Privacy Policy

Plan-Sarthi is a business-to-business software-as-a-service platform for Engineering, Procurement and Construction (EPC) project controls. It is owned and operated by Sarthi Associates, Ghazipur, Uttar Pradesh, India. For the purposes of the DPDP Act, we act as the Data Fiduciary for account information about your users, and as a processor acting on your instructions for the project data you upload.

This policy applies to the Plan-Sarthi web application, its APIs and all related email communication. It does not apply to third-party websites we link to.

We collect only what the platform needs to function and to bill you correctly:

• —Account and identity data: full name, work email address, mobile number, company name, designation and company size, submitted during signup.
• —Authentication data: a securely hashed password (bcrypt), email verification codes, session tokens and login timestamps. If you sign in with Google, we receive your name, email address and profile picture from Google — never your Google password.
• —Project and execution data: projects, WBS and BOQ line items, quantities, rates, Daily Progress Reports, manpower and shift records, hindrances, resources, store and inventory records, employee KPI records, and any notes or remarks your team enters.
• —Site photographs and uploaded files: BOQ spreadsheets, PDFs and any images attached as field evidence, including any location metadata contained in those files.
• —Billing data: plan selected, invoice amounts, payment status, Razorpay order and payment identifiers, and GST details where supplied. We never receive or store your full card number, CVV or UPI PIN.
• —Technical and usage data: IP address, browser and device type, pages used, feature usage and error diagnostics, used to keep the service secure and to fix faults.

• —To create and secure your workspace, verify your email address and manage roles and permissions.
• —To operate the platform: compute progress, S-curves, critical path, earned value, forecasts and reports from the data your team enters.
• —To run AI features on request — risk narratives and BOQ parsing — where the relevant text or tabular content is sent to a large-language-model provider for processing.
• —To process subscriptions, trials and payments, and to issue receipts.
• —To send service email: verification, trial reminders, payment receipts and important security or availability notices.
• —To provide support, investigate faults, prevent fraud and abuse, and comply with legal obligations.

We do not sell your personal data. We do not use your project data to train third-party AI models, and we do not share it with your competitors or with any other customer.

We process account data on the basis of your consent given at signup and on the basis of the contract between us. Where you upload personal data about your employees, contractors or site workers, you confirm that you have the authority and any consent required to do so, and you remain responsible for the lawfulness of that collection. Consent may be withdrawn at any time by writing to admin@plansarthi.com, after which we will stop processing and, where the law permits, delete the relevant data.

We use a small number of carefully chosen providers. Each receives only the minimum data needed:

• —Razorpay Software Private Limited (India) — payment processing. Receives your name, email and the transaction amount. Card and UPI credentials are captured by Razorpay directly on PCI-DSS compliant infrastructure and never reach our servers.
• —Twilio SendGrid — transactional email delivery. Receives your name and email address and the content of service emails.
• —Emergent (platform and AI gateway) — application hosting, the managed Google sign-in flow, and access to large-language-model providers (Anthropic Claude, OpenAI, Google Gemini) used by the Risk Radar and BOQ Parser. Only the specific text you submit for analysis is transmitted.
• —Product analytics — anonymised or pseudonymised usage events, used solely to improve the platform. These are optional cookies you can reject at any time.

We may also disclose information where we are legally required to do so by a court, regulator or law enforcement authority in India, or where necessary to protect our rights or the safety of others.

Plan-Sarthi is hosted on cloud infrastructure with Indian data residency for the primary application database. Certain sub-processors listed above may process limited data outside India; where that happens we rely on contractual safeguards to keep the level of protection equivalent.

We retain your data for as long as your account is active. After cancellation we retain your project data for 30 days so that you can reactivate or export it, then delete it. Billing records and invoices are retained for eight years as required by Indian tax and companies legislation. Backups are rotated and purged within 35 days.

• —All traffic is encrypted in transit with TLS (256-bit).
• —Passwords are stored only as bcrypt hashes; we cannot read them.
• —Access is controlled by role-based permissions (admin, project manager, HOD, engineer, storekeeper, viewer) and short-lived signed session tokens with httpOnly cookies.
• —Repeated failed logins are rate-limited and temporarily locked out.
• —Payment signatures from Razorpay are verified server-side with HMAC-SHA256 before any entitlement is granted.
• —Internal access to production data is limited to the personnel who need it to run the service.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users without undue delay, as required by the DPDP Act.

Subject to the DPDP Act, you may:

• —Access a copy of the personal data we hold about you, and information about how it is processed.
• —Correct or complete inaccurate or outdated data — most fields can be edited directly in the platform.
• —Erase your data, subject to records we must keep by law.
• —Export your project data at any time in Excel, PDF or PPTX form from the Export Center, or request a full machine-readable export by email.
• —Withdraw consent and close your account.
• —Nominate another person to exercise these rights on your behalf in the event of death or incapacity.
• —Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these rights, write to admin@plansarthi.com from your registered email address. We respond within 30 days.

Plan-Sarthi is a workplace tool intended only for adults acting for a business. We do not knowingly create accounts for anyone under 18 and do not knowingly process children's data.

We use essential cookies for your session and preferences, and optional analytics cookies. See the Cookie Policy for the full list and how to reject the optional ones.

We may update this policy as the platform or the law evolves. Material changes will be notified by email or in-app at least 14 days before they take effect, and the effective date above will be revised.

Grievance Officer / Privacy contact: admin@plansarthi.com, Sarthi Associates, Ghazipur, Uttar Pradesh, India.