Privacy Policy

DPMi360 is provided by White Sun Private Limited, M. Jeymuge, Majeedhee Magu, 20290, Male', Maldives. This policy covers the DPMi360 website and web app (dpmi360.whitesun.mv) and the DPMi360 mobile apps for iPhone and Android. It covers two kinds of data: data about you as a user, which we control, and data your organization puts into its own projects, which your organization controls and we process on its behalf.

Data about you as a user

• Your name, email address, role and which organizations and projects you belong to.
• Your sign-in: a password (stored only as a hash by our sign-in provider) and, if you turn it on, a second step with an authenticator app. Recovery codes for that second step are stored only as one-way hashes.
• Sign-in and activity records: your IP address, browser or phone type, and times, kept in security logs and in the audit trail of changes.
• Your devices: a name and type for each phone or browser you are signed in on, the app version, when it was last used, and a push-notification token if you turn notifications on.
• Your notification settings.

Data your organization puts into its projects

Inspections and checkpoint answers, photos, voice notes, video, 360° and drone imagery, documents and their version history, compliance obligations, programme data, issues, actions, comments, reports, Ministry progress reports, and records of documents sent for signature. This is your organization's data — we process it to run the service, not for our own purposes.

The mobile apps

The apps ask your phone for permission before using any of the following, and work without the ones you decline:

• Camera and photo library — to take or attach photo evidence to an inspection.
• Microphone — to record voice notes as evidence.
• Location (only while the app is open) — to stamp evidence photos with where they were taken.
• Notifications — to alert you when something needs you. A push message only says what kind of thing happened; it never contains project names or record details.
• Face ID / fingerprint — only to unlock the app on your phone. Your biometric data stays on your phone; we never receive it.

To work without a connection, the app keeps copies of the project data you can see, and any evidence not yet sent, in storage on your phone; your sign-in is kept in the phone's secure storage. Unsent evidence is never deleted until it has reached our servers. The apps contain no advertising and no third-party analytics or crash-reporting service.

Why we use it

To provide the service your organization has chosen, to keep it secure and reliable, to respond when you contact us, and to meet our legal obligations. We do not use your data to show you advertising, and we do not sell it, rent it, or share it with data brokers.

Who can see it

Within DPMi360, visibility follows the role and project assignment you have been given — a role only sees the projects it has been assigned to, not everything the organization owns. Some records, such as unapproved inspection evidence, are visible only to the people who can see that inspection. A small number of White Sun platform administrators can see data across organizations in order to run and support the service; their actions are recorded in the audit trail.

Who we share it with

We share data only with the service providers below, when the law requires it, or with a successor if the business is transferred. None of them may use it for their own purposes.

• Supabase — sign-in and identity (your email, name and password hash).
• Amazon Web Services — the servers, database and file storage that run DPMi360, in Singapore.
• Cloudflare — the network in front of the site (it sees traffic to and from the site).
• Resend — sends reminder emails (your email address and the short reminder text, which can include a document or project name). You can turn these off in your notification settings.
• OpenAI and Anthropic — the AI features, described below.
• Expo, Apple and Google — delivery of push notifications to your phone (a push token and a generic message type only).
• Other White Sun products, only if your organization switches them on: WS Ledger (we send your projects' names, codes, status, client name, contract value and dates and receive accounting figures back) and MV Sign (we send the document or report you choose to have signed, with the signers' names and email addresses, and receive the signed copy).

AI processing

When you use an AI-assisted feature, the relevant data is sent to our AI providers to produce that one response: your question and the project records needed to answer it (project Q&A); project data (report drafting, health digest, inspection comparison); the text of a document (document and obligation extraction); a photo (photo suggestions); or a voice recording (a suggested transcript). Nothing is sent unless you ask for the feature. Under the providers' business API terms this data is not used to train their models. The result is always shown as a suggestion that you choose whether to keep — AI never changes a record by itself.

Where it is stored, and for how long

Our servers, database and file storage are in Singapore, the closest region to the Maldives that we use. Some providers above, including the AI providers, may process data in other countries, including the United States. Files are kept in private, access-controlled storage that is never publicly listable.

We keep your organization's data for as long as it uses DPMi360 and as required by law afterward. Approved inspections and reports, and Ministry reports once filed, are permanent records by design and are not edited afterwards. Audit trail entries are kept for security and accountability. Backups age out on their normal schedule.

Security

• All traffic uses HTTPS, and passwords are hashed — never stored in plain text.
• Authentication is handled by a dedicated identity provider, with optional authenticator-app two-factor sign-in, which is required for platform administrators.
• Files are in private storage with no public access, and our database is not reachable from the internet.
• Actions on records are logged in an audit trail, and sensitive administrator actions require a recorded reason.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell your organization without undue delay.

Your rights, and deleting your account

You can ask to access, correct, export or delete the personal data we hold about you as a user by writing to [email protected].

To delete your account you can also use Security → Delete your account on the web, or Settings → Delete your account in the mobile app. Asking does not delete anything by itself: a person at White Sun carries it out, and we aim to do so within 30 days. Your sign-in, name and email are then removed and you are signed out everywhere. Inspections, photos, documents and other records you added belong to your organization and stay with it, shown as “Deleted user”. The steps are also on our delete your account page, which works without signing in. A request about your organization's project data should go through your organization's own administrator first, since that data belongs to them.

Children

DPMi360 is for working professionals and is not intended for anyone under 18. Accounts are created by invitation only.

Changes to this policy

When we change this policy we update the date at the top, and tell your organization's administrators about changes that matter.

Contact

White Sun Private Limited, M. Jeymuge, Majeedhee Magu, 20290, Male', Maldives. Email [email protected], telephone +960 779 5857.