Privacy
Nirmaan is used by construction companies to run their projects. The company that signs up owns the data its people put in; Nirmaan keeps it and shows it only to the people that company lets in. This page says what is kept, where, who sees it, and how a company takes it out or has it erased.
What is kept
- Accounts: name, email, role, and optionally a mobile number. Passwords are stored only as salted hashes.
- Project records the company enters: BOQs, progress, daily reports, attendance, materials, machinery, expenses, measurements, bills, orders, vendors, staff and leave, quality checks, documents and the photos and files attached to them.
- An audit log of who submitted, approved, changed or exported what, and when.
- Notifications, and a log of the WhatsApp and SMS messages sent (to whom, which message, whether it went).
- Push tokens for the phones where someone is signed in to the site app, removed when they sign out.
- For a paying company: who its invoices are made out to (name, GSTIN, address) and its payments. Card, UPI and bank details are entered with Razorpay, the payment provider, and never reach Nirmaan; we keep only Razorpay's payment reference.
Nirmaan does not sell data, show advertising, or use a company's records for anything except running the service for that company.
Who can see it
- Only people the company's admin invites. Each sees only the projects they are on and what their role allows.
- Clients' engineers and consultants the company invites see only the client portal of their own projects: approved progress, approved reports, bills once sent, and inspections.
- Every company's data is kept apart, and the database itself refuses to show one company's rows to another.
- Nirmaan staff can open a company's data only after its admin allows support access under Admin, Data & Privacy. It lasts7 days, is read-only, can be withdrawn at any time, and every visit is recorded in the company's log.
Where it is kept, and who helps
- The database runs on Neon (PostgreSQL) in Singapore, and the application on Vercel. Connections are encrypted.
- Email goes through the configured email provider; push notifications through Expo; WhatsApp and SMS, when a user switches them on, through the messaging provider the company's plan uses.
- These providers handle the data only to deliver the service.
Taking your data out
A company admin can download everything at any time from Admin > Data & Privacy: an Excel file for each kind of record and every photo and document, in one zip. Lists in the app also export to Excel.
Deleting it
- An admin can remove a user at any time; the records that person entered stay with the company.
- An admin can ask for the whole company to be deleted from Admin > Data & Privacy. Nothing is erased for 30 days, and any admin can cancel until then. On that day every project, record, photo and user account of the company is erased.
- Database backups roll over and the erased data leaves them within the provider's backup window.
Questions
Ask your company's admin, who can reach Nirmaan support.