LAPCO · BUSINESS MADE SMARTER
Privacy Policy
Effective date: 18 October 2026 · Last updated: 19 October 2026
This Privacy Policy explains how LAPCO, operated by Digital Savvy, handles information when you visit lapco.in, sign in, work in a company workspace or connect optional Google Drive backups.
1. Who handles your information
Digital Savvy operates the LAPCO platform. A vendor or employer manages its own company workspace and decides which employees may access its business records. For employee records, contact your employer first about its collection and use. You can also contact LAPCO for platform privacy, access or deletion requests.
2. Information we collect
- Accounts and company details: name, email address, mobile number, company name, billing address, tax details when supplied, subscription requests and payment references.
- Google sign-in: verified email, account identifier and authentication details used to confirm your identity. Your Google display name may prefill signup. LAPCO does not receive your Google password.
- Business records: customer and lead contacts, follow-ups, invoices, quotations, receipts, expenses, inventory, tasks, visits and incentives entered by authorised users or submitted through connected enquiry sources.
- Employment records: employee contact information, permanent/current addresses, joining and employment details, submitted identity/education documents, payroll, leave and attendance records.
- Attendance evidence: a selfie and device location submitted when an employee chooses to mark attendance. The employee's device asks for the required camera/location permission. Evidence is sent for employer review; this is not continuous background location tracking.
- Security and operation: sessions, request/security logs, access events, device/browser information available in requests, and support messages. Passkeys store a public credential on the server; fingerprint/face templates and device PINs are handled by your device or passkey provider, not sent to LAPCO.
3. Why we use this information
We use information to create and secure accounts, enforce company permissions, provide subscribed business tools, process manual subscription review and billing, deliver service messages, support users, investigate abuse and comply with applicable obligations. An employer uses submitted records for its attendance, workforce and business processes. LAPCO does not automatically make statutory payroll filings or transfer salaries.
4. Google account and Google Drive data
Google sign-in and Google Drive backup are separate permissions. Signing in does not grant access to Drive. Optional Drive backup asks for https://www.googleapis.com/auth/drive.file, allowing LAPCO to create and manage the specific backup files and folders used with the app. We do not request unrestricted access to all your Drive content.
When you consent, LAPCO checks the connected Drive account's email/account identity, saves OAuth credentials securely and uses that access to create encrypted company snapshots and linked document/selfie backups, check backup status and delete app-managed expired selfies. Drive must be connected with the Google account matching your verified LAPCO login email. Each company is connected separately.
Backups include company service records and linked uploaded files. Invoice and payslip records can be backed up; PDFs independently saved from the browser are not automatically uploaded. Password hashes, authentication sessions and other companies' records are excluded from a company's backup. Drive folder/file names, sizes and dates may remain visible in your Google account even though backup contents are encrypted.
Google API data use: We comply with the Google API Services User Data Policy, including its Limited Use requirements. Google API data is used only for the disclosed user-facing features and their security/support needs. We do not sell it, use it for advertising or profiling, or use it to train general-purpose AI or machine-learning models. Transfers are limited to providing the requested features, your instructions, security, legal requirements or other uses allowed by that policy. Human access is limited to specific support with your permission, security investigations, legal duties or other permitted exceptions.
6. Retention and 45-day selfie deletion
Attendance selfie deadline: original server upload time plus 45 days. Approval does not extend it. The scheduled worker deletes expired local selfies and the app-managed remote selfie backups. Attendance status, location, dates and approval records remain separately; employee identity/education documents do not inherit the selfie deletion period.
Cleanup runs at the next successful scheduled check. A stopped scheduler, revoked Google access, provider errors or unavailable files can delay deletion. LAPCO cannot delete independently downloaded/manual copies, copies in unrelated hosting backups or information retained under a separate provider's retention controls. Reconnect the original Drive account if permission is needed to complete pending remote cleanup.
Other workspace, account, subscription, document and audit records are retained while needed to provide the service, resolve support/payment issues or meet applicable obligations. Trial or subscription expiry does not automatically erase those records. Drive snapshots and non-selfie document backups do not have an automatic deletion period in the current service. Account/company deletion is a verified support process; there is no automatic self-service account-deletion button.
7. Access, correction, revocation and deletion requests
Contact your company owner for corrections and permitted exports of workspace records. For account/company deletion, a copy of information, access concerns or complaints, contact LAPCO using the details below. Identify your registered email and company and describe the request; do not email passwords or full identity documents. We verify your identity and authority, assess the scope and explain any records we must retain. An employee cannot authorise deletion of an employer's entire company workspace.
In My Drive Backup, Stop New Backups stops uploads. Saved access may remain temporarily so app-managed selfies can be deleted at expiry, then credentials are removed after cleanup. Existing snapshots/documents remain until separately removed. You can revoke access at Google Account connections; revoking access prevents further Drive operations, including pending remote deletion, until you reconnect. Revocation alone does not erase existing backups or LAPCO server records.
8. Storage, security and recovery
The live application uses its server database and private file storage; Drive is an additional backup copy. We use HTTPS, account/session controls and company permissions. Saved Drive tokens and recovery keys are encrypted in the database, and Drive backup contents are encrypted. This is not a claim that every database field is encrypted or that the platform has zero access: authorised platform operation can decrypt backups. Keep your downloaded recovery key separate and private. No system can guarantee absolute security.
10. Intended users
LAPCO is intended for businesses and authorised adult users, not a service directed to children. Do not submit a child's information without appropriate authority and safeguards. Contact us if you believe such information has been submitted improperly.
11. Changes and contact
We update this policy when relevant processing changes. The date above identifies this version. Material changes will be communicated through available service channels where appropriate.
LAPCO / Digital Savvy — privacy and support:
info.digitalsavvy@gmail.com · +91 86 5555 0707
Partner applications and commission records
Partner sign-in uses a verified Google account. Applications collect contact details, location and working categories. Onboarding may collect PAN and bank beneficiary details for manual review and payouts; the Aadhaar field accepts only the last four digits.
PAN and bank details submitted through the Partner form are encrypted on the server. Access to the full details is restricted to Super Admin and is logged. Partner screens show masked identifiers. Changing bank details requires approval again.
Partner lead registration requires confirmation that the customer agreed to be contacted. Partners can access their own leads and commission records. Commission is based on verified subscription approvals and configured rules; payout records do not initiate a bank transfer. Contact the support address above for account, correction or deletion requests. Business and payout records may need to be retained where applicable.