Privacy Policy

1. Who we are

This policy is issued by Site-Voice, Colombo, Sri Lanka ("Site-Voice", "we", "us"). It covers site-voice.lk, the company dashboard, WhatsApp attendance, and related APIs. It is written so you can submit this URL to Meta / Facebook for WhatsApp Business API review.

2. What we collect

We only collect data needed to run the product for your company:

• Account data — email, phone, hashed password, role (owner or manager).
• Company profile — company name, logo, contacts, and settings you save.
• Crew data — employee names, job labels, WhatsApp numbers, site assignments.
• WhatsApp messages — inbound text, voice notes (for supply / site updates), and attendance commands such as "in" / "out".
• Location — live GPS only when a company turns on location attendance and a worker shares live location to clock in. We do not track workers in the background.
• Attendance records — clock-in / clock-out times, selected site or custom mode, and optional GPS coordinates.
• Technical logs — webhook IDs and security logs used to stop duplicate or fake messages.

We do not scrape public Facebook or Instagram profiles. We do not collect payment card numbers on this website.

3. How we use data

• Create and secure company and manager logins.
• Process WhatsApp voice/text into site updates, supplies, and job orders.
• Mark attendance when a registered employee messages the company WhatsApp number.
• Show dashboards, reports, and chat history only to that company.
• Enforce plan limits and prevent abuse (rate limits, signature checks).
• Respond to support and deletion requests.

We do not use your data for ads, public feeds, or resale.

4. WhatsApp and Meta

If your company (or Site-Voice admin) connects a Meta WhatsApp Business number, messages sent to that number are delivered to our webhook so we can reply and record attendance. Meta is a separate controller for the WhatsApp service itself. Our use is limited to:

• Receiving messages from employees who write to your business number.
• Sending operational replies (sign-in confirmation, hours, help menu).
• Storing message content only inside your company workspace — not in a public directory.

Access tokens and app secrets are stored as account secrets and are never shown in full after save. We verify Meta webhook signatures so outsiders cannot inject fake messages.

5. We do not share data publicly

User, employee, and message data is not public. Other Site-Voice customers cannot see your crew, attendance, or WhatsApp history. We do not sell, rent, or trade personal data. We share data only:

• With processors that host or process the service (for example database hosting, speech-to-text, or voice reply vendors), under confidentiality.
• With Meta / WhatsApp, solely to deliver and receive business messages you initiated by connecting a number.
• If required by law in Sri Lanka or a valid legal order.
• With your own authorised company users (owner and managers you grant access to).

6. How we store and protect data

Data is stored on secured servers (MongoDB and application hosting), not in a public website listing. Passwords are hashed. Admin and company sessions use HTTP-only cookies. WhatsApp credentials are restricted to authorised Site-Voice and company-owner settings. Attendance GPS is stored only on the attendance record for that clock-in.

No method of transmission is 100% secure, but we take reasonable technical and organisational measures to keep accounts private.

7. How long we keep data

We keep account, crew, attendance, and message data for as long as the company account is active, so the dashboard and reports remain accurate. Webhook duplicate-message IDs are kept only briefly for security. When an account is deleted, we remove or irreversibly anonymise associated company data as described on our data deletion page.

8. Your rights and account deletion

Company owners and managers may access and update profile, crew, and settings in the dashboard. You may request a copy of your data, a correction, or full account deletion at any time.

To delete an account, email privacy@site-voice.lk from the registered login email, or follow site-voice.lk/data-deletion. We will delete the login, company profile, employees, WhatsApp settings, attendance, messages, sites, and related records. This cannot be undone.

Employees who only use WhatsApp (and do not have a dashboard login) can ask their company or Site-Voice to remove their crew record and WhatsApp number from the system.

9. Children

Site-Voice is a business tool for construction companies. It is not directed at children under 18. We do not knowingly collect data from children.

10. Changes

If we update this policy, we will change the date above and post the new version at this URL. Continued use after an update means you accept the revised policy.

11. Contact

Questions about privacy, WhatsApp data, or deletion: