Privacy policy

Who we are

gamitrack is operated by gamitrack (PAN [PAN]), Kathmandu, Nepal, Nepal ("we", "us").

For the business data a company records in gamitrack, including information about its staff and customers, that company decides what is recorded and why; we process it on the company's behalf and only to provide the service. For website visitors, demo requests and the companies we bill, we decide how the information is used.

Information we collect

Account details: names, mobile numbers, email addresses (optional) and roles of the people a company adds. Office staff PINs are stored only as one-way hashes.

Business data the company records: parties, products, orders, invoices, payments, stock, returns, expenses and notes.

Field data for salespeople and delivery staff, only during their working day: GPS location points between Start day and End day (also while the app is in the background), the morning area check when the day starts, visit check-ins and check-outs, photos taken in the app, and device signals such as battery level, power-saving mode, whether location and its permission are on, app version and the phone's clock.

Demo requests and website enquiries: name, phone, email, company and what you write to us.

Push notification tokens for the phones you sign in on.

Crash reports and technical logs: error messages, app version, device model and platform, and request records. IP addresses are kept only as one-way hashes, for rate limits.

Face ID and fingerprint: the phone checks them itself. Biometric data stays on your device and we never receive it.

Why we use it and on what basis

We process personal information in line with Nepal's Individual Privacy Act, 2075 (2018) and its regulations: to perform our contract with the company that uses gamitrack and to let its users work; with the consent of field staff for location tracking, given in the app before tracking first starts; and where the law requires it, for example keeping tax invoices.

We use it to provide the service (reports, alarms and notifications), to bill companies, give support and send service messages, and to keep gamitrack secure and working.

We send product news only to company owners and admins who have not unsubscribed; every marketing email has a one-click unsubscribe link.

We do not sell personal information and we do not use business data for advertising.

Location tracking and employees

Location is collected only for salespeople and delivery staff and only between Start day and End day. Before tracking first starts, the app shows a full-screen notice that the person must accept; only then does the phone ask for location permission. Field staff can see when tracking is on, and it stops when they end their day or sign out.

The employer must tell its staff in writing about location tracking and photos before they use the app, obtain their consent, and use the data only for work (attendance, visits and routes). This is also required by our terms of service.

Who we share it with (sub-processors)

We share personal information only with providers that help us run gamitrack, under agreements that require them to protect it: Sparrow SMS and Aakash SMS (Nepal) to send sign-in codes and, when a company turns them on, SMS copies of its messages to staff and critical alerts; Meta Platforms (WhatsApp Business), only for companies that send their messages to staff by WhatsApp, to deliver those messages to the staff member's WhatsApp number; Cloudflare R2 for photo storage and encrypted backups; our email delivery provider for service and billing emails; Expo, Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) to deliver push notifications; and our hosting provider for the application servers and database.

AI insights (only for companies that turn them on): to write insights, Anthropic receives each salesperson's name with weekly sales, orders, visits, days worked, the share of visits with an order, the number of shops visited, average visit time, best-selling products, target progress, and counts of very short visits, check-ins away from the shop and cash not handed over; and, when an owner or manager asks a question, the question and the sales figures needed to answer it. Shop names, phone numbers, emails, addresses, photos, notes and GPS traces are not sent, and Anthropic does not use this data to train its models.

Some of these providers process data outside Nepal. We choose providers with strong security and access controls and share only what each needs. We may also disclose information when Nepali law or a court order requires it.

Where data is stored and how it is protected

Data is stored on cloud servers run for us by our hosting provider, with encrypted connections (HTTPS), access limited to the people who need it and regular encrypted backups. Photos are kept in private storage and shown only through short-lived links. Sign-in codes and session tokens are stored only as hashes.

How long we keep it

GPS location points and device signals: 12 months, then deleted automatically.

Visit photos: 24 months, then deleted automatically.

Orders, invoices, payments and the ledger: as long as Nepal's tax and accounting laws require.

A person's account details: while their sign-in is in use; after a deletion request, as described below.

Demo requests and website enquiries: until the enquiry is closed, and deleted on request.

A company's data after its account is closed: available for export for 30 days, then deleted except records the law requires us to keep. Deleted data can stay in encrypted backups for a short time until they are overwritten.

Deleting or correcting your data

Staff: in the gamitrack app open Account → Delete my account. Your sign-in stops at once and your company is told. After 30 days we erase your name, mobile number, email, location history, device signals, notifications and visit photos. Orders, invoices, payments and the ledger stay with your company, linked to "Deleted user" without your personal details. If you cannot use the app, use the form at https://gamitrack.com/delete-account.

Company owners: deleting the owner's account closes the company's account, so the app sends it to our support team, who confirm with you and offer an export first.

To see or correct your information, ask your company's admin (they can change names and numbers) or write to hello@gamitrack.com. We reply within 7 days and complete deletion within 30 days of a confirmed request.

Changes

We will update this page when the policy changes and notify company owners of significant changes.