Privacy Policy

This explains what Anarpakaya collects when you visit merp.udyogya.com or use Udyogya, why, who else touches it, and how long we keep it. It is written to be read, not to be survived.

The short version. We hold your business records so the software can run your plant. We do not sell data, we run no advertising or analytics trackers (we only count visits to this website ourselves, without cookies), and we never receive biometric templates from attendance terminals — only an enrolment number and a time.

1. Who is responsible for what

For your account — the company that signed up, the people who sign in, billing details — we are the controller.
For the data you put into the product — your workers, customers, suppliers, transactions — your company is the controller and we are the processor. We handle it on your instructions to run the service. If you are an employee of one of our customers and want to see or correct your record, ask your employer; they hold the controls, and we will help them.

2. What we collect

Kind	What it is	Why
Account	Company name, address, tax registration, your name, email, phone, password (stored only as a salted hash)	To create your workspace, sign you in, and reach you
Business records	Items, stock, BOMs, work orders, purchases, sales, quality records, maintenance, the ledger	They are the product — the software cannot run your plant without them
People records	Worker and staff names, codes, department, date of birth, sex, wage terms, attendance, leave, payslips	Attendance, payroll and statutory registers you asked the software to keep
Attendance punches	An enrolment number, a terminal id and a timestamp	To mark the muster. No biometric templates are requested or stored
Contacts	Customer and supplier names, addresses, GSTINs, contact details	Orders, invoices and the tax documents that carry them
Billing	Invoices, payment references, amounts. Never card numbers	To charge for the subscription and issue tax invoices
Technical	Sign-in times, IP address, the browser you used, error logs, an audit trail of changes	Security, fraud prevention, and answering "who changed this?"
Sign-in codes	Where your company switches them on: each login's own mobile number; the kind of each browser it has confirmed (for example "Chrome on Windows") and when it was last used; two times per login, each overwritten — when its current stretch of use began and when it was last seen; and on how many days it was asked for a fresh code after 14 hours	One login per person, as your company chose. Never a history of what was done

3. Cookies

One cookie, and it is the session cookie that keeps you signed in. It is http-only (script on the page cannot read it), sent only over HTTPS, and it expires. We run no advertising cookies, no analytics trackers and no third-party pixels — there is nothing here to opt out of.

Counting visits to this website. When someone opens our public website, our own server counts the visit: the day, the page, the campaign tags in the link they followed (for example utm_campaign) and the name of the website that sent them. To tell two visits by the same person on the same day apart, it keeps a scrambled code made from the request's address and browser with a random key that is destroyed when the day ends — so the code cannot be traced back to anyone, and no address is stored. No cookie is set and nothing is shared with anyone. If a company signs up in that same visit, the campaign tags are kept on its record, so we know which advertisement brought it.

Product pages. When someone scans the QR code on a manufacturer's product, the page they open is run by us for that manufacturer. We note the product's code, the time and only the first part of the network address (never the full address) — so that a label copied onto other boxes can be spotted. If the person registers the purchase, raises a complaint or asks for the product's service history, we first confirm their mobile number with a one-time code, then keep the number (and the name they give, if any; for a complaint also their address and what is wrong) in that manufacturer's records, for its after-sales service. The manufacturer is responsible for that information; we process it on its behalf.

Repair visits. When a manufacturer asks for it, the phone of a repair shop's technician is asked for its location while a service visit is being recorded, and one location (with how precise the phone said it was) is kept on that visit — the technician is told on the visit form and may refuse, which is recorded. It is used only to show the visit was made at the customer's address, by the manufacturer's service desk.

4. How we use it

To provide the service you signed up for, and to keep it correct.
To secure it — throttling sign-in attempts, keeping an audit trail, investigating misuse.
To bill you and issue tax documents, and to meet our own tax obligations. What you pay is worked out from your plants and your logins and their roles — we never read your business records to price you.
To support you when you ask, including entering your workspace with support access, which is written into your own Changes log.
To tell you things you need to know about your account: renewals, changes to these policies, incidents.

We do not sell personal data, and we do not use your business data to train AI models.

Only the providers we need to run the service, each under contract, each doing one job:

Provider	What they do	What reaches them
DigitalOcean (Bangalore, India)	Hosts the application and the database	All service data, encrypted in transit and at rest
Cloudflare	Sits in front of the website, protecting it from attacks; and the plain-HTTP door old attendance terminals can reach	Traffic passing through it, encrypted; for terminals, punches only: enrolment number, time, terminal serial
Razorpay	Takes online subscription payments	Your billing contact and the amount. Card details go to them, never to us
Anthropic	Powers the AI features, when you use one	Only the records that feature needs — a scanned bill, a machine history, a statement line. Not used to train public models
ImageKit	Stores photos of customers' bills, warranty cards and receipts attached to service jobs, and the photos a repair shop takes at a service visit (the unit, its sticker, the parts, the fault), privately	The photo. A bill photo is deleted 90 days after the job closes, a visit photo 90 days after the repair shop is paid for the job, or after the job closes if nothing is owed for it (longer while a manufacturer's claim on that unit is open); what it showed stays in the job record
2Factor (an automated call, or SMS) and Zoho ZeptoMail (email)	One-time codes, account notices, and the plant digest for those who ask for it by email	Your phone number or email address; for a digest, its summary

We will also disclose data if the law requires it, and we will tell you unless we are forbidden to. If the business is ever sold or merged, your data moves with the service under these same commitments, and you will be told first.

6. Where it lives

The application and database run in DigitalOcean's data centre in Bangalore, India, which is certified by its operator. Some providers above process data outside India; where that happens it is under contractual protections for international transfer. If your own rules require data to stay in one country, tell us before you buy.

7. How long we keep it

While you are a customer, for as long as you keep the record. Your books need history; we do not quietly prune it.
After you leave, 90 days, so you can export or change your mind. Then it is permanently deleted, backups included, on the ordinary backup expiry cycle.
Invoices and tax records we must keep for as long as tax law requires, even after you leave.
Security logs for a limited period, for investigation.
Sign-in codes: a confirmed browser for 90 days after it was last confirmed; a code waiting to be entered for at most a day; a login's mobile number for as long as the login exists.

8. How it is protected

HTTPS everywhere; the punch gateway is a separate door that carries nothing but punches.
Passwords are stored as salted scrypt hashes. Nobody at Anarpakaya can read yours.
Every company's data is fenced by its own identity on every query — not by a filter on a screen.
Permissions are enforced on the server for every action, and nobody can grant a permission they do not hold themselves.
Our own admin console requires a second factor, and every action it takes on a tenant is audited.
A content-security policy, sign-in throttling, and a full change log inside each company.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority without undue delay, with what we know and what we are doing.

9. Your rights

Depending on where you are, you may ask to access, correct, export or delete personal data we hold about you, or object to some processing. Write to us using the details below and we will respond within 30 days. If the data belongs to your employer's workspace, we will point you to them and help them act.

10. Children

Udyogya is software for businesses and their customers' after-sales service. It is not directed at children, and we do not knowingly collect personal information online from a child under 13 (the US Children's Online Privacy Protection Act) or, without a parent's or guardian's verifiable consent, from anyone under 18 (India's Digital Personal Data Protection Act, 2023).

Product pages (registering a purchase, raising a complaint, seeing a product's service history) are meant for adults and say so; someone under 18 is asked to have a parent or guardian use them. We do not track, profile or show advertising to anyone — children included: there is one sign-in cookie, and visits are counted without cookies (section 3).

Worker records. A business may record its own workers for attendance and payroll, including a worker's date of birth. The software refuses anyone below the legal working age set for that company. These records are entered by the employer, not collected from the worker online; the employer is responsible for any consent the law asks of it.

If you believe a child has given us personal information, write to us at the address below. We will delete it promptly — and a parent or guardian may ask to see what was collected first.

11. Contact

Questions, requests or complaints about privacy go to:

Anarpakaya

Email admin@udyogya.com · Phone +91 63676 36814

If you are not satisfied with our answer, you may complain to your local data-protection authority.