Privacy Policy

How the Website Manager mobile app handles your information.

Last updated: 8 August 2026 · Applies to: Website Manager for Android · app.website.manager

Website Manager is a companion app for a website built and hosted by Credence IT Soultion ("we", "us"). It lets the staff of an organisation that already has one of our websites — a school, a college, a business — sign in and manage that website from a phone: edit pages, publish notices, upload photographs, read enquiries left by visitors, and see what the organisation has been invoiced.

This policy explains what the app collects, why, where it goes, and how to get rid of it. It covers the app only. The public website the app manages is operated by the organisation that owns it, under that organisation's own policies.

The short version. The app talks to one server — your own website — and nowhere else. It contains no advertising, no third-party analytics, and no tracking libraries of any kind. It does not collect your location, your contacts, or anything about the other apps on your phone. We do not sell data, and we do not use it to advertise to you.

1. Who is responsible for what

Two different things are going on, and the distinction matters if you ever want data removed.

Your staff account — the sign-in details that identify you as a person — is handled by us, as the operator of the service.
The website's own content and its enquiries — pages, notices, photographs, and the messages left by visitors to the website — belong to the organisation whose website it is. We hold that data on their behalf and act on their instructions. If you want an enquiry deleted, that organisation decides; we can carry it out.

2. What the app collects

Information you give us

What	Why
Your username or email address, and your password, at sign-in	To confirm you are who you say you are. The password is checked by the server and is never stored on the phone.
Your name, email address, and account identifier	Returned after sign-in so the app can greet you, show which websites you may manage, and apply your permissions.
The website code you enter to find your site	To point the app at the right website before you sign in.
Content you create — page text, notices, blog posts, menu items	Saved to your website, which is the purpose of the app.
Photographs you choose to upload	Added to your website's media library. Only files you pick, one action at a time. The app never browses your photo library on its own.

Information the app shows you

Two categories of data are displayed in the app but were not collected by it — they already exist on your website, and the app is a window onto them:

Enquiries. When somebody fills in a contact form on your public website, their name, email address, phone number, and message are stored against that website. The app lets authorised staff read and reply to them. This is personal data about members of the public, and the organisation that owns the website is responsible for how it is used.
Visitor statistics. The app shows visitor and page-view counts for the last seven days. These are counts only. Visitors are counted by storing a one-way cryptographic hash of their network address combined with a secret held on the server — the address itself is never stored in a form anyone can read or recover, statistics are switched off entirely if that secret is not configured, and browsers sending a "Do Not Track" signal are not counted at all. The app's own traffic is never counted.

Information collected automatically

Very little, and none of it for tracking:

Your app's version number, sent when the app asks the server whether this build is still supported. This is how a broken old version can be told to update rather than silently failing.
Ordinary server logs. Like any website, our server records requests it receives — network address, time, and what was asked for — as a normal part of running and securing a service.

There is no advertising identifier, no device fingerprinting, no usage or behavioural analytics, and no crash-reporting service. The app contains no software development kit from Google, Meta, or any other third party for these purposes.

3. Permissions the app asks for

Permission	What it is for
Internet	To reach your website. Without it the app does nothing at all.
Biometrics (fingerprint or face)	Optional. Unlocks a session you have already signed into, so you do not retype a password every time. Your fingerprint or face is checked by Android and never leaves your phone — the app is only told yes or no, and never receives, stores, or transmits any biometric data.

The app declares no camera permission and no storage permission. Photographs are chosen through Android's own picker, which hands the app the one file you selected and nothing else.

4. What is stored on your phone

Your session token, in Android's encrypted Keystore-backed storage. It identifies your signed-in session and is removed when you sign out.
A small cache of the last figures and lists you viewed — in the app's private storage, so the app can show something useful when you are briefly offline. Every cached figure is shown with the time it was fetched, and the cache is cleared when you switch websites or sign out.
A temporary copy of an invoice PDF, written to the cache folder for as long as it takes to hand it to the app you chose to share or save it with. Invoices are never stored permanently on the phone, because an outstanding balance changes the moment a payment is recorded.

Uninstalling the app removes all of it.

5. Payments

If your organisation has an unpaid invoice, the app can show the amount, a UPI payment link, and a QR code, and can produce the invoice as a PDF.

The app never handles money. Tapping "Pay now" opens the UPI app you already have installed, with the amount and reference filled in; you approve the payment there. We never see, receive, or store card numbers, bank credentials, UPI PINs, or any other payment instrument. What we record is what any supplier records: that an invoice was raised and that a payment was received against it.

6. Who we share information with

We do not sell your data, and we do not share it for advertising. Information leaves our systems only in these situations:

Our hosting provider, which stores the data on our behalf under contract and may not use it for its own purposes.
The organisation whose website you manage, and its other authorised staff — which is the point of a shared administration tool.
Where the law requires it, such as a valid order from a court or a competent authority.
Apps you choose to send something to. When you share an invoice PDF, you pick the destination — email, a messaging app, cloud storage — and that app's own privacy policy applies from that point on.

7. How long we keep it

Website content is kept for as long as the organisation's website is live, because it is the website.
Enquiries are kept until the organisation deletes them.
Your staff account is kept while it is active. When the organisation removes your access, the account is deactivated and then deleted.
Invoices and payment records are kept for as long as accounting and tax law requires us to keep them.
Server logs are kept for a short period for security and troubleshooting, then discarded.

8. Deleting your data

To delete your account and the personal data held about you, write to erp.credence@gmail.com from the address on your account, or ask the administrator of your organisation's website to remove your access.

We will confirm the request, delete the account and its personal data, and tell you when it is done — normally within 30 days.

Two things we may not be able to delete on request, and it is fairer to say so than to discover it later: records we are legally required to keep (invoices and payment records, for the statutory retention period), and content published to the website itself — a notice you wrote belongs to the organisation, not to your account, and removing it is that organisation's decision.

You can remove everything held on your own device at any time by signing out or uninstalling the app.

9. Your rights

Depending on where you live, you may have the right to ask for a copy of the data we hold about you, to have it corrected, to have it deleted, to object to how we use it, or to complain to a data protection authority. Write to the address in section 11 and we will help. We do not charge for this, and we will not treat you differently for asking.

10. Security, and children

All traffic between the app and the server runs over HTTPS. Sign-in issues a token rather than storing your password on the phone; the token is held in encrypted storage and can be put behind your fingerprint or face. Every request the app makes is re-checked on the server against both who you are and which website you are acting on, so an account can only ever reach the websites it has been granted.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your data, we will tell you and the relevant authority as the law requires.

The app is a work tool for the staff of an organisation. It is not directed at children, it has no content aimed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has an account, contact us and we will remove it.

11. Contact us

Credence IT Soultion
Sepco Township, Durgapur

Email: erp.credence@gmail.com
Phone: +91 70631 74514

12. Changes to this policy

If this policy changes, the revised version is published at this address and the date at the top is updated. Where a change materially affects how your information is used, we will tell you in the app or by email before it takes effect. Continuing to use the app after a change means you accept the revised policy.