Privacy Policy

Alfa HazardX is operated by Agresh Agrawal from Indore, Madhya Pradesh, India. He is the data controller and the person who answers requests under this policy. There is no separate privacy department; enquiries go to agresh@agreshagrawal.com.

Nothing is collected until you submit something.

• Enquiries. Name, email, phone, company, industry and your message. Your IP address and browser user agent are stored with it, to make spam traceable.
• Newsletter. Your email address, and whether you are subscribed. Every issue carries a one-click unsubscribe.
• Job applications. The details on the form and your CV. CVs go into a private storage bucket that is not reachable by URL — access is granted for five minutes at a time to a signed-in administrator.
• Buying an Alfa Hexa. Your verified email address, the factory profile and questionnaire you fill in, your orders, and payment references returned by Razorpay.
• Dashboard accounts. Email address, sign-in events, and the plants you have been granted access to.
• Deployed hardware. Sensor readings, device status and incidents from nodes at your site.
• Windows notifications. Only if you turn them on in the app or the dashboard: the push address your browser or the Alfa HazardX app creates for that device, its two encryption keys, and which account it belongs to. Nothing else about the device is read.

We never see your card or UPI details. Those are entered inside Razorpay’s own payment window and do not reach this site. We store the payment identifiers Razorpay gives us — enough to trace a payment, never enough to make one.

Two, both strictly necessary, neither used for tracking.

• Dashboard session. Set by Supabase when you sign in to the operator dashboard.
• Buyer session (hx_buyer). Set after you verify your email in the buy flow, so a saved checkout can be restored. It holds a random token; the database stores only that token’s SHA-256, so a copy of our database cannot be used to sign in as you.

There is no advertising cookie, no analytics cookie and no consent banner, because there is nothing to consent to.

Only the services the product needs to function. Each is named because “trusted third parties” is not a disclosure.

• Supabase — database, authentication and file storage.
• Vercel — hosting and content delivery.
• Resend — outbound email: verification codes, receipts, the newsletter.
• Razorpay — payment processing. They are the controller of your payment credentials, not us.
• Your device’s push service — Microsoft for Windows and Edge, Google for Chrome — delivers notifications you have turned on. It receives the notification itself (an incident or forecast title and one line), encrypted end to end so that only your device can read it.
• OpenAI — used only to explain a hazard the deterministic layer has already classified. Sensor values and device context are sent; customer contact details are not.

Your data is not sold, rented, or shared with anyone for advertising. It is not shared between customers: one plant cannot see another’s readings, and that is enforced in the database by row-level security rather than only in the application.

• Enquiries and applications — until they are dealt with and for a reasonable period afterwards, then on request at any time.
• Orders and payment records — retained for as long as tax and accounting law requires. These are the one category we cannot delete on request while that period runs.
• Verification codes — expire in 15 minutes and are purged.
• Buyer sessions — expire after 30 days.
• Newsletter — until you unsubscribe.
• Notification subscriptions — until you turn notifications off or uninstall the app. One the push service reports as gone is deleted the next time an alert is sent. If your access is removed, nothing more is sent to it.

You can ask for a copy of what we hold about you, ask for it to be corrected, ask for it to be deleted, or withdraw consent to email. Email agresh@agreshagrawal.com and say which. We will act on it, and we will tell you plainly if something must be retained for the accounting reason above rather than quietly not doing it.

Traffic is served over HTTPS. Verification codes and session tokens are stored as SHA-256 hashes, never in plain text. CVs sit in a private bucket. Per-plant isolation is enforced in the database. Payment credentials never touch our servers.

What we will not claim: no system is impossible to breach, this one has not been independently penetration-tested, and it holds no security certification. If that changes, this paragraph changes with it.

This document is part of the site’s source code, so every change to it is a dated commit. The date at the top is the date of the last one.