Acxa Control System — machine panels, gateways, apps, cloud service and the acxa.in website, provided by Advance Tech India.
Advance Tech India, a sole proprietorship owned by Gurmail Singh Dheri (“Acxa”, “we”, “us”, “our”), makes and supports the Acxa Control System: machine panels, Gateways, the Acxa Control System app for Windows and macOS, the web dashboard at app.acxa.in, the Acxa phone app for Android and iOS, and the cloud service behind them (together, the “Services”). We also run the website acxa.in.
4060/1, 1st Floor, Street No. 0, Beantpura,Privacy, support and grievances: support@acxa.in (see Section 20).
This Policy covers personal data and factory data handled through:
It does not cover services we do not control, such as Razorpay's payment pages, Apple's App Store, Google Play, WhatsApp, or your own factory's records and HR systems.
When a factory uses the Services to record which worker ran which machine and how they performed, the factory decides why and how that information is used. Under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) the factory is the Data Fiduciary for its workers' data (the “controller” under other laws), and Advance Tech India handles that data on the factory's behalf as its Data Processor, under our Terms and Conditions (clause 15).
For the information we need to run our own business — accounts, billing, support, security logs and the record of who accepted our Terms — Advance Tech India is the Data Fiduciary.
If you are a worker in a factory that uses Acxa, please contact your employer first about your data. We will help the factory answer you, and may need its permission before acting on a request about factory records.
The Services are for businesses — knitting factories and the people they authorise — not for consumers or children. A factory owner creates the factory's account at app.acxa.in, or we set it up during onboarding. The phone app is a companion for existing factory accounts.
The account holder's name, email address, mobile number and factory name; a password (handled by Google Firebase Authentication and stored only in scrambled “hashed” form — we never see it); an optional recovery email; the account's role (factory owner, or Acxa staff); email verification, password reset and deletion events; and the version and time of your acceptance of our Terms and Conditions.
Factory name and time zone; Gateways and the machines they serve; machine names and settings; shift timings; roll targets and sample-roll weights; orders; maintenance records; alert thresholds and notification settings.
For each machine, with times: running, stopped, inching or offline; speed (RPM); revolution, counter and roll counts and targets; roll starts and ends; stops and stop reasons; faults and alarms; and device health such as signal strength, firmware version, restarts and power-ups. From this we calculate efficiency, shift summaries, reports and alerts. Machine data is personal data where it can be linked to a worker (Section 6).
Subscription plans, machine counts, amounts, payment and order references, invoices and receipts, and the billing name, address and GSTIN you give us. Card and UPI payments are processed by Razorpay; we do not receive or store full card numbers, CVV or UPI PINs.
Emails, WhatsApp messages and calls you exchange with us, and the emails we send you (such as verification, password reset, payment receipts, plan reminders and alerts).
See Section 11. The assistant is switched off.
Workers enter a worker ID on the Panel when they start work on a machine. The factory may add each worker's name and, optionally, a phone number to its worker list. The Services then record which worker ran which machine and when, and calculate worker efficiency, timings and production figures.
These figures can be wrong (see Terms, clause 12). Where data is missing, worker figures are left blank rather than guessed. The factory decides how the figures are used and must check them before making any decision about a worker. Our Terms require the factory to tell its workers what is recorded and how it is used, to enter only the information needed, and never to enter Aadhaar numbers, bank details, health information or details of anyone under 18.
| Purpose | Examples |
|---|---|
| Provide the Services | Sign-in; live machine status; history; shift summaries; reports; alerts |
| Support and repairs | Setting up a factory; investigating faults, complaints and accuracy; remote updates to Panels and Gateways |
| Billing | Trials, plans, payments, GST invoices and receipts, plan reminders |
| Security | Keeping each factory's data separate; preventing misuse; investigating incidents; logging staff actions |
| Improving the Services | Crash reports; statistics that are aggregated and anonymised so they identify no factory or person |
| Legal | Keeping tax records; recording acceptance of our Terms; answering lawful requests; defending claims |
We do not sell personal data, use it for advertising, or share it with other factories.
India (DPDP Act). We handle account, billing and security data for the specified purposes you agree to when you create an account and accept our Terms, and for legitimate uses the Act allows, such as complying with law. Workers' data is handled for the factory, which is responsible for the notice and the legal ground for it (Section 3). Where we rely on your consent — for example phone notifications — you can withdraw it at any time, without affecting what was done before.
Other countries. Where the EU General Data Protection Regulation or a similar law applies, we rely on performing our contract with the factory, our legitimate interests in running and securing the Services, compliance with legal obligations, and consent where required.
| Provider | What it does for us |
|---|---|
| Google (Firebase and Google Cloud) | Sign-in, databases, server functions, file storage and web hosting |
| Mobile network operators | Internet connection for the SIM cards in Gateways |
| Razorpay | Card and UPI payments |
| Expo, Apple and Google | Phone app updates and delivery of phone notifications |
| Email providers (Microsoft 365 and/or Google) | Sending account, billing and alert emails |
| Sentry (Functional Software, Inc.) | Crash and error reports (Section 5.5) |
| Vercel | Hosting and visitor statistics for the acxa.in website |
| Google Gemini | Only if the ACS Assistant is switched back on — currently off; nothing is sent |
They may use the data only to provide their service to us, under their own terms and security commitments.
Anyone who signs in with your factory's account can see that factory's data, including worker data. You decide who has your login.
Our authorised staff can view a factory's data and account, and change its settings and plan, to set it up, support it, investigate faults and complaints, check accuracy, run billing and keep the Services secure. Staff access is limited to staff roles, and staff actions are logged. To investigate a problem, we may copy a limited time window of a factory's data into our separate test system, replacing worker names where practical, and delete the copy when the investigation is complete, normally within 30 days.
We may disclose data where required by law, court order or a government authority, or to protect rights, property or safety and prevent fraud. If our business is sold, merged or reorganised, data may pass to the new owner under the same protections.
The ACS Assistant is currently switched off, and no factory, machine or worker data is being sent to Google Gemini or any other AI provider. The assistant was removed from the Acxa phone apps in August 2026 and is disabled in the other apps. If we ever switch it back on, it will ask for your explicit consent before sending anything, requests will go through our own servers (no AI key is stored in the app), and we will update this Policy first. Google's terms for Gemini: ai.google.dev/gemini-api/terms.
Transfers outside India are made as permitted by the DPDP Act. Where another law requires a transfer safeguard, we rely on the safeguards offered by our providers. Factories outside India remain responsible for their own local employment and privacy laws.
We keep data only for limited periods, after which it is deleted. At the date of this Policy, the periods are approximately:
| Data | Kept for |
|---|---|
| Minute-by-minute machine history | 30 days |
| Alert inbox entries | 30 days |
| Hourly and daily summaries; machine events (running, stops, faults, rolls); worker sign-ins and shifts; connection events | 90 days |
| Shift summaries and saved report PDFs | 365 days |
| Factory settings, Gateway ownership records, orders, maintenance records, and billing, payment and invoice records | Until deleted by the factory or on closure of the factory's account; tax and accounting records for the period the law requires |
| Your sign-in, profile (including your record of accepting the Terms), notification settings and push tokens | Until you delete your account; they are then deleted immediately |
| Records of actions our staff took on a factory (for example a reset or a wipe) | Kept for security and accountability; not deleted automatically |
| Emails and messages with us | As long as needed to deal with the matter and any follow-up |
Some specific kinds of record may be kept for a shorter or longer time where the feature that uses them needs it (for example, an open sensor-fault record is kept until it is resolved). Data may be removed a few days after its period ends. We will give factory customers at least 30 days' notice before shortening any of these periods, unless the law requires a shorter time.
No backups. We do not keep separate backup copies of Service data, so deleted data cannot be restored. Google's systems store data redundantly for reliability, and after deletion data may remain in Google's systems for a limited period under Google's own processes before it is permanently removed.
Longer only when needed. We may keep particular records for longer where the law requires it, or to resolve a dispute, enforce our Terms or investigate a security incident, only for as long as needed.
Deleting an account. Deleting your login removes your sign-in, profile, notification settings and push tokens immediately (see Delete your account). A factory's machine and worker data is not deleted with one person's login; it is kept for the periods above unless the factory owner asks us to delete the factory's data sooner.
We take reasonable security measures, including: encryption of data in transit (HTTPS/TLS); access rules that keep each factory's data separate and allow access only to that factory's account and our authorised staff; checks on our servers before data is changed; passwords stored only in hashed form by Google; authenticated radio links and locked device chips on Panels and Gateways that support them; and limited, logged staff access.
No system is completely secure. Keep your password secret and report anything suspicious to support@acxa.in. If a personal data breach affects you or your factory, we will tell the factory without undue delay and help it meet any legal duty to inform the Data Protection Board of India or the people affected. For data we are responsible for (Section 3.2), we will inform the Board and the people affected as the law requires.
Depending on where you are and your role, you may have the right to: get a summary of the personal data we hold about you and how it is used; correct, complete or update it; have it erased; withdraw consent; have a grievance dealt with; and, under the DPDP Act, nominate someone to exercise your rights if you die or become unable to. Other laws may give further rights, such as objecting to or restricting some processing and data portability.
Email support@acxa.in with the subject “Data request — Acxa”, giving your name, the account email, the factory name if known, and what you want. We may need to confirm your identity first. We aim to reply within 30 days, and always within any period the law sets.
If you are a worker, please also contact your factory, which decides about its workers' data (Section 3).
If you are not satisfied, contact our Grievance Officer (Section 20). If you are still not satisfied, you may complain to the Data Protection Board of India, or to the data protection authority in your country.
The Services calculate figures and send alerts automatically, but we make no automated decisions about any person that have legal or similarly significant effects. Any decision about a worker is made by the factory, which must check the figures first.
The Services are not for anyone under 18, and our Terms forbid factories from entering personal data about anyone under 18. If you believe we hold such data, email support@acxa.in and we will delete it.
We may update this Policy when our practices, the Services or the law change. We will publish the new version here with a new version date. For changes that materially affect you, we will give at least 15 days' notice by email or in the apps before they take effect, unless the law requires a change sooner. Where the law requires your consent to a change, we will ask for it.
Grievance Officer and privacy contact — Gurmail Singh Dheri, Proprietor, Advance Tech India, at the address below, email support@acxa.in with the subject “Grievance — Acxa”. We acknowledge grievances within 7 days and aim to resolve them within 30 days.
Advance Tech IndiaSupport page: app.acxa.in/support · Terms and Conditions: app.acxa.in/terms