Privacy Policy

Arytan Technologies OPC Pvt. Ltd. — IoT Workshop

Last Updated: [Privacy Policy last-updated date - to be confirmed]

Not ready to publish

This page is complete except for company details that only Arytan Technologies OPC Pvt. Ltd. can confirm. They are marked like this in the text below, and nothing has been invented in their place. Set them in config/config.php under legal (or the matching LEGAL_* values in .env), and this banner disappears.

Registered office address
Privacy contact email
Grievance officer name
Grievance officer email
Governing jurisdiction (courts)
Terms & Conditions last-updated date
Privacy Policy last-updated date

1. Introduction

This policy explains what Arytan Technologies OPC Pvt. Ltd. collects when you use IoT Workshop, why we collect it, how long we keep it and what rights you have. It describes the platform as it is actually built.

We do not use advertising or tracking cookies, we do not run third-party analytics, we do not collect location data, and we do not process payments through this platform. Where something is not described below, the platform does not do it.

2. Account information

When you register and use an account, we hold:

your first and last name;
your email address;
your password, stored only as a one-way hash — we never store or have access to your actual password;
whether your email address has been verified, and when;
a short profile biography, if you choose to add one;
the date your account was created and last updated, and the time of your last sign-in;
your account status (for example pending, active or suspended).

Email verification and password reset links are one-time tokens sent to your address. We store only a hash of each token, together with its expiry.

3. Project and IoT data

When you create and use a Project, we store what you and your devices put into it:

the Project's name, description and icon;
its Field configuration and the labels you give your Fields;
its settings, including its visibility setting;
the Entries your devices send — the Field values and the time each Entry was received;
data you import from a file, which is stored as Entries in the same way;
your dashboard and Widget configuration;
a record of each import and export you run, including the file name, the options chosen, the number of rows and the outcome.

We store the IoT data you submit in order to provide the platform's services: to keep it, return it to you through the API and the interface, visualize it and export it. Please do not send personal information about other people through your devices; a Project is a place for sensor readings.

4. API keys

Each Project has a Read API Key, which returns Entries, and a Write API Key, which stores them. We hold each key in encrypted form so that it can be shown to you on the Project's API Keys page, and separately as a one-way hash used to check incoming API requests. We also record when a key was last used.

You are responsible for keeping your API keys private, particularly the Write API Key. You can replace a key at any time by regenerating it, which immediately stops the old one from working.

5. Technical and security information

To keep accounts and the platform secure, we record:

Sessions. For each signed-in session: an identifier, the IP address, the browser or device description your browser reports, when it was last active and when it expires. You can see and revoke your own sessions under Account → Security.
Sign-in attempts. The email address used, the IP address, whether the attempt succeeded and when — used to detect and slow down attacks on accounts.
API requests. For calls to the IoT API: which Project and key were used, the endpoint, the IP address, the HTTP status returned, whether the call was rate limited, and how long it took.
API usage counters. A per-account count of calls made each day, used to apply the daily limit.
Error logs. Technical errors are written to server logs so that faults can be diagnosed.

Administrative actions taken in the admin panel are also recorded, with the administrator's identity, IP address and what was changed.

6. Notifications

The platform sends security notifications by email to the account owner — when the account password is changed, and when it is signed in to from a device and address not seen on the account before. These are sent through the email service described in section 10. The messages themselves are not stored by the platform.

7. Cookies

IoT Workshop sets one cookie, and it is strictly necessary:

iotworkshop_session: Keeps you signed in and protects forms against cross-site request forgery. It holds a random session identifier and nothing else. It is marked HttpOnly, so scripts cannot read it, and SameSite=Lax, so it is not sent from other sites. It expires after about 2 hours, and is removed when you sign out.

There are no advertising, analytics or tracking cookies on this platform, and no third-party cookies. If that ever changes, this section will be updated first.

8. Why we process this information

to create and maintain your account, and to authenticate you;
to verify your email address and let you reset your password;
to provide Projects, Fields, Entries, Widgets and dashboards;
to receive, store, return and visualize the IoT data you send;
to provide REST API access, and to import and export data at your request;
to keep accounts and the platform secure, and to detect and prevent abuse;
to apply platform limits, such as API and rate limits;
to send you service and security notifications;
to respond to your support and privacy requests;
to maintain, fix and improve the service, where permitted by law.

9. How long we keep it

Account information

Kept for as long as your account exists, and afterwards only where retention is necessary for security, to resolve disputes or to meet a legal obligation.

Project data

The Entries collected in a Project are subject to the workshop data-retention policy. The default period is 3 days, and the applicable retention period is controlled by the Administrator and may change. The period runs from the date and time the Project was created. When it expires, the collected data is cleared automatically while the Project, its configuration, Fields, Widgets and API keys remain. Your remaining time is shown on your Account page.

Security and technical records

Sign-in attempts, session records and API request logs are kept for security, abuse prevention and diagnostics. Deleting your account removes your account and its Projects and data; certain security records may be retained where necessary for security, fraud prevention, dispute resolution or to meet a legal obligation, and sign-in attempt records are kept without being linked to your account.

11. Your rights

Subject to applicable Indian data-protection law, including the Digital Personal Data Protection Act, 2023 and the rules made under it, you may:

ask what personal data of yours we hold, and request a copy;
ask us to correct information that is inaccurate or incomplete;
ask us to delete your personal data;
withdraw your consent, where our processing is based on consent;
raise a grievance about how your data has been handled.

You can do much of this yourself: update your details under Account → Profile, review and revoke sessions under Account → Security, clear a Project's data or delete a Project from Project Settings, and delete your whole account from the Account page.

Where a legal or security obligation requires us to retain particular records, we may not be able to delete everything on request. If that applies, we will tell you.

12. Students and younger users

IoT Workshop is used in workshops and classrooms. You should use the platform only where you are legally permitted to do so and, where applicable, with the authorisation of a parent or guardian. Where a workshop or institution creates accounts for participants, the organiser is responsible for obtaining any authorisation required.

If the platform is intended to admit minors, this section must be reviewed against the applicable requirements — including verifiable parental consent under the Digital Personal Data Protection Act, 2023 — before publication.

13. How we protect your information

We use reasonable technical and organisational measures to protect your account and your data, including:

passwords stored only as one-way hashes;
API keys held encrypted, and verified against a one-way hash;
server-side authorisation on every request, so a Project can only be reached by the account that owns it;
session controls, including idle and absolute expiry, session review and revocation, and the ability to sign out other sessions;
protection against cross-site request forgery, and a content security policy;
rate limiting and sign-in protections against automated attacks.

No online service can be completely secure, and we do not claim otherwise. Please use a strong, unique password and keep your API keys private.

14. Security incidents

If a personal data breach occurs, we will handle it in accordance with our incident response procedures and applicable law, including notifying the relevant authority and affected users where required and within the timeframes the law prescribes.

15. Changes to this policy

We may update this policy as the platform develops. The current version is always the one published on this page, and the “Last Updated” date shows when it last changed.

16. Contact and grievances

Arytan Technologies OPC Pvt. Ltd.

Privacy contact: [Privacy contact email - to be confirmed]
Grievance officer: [Grievance officer name - to be confirmed]
Grievance contact: [Grievance officer email - to be confirmed]
Registered office: [Registered office address - to be confirmed]