# Privacy Policy

> What we collect, why we collect it, and what we will never do with it.

- **Page** - https://iotready.com/privacy

IoTReady Technology Solutions Pvt Ltd operates this website and the IoTReady
mobile app, and has created this policy to inform users about how we collect,
use, and protect your information. The app has [its own section](#the-iotready-mobile-app).

## Personal information collection

The company collects data when users register on the site, including:

- Name
- Email address
- Mailing address
- Phone number
- Other details to improve user experience

## When information is collected

Data collection occurs during:

- Site registration
- Newsletter subscriptions
- Survey responses
- Form submissions
- General site interaction

## How information is used

Collected information serves these purposes:

- **Personalization.** To personalize your experience and deliver content in which you are most interested.
- **Website improvement.** To improve our website and deliver better service.
- **Customer service.** To enhance customer service responses.
- **Promotions.** To administer contests and promotions.
- **Communications.** To send periodic service-related emails.
- **Follow-up.** For follow-up communications via chat, email, or phone.

## Information security

Personal data is stored behind secured networks with limited access. All
sensitive information you supply is encrypted in transit via Secure Socket
Layer (SSL) technology.

Transactions process through external gateways and are not stored on company
servers.

## Cookies, analytics and advertising

The site measures how it is used in two ways.

**Without cookies.** Cloudflare Web Analytics counts visits, pages, referrers and
page speed. It sets no cookies and does not identify you across sites. It is
always on.

**With cookies, only if you accept.** When you first visit, a banner asks whether
we may use Google Tag Manager, Google Analytics and, when we run advertising,
Google Ads and LinkedIn. Nothing from them is switched on until you accept.
They use cookies and similar storage to count visitors, to see which
campaigns bring people to the site, and to show our advertising to people who
have visited. Google and LinkedIn receive your IP address and information about
the pages you view, and handle it under their own privacy policies.

If you accept, we also keep on your device, for up to 90 days, where you came
from: the campaign details in the link you followed, and the page you landed on.
If you then send us an enquiry, that is included with it, so we know which
campaign it came from. If you decline, none of this is stored, and anything
stored earlier is deleted.

You can change your mind at any time with "Cookie settings" in the footer of any
page. Your browser can also block or delete cookies. The site works without
them.

## Enquiries

When you send an enquiry through the contact form, it is emailed to our sales
team and kept in our mailbox and in our customer records. Cloudflare Turnstile
checks that the sender is a person, and sees your IP address and browser signals
to do so. Cloudflare carries the message. We keep an enquiry for as long as it
is useful for the conversation it started, and delete it when you ask.

## The free QR tool

The [QR tool](https://iotready.com/qr.md) is the one place on this site where you can have an account.
This is what it keeps.

**To sign in:** your email address, and the six-digit code we send it. The code
is stored as a hash, works for ten minutes and allows five tries. After you sign
in we set one cookie, which holds a random session token and nothing else. It
is a cookie the tool needs to work, so it is set without asking. Cloudflare
Turnstile checks you are a person and sees your IP address and browser signals
to do so. If you had accepted analytics cookies, we also keep the campaign that
brought you here (a `utm_source` or a click ID), so we know which of our
advertising worked. Decline them and we keep none of it.

**Your codes:** what you put in them, the name you give them, and the dates and
scan limits you set. An editable code keeps its destination address with us.
You can download all of it, or delete the account and with it every code. We
delete a code's scan history when you delete the code.

**People who scan your codes:** we count a scan against the day, the country
Cloudflare puts the phone in, and whether it was an iPhone, an Android or
something else. We keep no IP address, set no cookie and keep no record of
individual scans. Link-preview bots and mail scanners are not counted.

**Codes made without an account:** a plain code is drawn in your browser and
never reaches us. A code that expires is signed by us and stored nowhere. A
code that works once leaves a random ID with us until the code expires.

**If you ask about IoTReady Engine:** the form's answers and your email go to our
sales team and stay in our customer records. We delete them when you ask.

**Reports:** anyone can report a code from the page it lands on. We keep the
report for six months.

**Over MCP:** the QR tool also speaks the Model Context Protocol, at
`iotready.com/mcp` and `iotready.com/mcp/account`. The first needs no sign-in
and stores nothing. The second acts as you, on your codes, once you have
allowed an app on the sign-in page. [How to connect](https://iotready.com/docs/platform/qr-mcp.md).
You can disconnect an app from your account page.

## The free label designer and Starlark editor

The [label designer](https://iotready.com/tools/label-designer.md) and the [Starlark editor](https://iotready.com/tools/starlark-editor.md)
are IoTReady Engine apps, shown on this site in a frame. They are served from
`labels.iotready.dev` and `editor.iotready.dev`, not from this page, and this
site cannot see what you do inside them. They set no cookies when you use them
without an account.

If you have accepted analytics, we count that you clicked into the frame or
opened it full screen. That is all we count, and it carries nothing you typed.

The Starlark editor works on files on your own device and runs them in your
browser. A label you draw is not saved unless you sign in to an Engine account.
Signing in, and what an account then stores, is covered by your agreement for
that workspace.

## The IoTReady mobile app

The IoTReady app for Android (`com.iotready.app`, on Google Play) is the floor
side of IoTReady Engine. Operators use it to follow the steps of an activity:
scan a crate, read a scale, confirm a count. It works only with a workspace
account, which your employer or their administrator creates. You cannot sign
up from the app.

**Who is in charge of your data.** The records you create in the app belong to
the company whose workspace you sign in to. They decide what the app asks you
to capture and how long it is kept. IoTReady stores and processes it for them,
under their agreement with us. Questions about a workspace's records go to
that company first.

**What the app sends to your workspace:**

- **Your sign-in.** Your workspace address, username and password. The
  password is sent only to sign you in. The app keeps a session token on the
  phone, encrypted, not the password.
- **What you capture in an activity.** Scans, weights, counts, readings from
  connected devices, answers to the activity's questions, and photos you take
  as part of a step. Each is recorded with your name and the time.
- **Location, only where an activity asks for it.** If your workspace sets up an
  activity to record where a step happened, the app reads the phone's location
  while you are in that activity and attaches it to the step. It does not
  track you outside an activity, and if you refuse the permission the app
  records no location.
- **Issue reports, only when you send one.** A description, a screenshot of the
  screen you were on, any photo, video or voice recording you choose to add,
  the app version and the app's own recent log lines. These go to your
  workspace's issue list, where your administrators and IoTReady support can
  see them so the problem gets fixed. A recording is
  deleted from the phone once it is uploaded.
- **A device ID for notifications.** A random ID the app makes when first
  installed, and the push token Google gives the phone, so your workspace can
  send you notifications. The notifications themselves are carried by Firebase
  Cloud Messaging, a Google service.

**Permissions and what they are for.** The camera reads barcodes and QR codes
and takes the photos and video above. Barcodes are read on the phone and the
camera image is not sent anywhere. Bluetooth, USB and nearby Wi-Fi devices
connect to scales, scanners, RFID readers and IoTReady hardware. The
microphone records the voice notes and video sound in an issue report, and
nothing else. Location is described above. The app also runs a foreground
service, with a notification in the tray, to keep a connected scale or scanner
from dropping during a session. You can turn any permission off in Android's
settings. The parts of the app that need it will stop working, and the rest
will not.

**Crash reports.** If the app crashes, Firebase Crashlytics, a Google service,
sends us the error, the phone model, the Android version and the app version.
A crash report carries no name, no username and no workspace records.
Firebase Analytics is off. The app has no advertising and no ad tracking.

**On the phone.** The app keeps a copy of the workspace data your activities
need, so that it works without a signal and syncs when the signal comes back.
That copy is encrypted, with a key held in Android's keystore. Signing out clears your session. Uninstalling the app removes everything it
stored on the phone. Android backups of the app are switched off.

**Security.** Everything the app sends travels encrypted over HTTPS to your
workspace.

**Sharing.** We do not sell what the app collects, use it for advertising, or
use it to train AI models. It goes to your workspace, to Google for push
notifications and crash reports as described above, and to no one else unless
the law requires it.

**Retention.** Records you create are kept for as long as the company that runs
your workspace keeps them. Issue reports are kept while the issue is open and
for as long as they help with later support. Crash reports are kept by
Crashlytics for 90 days.

**Deleting your account and data.** Your account belongs to your employer's
workspace, so the quickest way to close it is to ask your workspace
administrator, who can remove it. You can also email
<support@iotready.com> from the address on your
account, or with your workspace name and username, and ask us to delete your
account. We will confirm with the workspace owner and delete it within 30 days.
Records you created as part of your work, such as a receipt or a stock count,
belong to the company and stay in its workspace, recorded against your name,
unless the company deletes them. Your device ID, push token and sign-in
sessions are deleted with the account.

**Children.** The app is a work tool for employees and is not meant for
children.

## Third-party practices

The company does not sell or trade personally identifiable information.
Third-party service providers must agree to maintain confidentiality. The
analytics and advertising providers named above are covered in the section on
cookies, and receive data only if you accept them.
Information may be released to comply with legal requirements or protect rights
and safety.

## AI connectors (Claude, ChatGPT and other MCP clients)

Each IoTReady workspace can let its users connect an AI assistant, such as
Claude or ChatGPT, through the Model Context Protocol. This section covers what
happens to your data when you do. The [connector documentation](https://iotready.com/docs/platform/ai-connectors.md)
explains how to set one up.

**Your administrator controls it.** Connectors are on in every workspace unless
an administrator turns them off in Settings > Connectors. Allow Changes is a
separate switch, off until an administrator turns it on, and without it
assistants can only read. Turning connectors off stops every connected
assistant at its next request.

**You approve each connection yourself.** The assistant connects to your own
workspace's address, `https://<workspace>.iotready.app/api/mcp`, and signs you
in through your workspace's normal login. Your password never goes to the
assistant. You see which app is asking and approve or cancel it. Changes are
only possible if your workspace allows them and you tick the box for them when
you approve.

**It sees what you can see, and no more.** A connected assistant acts as you.
Every read and every change goes through the same permissions as the
IoTReady dashboard. It can't delete anything.

**Where your data goes.** When the assistant calls a tool, the workspace sends
the result (the tables, rows or query results it asked for) to that assistant.
From there it is handled by the assistant's provider, such as Anthropic or
OpenAI, under your agreement with them and their privacy policy. IoTReady makes
no AI calls of its own to answer a connector's requests and sends your data to
no one else. The one exception is an AI agent the assistant creates in your
workspace: it runs inside the workspace, like any agent made there.

**What the workspace stores about a connection:**

- the assistant's registration: its name and the addresses it may return to
  after you approve it;
- for each connection: which assistant, which user, whether it may make
  changes, when you connected it and when it last renewed its access;
- one-time approval codes and refresh tokens, stored only as hashes.

Changes an assistant makes are recorded in the workspace's audit trail under
your name, like any change you make yourself.

**How long it is kept.**

- An approval code lasts 5 minutes and works once.
- Access tokens last an hour.
- A connection that goes unused for 30 days expires.
- An assistant registration that is never used for a connection is deleted
  after an hour.
- You can disconnect any assistant at any time from Connected Apps
  (`/dashboard/connections`) in your workspace. Its access stops at once.
- Changing or resetting your password ends every connection you made before it.

**What we don't do.** We don't use data reached through connectors to train AI
models, for advertising, or for any purpose other than answering your
assistant's requests.

Questions about connectors go to
<support@iotready.com>.

## Your rights

- You can browse the site anonymously.
- You may request personal data deletion via email at <support@iotready.com>.
- If you use the mobile app, you can ask for your account to be deleted as
  [described in its section](#the-iotready-mobile-app).
- Privacy policy links appear on the homepage and in all page footers.

## Additional policies

- The site does not respond to Do Not Track signals.
- The site does not market to children under 13.

## Questions or concerns

If you have any questions about this privacy policy or how we handle your data,
please contact us.

**IoTReady Technology Solutions Pvt Ltd**

F3, Rich Homes, 5/1 Richmond Road, Bangalore - 560025, India

<support@iotready.com>

[+91 82964 59900](tel:+918296459900)

## About this document

- **Entity** - IoTReady Technology Solutions Pvt Ltd
- **Contact** - sales@iotready.com