The short version
Baton is a tool for contractors who hand over an asset register. Your crew photographs equipment nameplates on site, Baton reads the details, your office checks them, and Baton generates a handover document.
- Your photographs and your finished documents live in your own Google Drive. They do not rest on our servers.
- We ask for an email address and a name so you can sign in and so we can send you password resets and team invitations. Nothing else.
- We count visits to the website and the office app with Google Analytics, set up to record page views and the names of a few steps (for example 'account created' or 'Drive connected'), never an email address, name or project detail. On the public website pages only, Microsoft Clarity shows us how visitors move around those pages. We run no advertising or profiling, and we do not sell or share your data with anyone for their own purposes.
- Your field crew never create accounts. Baton does not know who they are.
Everything below is the same thing said precisely, in the form India's Digital Personal Data Protection Act, 2023 asks for.
Who is responsible for your data
The Data Fiduciary for the personal data described here is Baton, run by Chetan: we decide why and how it is processed. You are the Data Principal. We are based in India, and email is the way to reach us: hello@hustleworld.app.
There is no company and no team behind Baton — it is built and run by one person, Chetan. “We” throughout this notice means him, and every request below reaches him directly rather than a support queue.
This notice is written under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Where the Information Technology Act, 2000 and the SPDI Rules, 2011 still apply to the same data, we follow those too.
What we collect, and why
Itemised, because the Rules require it to be. Each item is here because a named feature does not work without it.
Your name and email address
To create your account, sign you in, send password resets, and let a colleague invite you to a company. Email is the identity a sign-in and an invitation are matched against.
Your company name, and optionally your logo and brand colour
To group your team into one workspace, and to print your branding on the handover document you generate.
Optionally, a short answer to 'Who sent you to Baton?'
Asked once, after your first handover, so we can see which introductions work. It is whatever you choose to type, you can leave it empty, and it is never shared.
Project details you type in: project name, site address, capacity, description, installation and commissioning dates, the site's meter or grid reference (such as an MPAN or MPRN), and who the handover is prepared for
To organise captures into projects and to fill in the handover document's cover. A site address is a place, not a person, but you may choose to enter something identifying — and "prepared for" is free text that can name a person — so we treat them with the rest.
Handover recipients you add: a name, and the column wording you save for them
So every handover to that client comes out in their own column headings. A recipient name can be a person's name.
Equipment records: category, make, model, serial number, quantity, condition at install (with a note if it arrived damaged or with a minor issue), location on site, the client's site tag if entered, warranty dates if entered, notes, review status, item number
This is the register itself. It is the product.
Photographs your crew takes: the nameplate, and two required photographs of the unit
To read the equipment details from, and to include as the photographic record inside the handover document.
Files you attach to a project yourself: certificates, drawings, test sheets, manuals, warranties, and the one-line description you type beside each
To list them in the handover document's attachments index, so a reader knows what came with the pack. Baton never opens or reads these files; it records the name, the type and your description.
A tech name, if a crew member types one when joining a project
So the office can tell which crew a capture came from. It is optional, free text, and never verified.
A device identifier for each phone that joins a project
So a crew member can edit or delete their own captures and nobody else's. It is a random value our server mints. It is not an advertising ID and it does not follow a phone between projects.
For each phone on a project: its type (iPhone or Android), how many captures it still has to send, and when it last reported
So the office can see which phones are still sending before it generates a handover, and which crew members are done. The phone sends this after each upload attempt. Nothing about the phone beyond its type is sent.
The IP address of failed attempts to redeem a project code
Only to rate limit guessing against a six-digit code. Successful joins do not store an IP address.
Your subscription references, if you upgrade to Pro
The customer and subscription identifiers Dodo Payments gives us, the plan, and when the paid period ends — so Pro can be switched on, kept on until the period you paid for ends, and switched off when it lapses. No card details.
Your Google Drive authorisation
So Baton can create a folder in your Drive and write your photographs and documents into it. See the Google section below.
What we do not collect
- No location. The capture app never asks your phone for GPS and never records where a photograph was taken.
- No advertising and no advertising identifiers. No session recording or heat maps inside the signed-in office app, on the sign-in, sign-up and invitation screens, or anywhere in the capture app: Microsoft Clarity runs only on the public website pages (home, how it works, pricing, blog, privacy and terms). Google Analytics counts visits to the website and the office app. Both are listed under "Who else touches your data" below. The capture app has no analytics of any kind.
- No marketing list. We do not run a newsletter and there is nowhere on this site to subscribe to one. If we ever start, it will be a separate, explicit opt-in.
- No payment card details reach us. Upgrading to Pro hands you to Dodo Payments' own secure checkout page — your card number, name and billing country go to them, never to Baton. See "Who else touches your data" below.
- No contacts, no camera roll, no microphone. The capture app uses the camera only while you are on the capture screen, for the photograph you are taking.
- No children's data. Baton is a workplace tool sold to companies, is not directed at children, and must not be used by anyone under 18.
Where your data is stored
Two different things are stored in two different places, and the difference matters:
Files: in your Google Drive
Every photograph, every file you attach to a project, and every generated PDF, Excel workbook and CSV is written into a folder in your own company's Google Drive, under your own Google account. A photograph does pass through our storage on its way there, because a phone with no signal uploads to us first, but the same job that copies it into your Drive deletes our copy. Nothing rests on our servers.
The register: in our database
The text of the register (project names, equipment makes, models, serial numbers, review status) is stored in our database so the app can show it, search it and generate documents from it. That database is hosted on Convex, in Ireland (eu-west-1). This is a transfer outside India, which the DPDP Act permits except to countries the Central Government restricts; Ireland is not restricted.
Whose Drive, specifically: the Google account that connected Drive when the project was set up — normally the contractor's. If you are the client or building owner receiving a finished handover rather than producing one, the files live in your contractor's Drive, not automatically in yours. Ask them to share the folder, or export a copy to you, the same way you would with any file a contractor hands over today.
Google Drive, and Google's Limited Use rules
Baton asks for the narrowest Google Drive permission that exists for this job: the drive.file scope. It lets Baton create and manage only the files Baton itself creates. It gives Baton no ability to read, list or touch anything else in your Drive.
You can disconnect Drive at any time from Settings, which deletes the authorisation we hold. You can also revoke it from your Google account permissions. Files already in your Drive stay yours and are untouched.
Who else touches your data
Eight processors, each doing one job under contract, none of them permitted to use your data for their own purposes:
Google (Drive)
Stores your photographs and finished documents, in your own account.
Convex
Hosts the application and the register database, in Ireland.
OpenRouter
Reads the nameplate. A nameplate photograph is sent to the model provider through OpenRouter so the make, model and serial can be extracted, and the result is returned to us. Only the photograph is sent, not your account details.
Brevo
Sends transactional email only: password reset codes and team invitations. No marketing email is sent through it.
Dodo Payments
Handles Pro plan checkout end to end on their own hosted page — your card details, name, email and billing country go directly to them, never through our servers. We receive only confirmation that a subscription started, changed or ended.
Google (Analytics)
Counts visits to the website and the office app, so we can see how many people arrive and which pages they use. It receives the page path (with project ids and invitation tokens replaced by a placeholder, and no query string except the short campaign tags utm_source, utm_medium and utm_campaign when a link we sent carries them), the name of a few funnel steps such as 'account created' or 'Drive connected' (no details attached), the referring site, your browser and device type, and an approximate location derived from your IP address, which Google does not store. It never receives your name, email, project names, or anything from the register. Google signals and ad personalisation are switched off, and no account is ever linked to a Google identity. Visits are identified by a random cookie set by Google Analytics (see Cookies below).
Microsoft (Clarity)
Shows us, on the public website pages only, where visitors click and scroll and how far they read, as heat maps and anonymised recordings of those pages, so we can fix what confuses people. It does not run in the signed-in office app, on the sign-in, sign-up or invitation screens, or in the capture app, so it never sees a project, a serial number or a password. Anything typed into a form field is masked by Clarity before it leaves your browser. It receives your browser and device type, an approximate location from your IP address, and a random visitor identifier set in a cookie (see Cookies below). It is not linked to any account.
Cloudflare
Runs this website and the office app.
We do not sell personal data, we do not share it with data brokers, and we do not disclose it to anyone else except where the law requires it of us.
Your field crew
Field crew do not have Baton accounts. A crew member joins a project by scanning a QR code or typing a six-digit code, and that is the whole process: no name required, no email, no password, no app to install.
What Baton holds about a crew member is a random device identifier, the type of phone and how many captures it still has to send, and, only if they typed one, a display name. As the company running the project, you are responsible for telling your crew that captures they take are recorded against your project, and for cancelling a project code when a job ends.
How long we keep it
- Your account and register data: for as long as your company has an account with us, and for 90 days after you ask us to close it, so an accidental deletion can be undone. After that it is erased.
- Photographs on our side: minutes. They are deleted from our storage as soon as they are copied into your Drive. If Drive is not connected, a photograph stays with us until it can be copied or until you delete the capture.
- Files in your Drive: yours, indefinitely, and unaffected by anything you do with your Baton account. Deleting your Baton account does not delete your Drive.
- Failed join attempts: cleared once the lockout window has passed.
- Google authorisation: deleted the moment you disconnect Drive, and automatically if Google tells us the grant has been revoked.
Your rights
Under the DPDP Act you have the right to:
- Ask what personal data of yours we process, and a summary of it.
- Have it corrected, completed or updated. Your name, and most project and equipment data, you can edit yourself in the app.
- Have it erased, unless we are required by law to keep it.
- Withdraw consent as easily as you gave it. Disconnecting Drive is one click in Settings; closing your account removes the rest.
- Nominate another person to exercise these rights if you die or become incapacitated.
- Complain to us, and escalate to the Data Protection Board of India if our answer does not satisfy you.
Write to hello@hustleworld.app to exercise any of these. We acknowledge within 72 hours and answer within 7 working days, or tell you why we need longer.
The Act also asks something of you: please give accurate information, and do not file a false or frivolous complaint.
Grievance Officer
If something about how we handle your data is wrong, this is the person responsible for fixing it.
If we do not resolve it, you may complain to the Data Protection Board of India.
Security, and what happens if we get it wrong
Data is encrypted in transit and at rest. Access to a project is scoped per account, a crew member can only change captures taken on their own device, and a leaked project code can be revoked instantly, which cuts off every phone using it. Uploads are size and type limited, and repeated wrong guesses at a project code lock out both the device and the network address.
No system is perfect. If a breach affects your personal data we will tell you and the Data Protection Board without delay, and give the Board the full report within 72 hours of becoming aware, as the DPDP Rules require. We will tell you plainly what happened, what was exposed, and what you should do.
Changes to this notice
If we change what we collect or who processes it, we change this page in the same release, and we tell account holders by email before it takes effect. This version is dated 20 October 2026.