Privacy Policy

This explains what Anarpakaya collects when you visit merp.udyogya.com or use Udyogya, why, who else touches it, and how long we keep it. It is written to be read, not to be survived.

The short version. We hold your business records so the software can run your plant. We do not sell data, we run no advertising or analytics trackers, and we never receive biometric templates from attendance terminals — only an enrolment number and a time.

1. Who is responsible for what

For your account — the company that signed up, the people who sign in, billing details — we are the controller.
For the data you put into the product — your workers, customers, suppliers, transactions — your company is the controller and we are the processor. We handle it on your instructions to run the service. If you are an employee of one of our customers and want to see or correct your record, ask your employer; they hold the controls, and we will help them.

2. What we collect

Kind	What it is	Why
Account	Company name, address, tax registration, your name, email, phone, password (stored only as a salted hash)	To create your workspace, sign you in, and reach you
Business records	Items, stock, BOMs, work orders, purchases, sales, quality records, maintenance, the ledger	They are the product — the software cannot run your plant without them
People records	Worker and staff names, codes, department, date of birth, sex, wage terms, attendance, leave, payslips	Attendance, payroll and statutory registers you asked the software to keep
Attendance punches	An enrolment number, a terminal id and a timestamp	To mark the muster. No biometric templates are requested or stored
Contacts	Customer and supplier names, addresses, GSTINs, contact details	Orders, invoices and the tax documents that carry them
Billing	Invoices, payment references, amounts. Never card numbers	To charge for the subscription and issue tax invoices
Technical	Sign-in times, IP address, the browser you used, error logs, an audit trail of changes	Security, fraud prevention, and answering "who changed this?"

3. Cookies

One cookie, and it is the session cookie that keeps you signed in. It is http-only (script on the page cannot read it), sent only over HTTPS, and it expires. We run no advertising cookies, no analytics trackers and no third-party pixels — there is nothing here to opt out of.

4. How we use it

To provide the service you signed up for, and to keep it correct.
To secure it — throttling sign-in attempts, keeping an audit trail, investigating misuse.
To bill you and issue tax documents, and to meet our own tax obligations.
To support you when you ask, including entering your workspace with support access, which is written into your own Changes log.
To tell you things you need to know about your account: renewals, changes to these policies, incidents.

We do not sell personal data, and we do not use your business data to train AI models.

Only the providers we need to run the service, each under contract, each doing one job:

Provider	What they do	What reaches them
Railway (on Google Cloud)	Hosts the application and the database	All service data, encrypted in transit
Cloudflare	The plain-HTTP door old attendance terminals can reach	Punch traffic only: enrolment number, time, terminal serial
Razorpay	Takes online subscription payments	Your billing contact and the amount. Card details go to them, never to us
Anthropic	Powers the AI features, when you use one	Only the records that feature needs — a scanned bill, a machine history, a statement line. Not used to train public models
SMS and email providers	One-time codes and account notices	Your phone number or email address

We will also disclose data if the law requires it, and we will tell you unless we are forbidden to. If the business is ever sold or merged, your data moves with the service under these same commitments, and you will be told first.

6. Where it lives

The application and database run in the region our hosting provider serves us from, with data centres certified by their operators. Some providers above process data outside India; where that happens it is under contractual protections for international transfer. If your own rules require data to stay in one country, tell us before you buy.

7. How long we keep it

While you are a customer, for as long as you keep the record. Your books need history; we do not quietly prune it.
After you leave, 90 days, so you can export or change your mind. Then it is permanently deleted, backups included, on the ordinary backup expiry cycle.
Invoices and tax records we must keep for as long as tax law requires, even after you leave.
Security logs for a limited period, for investigation.

8. How it is protected

HTTPS everywhere; the punch gateway is a separate door that carries nothing but punches.
Passwords are stored as salted scrypt hashes. Nobody at Anarpakaya can read yours.
Every company's data is fenced by its own identity on every query — not by a filter on a screen.
Permissions are enforced on the server for every action, and nobody can grant a permission they do not hold themselves.
Our own admin console requires a second factor, and every action it takes on a tenant is audited.
A content-security policy, sign-in throttling, and a full change log inside each company.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority without undue delay, with what we know and what we are doing.

9. Your rights

Depending on where you are, you may ask to access, correct, export or delete personal data we hold about you, or object to some processing. Write to us using the details below and we will respond within 30 days. If the data belongs to your employer's workspace, we will point you to them and help them act.

The service is for businesses. It is not directed at children, and we do not knowingly collect data from them. Where a customer records a worker's age, the software refuses to accept anyone below the legal working age set for that company.

10. Contact

Questions, requests or complaints about privacy go to:

Anarpakaya

Email akshat.sajwan12@gmail.com · Phone +91 63676 36814

If you are not satisfied with our answer, you may complain to your local data-protection authority.