Privacy Policy

GripitOne is a business application for people who already have a GripitOne account issued by their organization. It is used to sign in and view operational information the account is allowed to see, such as sales, stock, shipments, aftersales, customer-service records, and related company records.

The app does not offer public self-registration. An administrator creates the account. You sign in with the email and password for that account.

From the person using the app, GripitOne collects:

• Email address and password, when you sign in.
• Mobile number, a one-time password, and a new password, when you use Forgot password.
• Account profile returned by our API after sign-in: name, email, mobile number, user ID, role, store assignment when one exists, and the brands your account can access.
• Session tokens. The app stores the access token, refresh token, and the signed-in profile on the device so you can stay signed in. Logout deletes that local copy.

When you open a screen, the app requests the business records that screen is allowed to show. Those records already live in Cavitak systems. Depending on the screen and your permissions, they can include employee account details, brand and product records, stock and sales figures, shipment and order records, customer-service or call records, and customer contact details such as name, phone, email, or address. The app does not read this information from your phone contacts, photos, or location.

GripitOne does not collect:

• GPS or other precise location from the device.
• Camera, photos, microphone, or media files.
• Contacts, SMS, or advertising IDs.
• Analytics or crash-reporting data from a third-party analytics SDK. The app does not include one.

We use the information above to:

• Authenticate you and keep your session valid.
• Show the profile, role, and brand access tied to your account.
• Display the operational records your account is permitted to view.
• Send a password-reset code to the mobile number on the account.
• Protect the service, including rate limits and security audit logs for sign-in, token refresh, and password reset.

Passwords are checked against a bcrypt hash stored on our servers. The app does not keep your password after the sign-in or reset request is sent.

We do not sell personal information.

We share information only as follows:

• With Cavitak's own GripitOne API, which receives sign-in, password-reset, and the data requests made by the screens you open.
• With our WhatsApp message provider, when you request a password reset. That request sends the account mobile number and the one-time code so the code can be delivered. SMS delivery through MSG91 is used only if that delivery option is turned on for the service. It is not the default.
• With administrators of your organization, who can see and manage GripitOne user accounts.
• When required by law, regulation, or a binding legal process.

The app does not send account or customer information to an advertising network. Some operational records shown in the app were originally received by Cavitak systems from business tools the company already uses, such as customer-service, CRM, commerce, and shipping systems. The Android app does not embed those providers' SDKs.

GripitOne does not request location permission and does not collect GPS or other precise location from the device.

Our servers record the IP address of sign-in, token refresh, and password-reset requests in security audit logs, and use the IP address for rate limiting. We do not use that IP address to determine or store your geographic location.

GripitOne does not request camera, photo, or media permission, and it does not capture or upload photos, videos, or files from the device.

Sign-in uses your work email and password. A successful sign-in returns a short-lived access token (about 15 minutes) and a refresh token (about 7 days). The refresh token is stored by the server as a hash. The app keeps both tokens, plus your name, email, role, and brand access, in a private file in the app's storage.

Forgot password asks for the mobile number on the account, then a one-time code, then a new password. The one-time code is stored on the server as a hash. The code is sent to that mobile number. Failed and successful sign-in, refresh, and password-reset events are written to an audit log with the IP address and user agent of the request.

There is no account-creation form in the Android app. Accounts are created by an authorized administrator in GripitOne.

The app does not read a device identifier, phone model, or advertising ID for its own records. Ordinary HTTPS requests include the client user agent. Our API stores that user agent, together with the IP address, on authentication audit events described above.

Account and operational data are stored on Cavitak systems that serve the GripitOne API at goapis.gogripit.com. Traffic between the app and that API uses HTTPS in production.

On the device, the session file is kept in the app's private document storage. Logout deletes it. Access to company records is limited by the role and brand permissions on the account.

The access token is intended to expire after about 15 minutes. The refresh token is intended to expire after about 7 days, or sooner if the session is revoked. The copy stored on the phone is deleted when you log out.

Account details are kept while the account exists. Authentication audit logs are kept as security records. We did not find an automatic purge period for those logs or for operational business records. Those records are kept for as long as the company needs them for operations, security, and legal obligations.

You can log out inside the app. Logout deletes the session file stored on that device. It does not delete the company account.

The Android app does not let you create an account, and it does not include a self-service control that deletes the company account. An administrator can deactivate an account. To ask Cavitak to deactivate or delete your GripitOne account and the associated profile data, email service@gogripit.com from the email address on the account, and include your name and the email or mobile number on the account.

Deactivating or deleting an account does not automatically erase operational business records that the account was allowed to view, such as orders, shipments, or customer-service history. Those records belong to the company's operations. We will delete or de-identify personal account data that we are not required to keep.

Depending on applicable law, you may ask to access, correct, or delete the personal account information we hold about you, or to object to or restrict certain processing. Email service@gogripit.com. We may need to confirm that the request comes from the account holder or from the organization that issued the account.

Profile details such as name, email, mobile number, and role are maintained by your organization's GripitOne administrator. Contact that administrator to correct them.

The Android app talks directly to Cavitak's GripitOne API. It does not include advertising, analytics, or crash-reporting SDKs.

When a password reset is requested, the API may send the mobile number and one-time code to:

• The configured WhatsApp message provider, which is the default delivery path.
• MSG91, only when SMS delivery is explicitly enabled.

Those providers receive the mobile number and the code for the purpose of delivering the message. They do not receive your password.

GripitOne is a workplace application. It is not directed at children, and we do not knowingly collect personal information from children through this app. Accounts are issued to authorized users of the organization.

We may update this policy when the app's data practices change. The effective date at the top of this page will change when we do. The current version is published at this URL. Continued use of GripitOne after an update means the updated policy applies to the app.

GripitOne

Cavitak Global Commerce Private Limited

Privacy and account requests: service@gogripit.com

This page: https://gripitnexus.gogripit.com/privacy-policy