinery (including boom lifts, scissor lifts, and cranes) is strictly restricted by law to verified individuals of legal working age (minimum 18 years old) possessing valid operating clearances.

Our platform is not directed toward minors. We do not knowingly solicit or collect personal information from individuals under the age of 18. Any account found to belong to a minor will be terminated immediately.

11. Cross-Border Transfers & Storage Localization

All primary operational databases and confidential document storage buckets are maintained in high-security enterprise cloud data centers adhering to Indian data localization principles and international compliance standards (SOC 2, ISO 27001). Any cross-border infrastructure failover is conducted under strict Standard Contractual Clauses (SCCs) ensuring equivalent data protection.

12. Policy Modifications & Notification Framework

We review and update this Privacy Policy periodically to reflect technological enhancements or regulatory changes. In the event of material modifications affecting data handling practices or operator rights, we will provide advance notice at least 15 days prior to enforcement through in-app notices, web dashboard alerts, and email communications.

13. Grievance Redressal, Compliance Officer & Official Contact

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, Reach International has designated a Compliance Officer for grievance redressal: