✓ Introduction
This Privacy Policy explains how Khodal Infrastructure ("we", "us", "our")
collects, uses, stores and protects information through:
- the web portal at khodalinfra.codizious.com ("the Portal"), and
- the companion Khodal Infrastructure Android application ("the App").
The Portal and App are internal business-management tools used by Admins, Partners and
Site Managers of Khodal Infrastructure to manage firms, partners, investments, income,
expenses and business results. By signing in and using the Portal or App, you agree to
the practices described in this policy.
1 Information We Collect
We collect only what is needed to operate the Portal securely and effectively:
- Account information — full name, username, password, email address and
phone number, provided when your administrator creates your account or when you update
your own profile.
- Business data you or your organization enter — firm details, partner
records and profit-share percentages, investment entries, site manager assignments, and
income/expense records. This data belongs to your organization and is used solely to
operate the Portal on your behalf.
- Security & activity logs — login timestamps, IP address, and a
record of key actions taken on the Portal (e.g. "added investment", "updated partner"),
kept for audit and fraud-prevention purposes.
- Optional photo/file uploads — only if a specific form in the Portal
includes a file or photo field, and only when you actively choose to upload something.
- Basic technical data — browser/device type and general usage data,
used only to keep the Portal working correctly and securely.
2 How We Use Information
- To authenticate you and enforce role-based access (Admin / Partner / Site Manager).
- To let you and your organization record and view business data you are authorized to see.
- To calculate and display results — income, expenses, ledger totals and each partner's
estimated profit share.
- To maintain the activity log for security, accountability and troubleshooting.
- To communicate with you about your account when necessary (e.g. a password reset).
We do not use your data for advertising. The Portal and App contain no
advertising SDKs, ad trackers, or third-party analytics, and we never sell personal or
business data to third parties.
3 Roles & Access Levels
Access to information is restricted by role, enforced on every page of the Portal:
| Role | What they can see / do |
|---|
| Admin | Full access to all firms, partners, site managers, investments, income, expenses, the ledger, and all user accounts. |
| Partner | Their own investment history, their firm's income/expense records (read-only), and their own estimated profit share. |
| Site Manager | Income and expense entries for their own assigned site only — no visibility into other sites or firm-wide financials. |
4 Data Storage & Security
- All data is stored in a private, access-controlled database operated for Khodal Infrastructure.
- Passwords are never stored in plain text — they are hashed using industry-standard
one-way bcrypt hashing, so even we cannot see your actual password.
- Every form submission is protected against cross-site request forgery (CSRF), and all
database queries use parameterized statements to prevent SQL injection.
- Failed login attempts are rate-limited to protect accounts from brute-force attacks.
In progress: we are working to enable HTTPS (SSL/TLS) encryption for all
traffic to and from the Portal. Until this is completed, please avoid logging in over
untrusted public Wi-Fi where possible, and contact your administrator with any concerns.
5 Cookies & Sessions
The Portal uses a single essential session cookie to keep you signed in securely
(KHODAL_SESSID). This cookie is required for the Portal to function, is
marked HTTP-only to prevent access by scripts, and is not used for advertising, tracking,
or any purpose beyond maintaining your login session. It is automatically cleared when you
log out or your session expires.
6 App Permissions (Android App)
| Permission | Why we need it |
|---|
| Internet / Network State | Required to load and use the Portal inside the app. |
| Camera (optional) | Only requested if you tap a photo-upload field inside the Portal. You can deny this and continue using the rest of the app normally. |
The app requests no other permissions, and does not access your contacts, location, messages, or files outside of a file/photo you explicitly choose to upload.
7 Sharing of Information
We do not sell, rent, or trade your personal or business data. Information is shared only:
- Within your own organization, according to the role-based permissions described above;
- With service providers strictly necessary to operate the Portal (e.g. web hosting), who
are bound to keep it confidential and use it only to provide that service;
- If required by law, regulation, legal process, or governmental request.
8 Data Retention & Deletion
Account and business data is retained for as long as your account is active or as needed to
provide the Portal's services, and to comply with our legal and accounting obligations.
Activity logs are kept for a reasonable period for security purposes. You may request
deletion or correction of your personal account data at any time — see "Your Rights" below.
9 Children's Privacy
The Portal and App are business tools intended for use by authorized adult personnel
(Admins, Partners and Site Managers) and are not directed at, or intended for use by,
children under 13. We do not knowingly collect personal information from children.
10 Your Rights
Depending on your role and applicable law, you may have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate account information (via "My Profile" or your administrator);
- Request deletion of your account data, subject to legitimate business/legal retention needs;
- Ask questions about how your data is used.
To exercise any of these rights, contact your organization's Portal administrator, or reach us directly using the details below.
11 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or
for legal/regulatory reasons. The "Last updated" date at the top of this page will always
reflect the most recent revision. Continued use of the Portal or App after changes are
posted constitutes acceptance of the updated policy.