Privacy Policy

Introduction

This Privacy Policy outlines how your personal and operational data is collected, used, and safeguarded when using Prayagh FactoryFlow. Prayagh FactoryFlow is a proprietary, internal enterprise application developed by Orvantia exclusively for Prayagh Consumer Care Pvt. Ltd.

Prayagh FactoryFlow is not a public service. It is designed solely for use by authorized personnel of Prayagh Consumer Care Pvt. Ltd. to manage internal operations, tasks, and communications.

Data Controller & Ownership

Prayagh Consumer Care Pvt. Ltd. acts as the Data Controller for all information processed through Prayagh FactoryFlow. All business data, employee records, operational metrics, and communications entered into the system remain the exclusive property of Prayagh Consumer Care Pvt. Ltd.

Orvantia acts as the software provider and maintainer but claims no ownership over the data processed within the system.

Information Collected

Because Prayagh FactoryFlow is an internal tool, the information collected is strictly limited to business operations:

• Employee Information: Your name, corporate email address, assigned role (e.g., SUPER_ADMIN, MANAGER, EMPLOYEE), department affiliation, designation, and account status (active, suspended, blocked).
• Operational Data: Data related to your daily work, including task assignments, descriptions, due dates, comments, queries, priorities, and automatically calculated productivity scores.
• Authentication Data: Login credentials (stored securely using bcrypt hashing), successful and failed login attempts, password reset requests, and session metadata.
• Technical Data: IP addresses and User-Agent strings, which are collected specifically during security events (such as failed logins or account locks) to prevent unauthorized access.
• Communications Content: Messages and content you create or send through the application, including emails composed in the Email Center (recipients, Cc/Bcc, subject, and body), saved drafts and templates, department announcements, in-app notifications, task comments, and queries.
• Diagnostic Data: Error reports and performance measurements collected through our error-monitoring provider solely to find and fix software defects. We do not record or replay your screen or sessions.
• Browser Preferences:Non-sensitive interface settings stored only in your own browser, as described in the Cookie & Session Policy.

Purpose of Collection (Internal Use Only)

Your data is processed strictly for the following internal operational purposes:

• To authenticate you and enforce Role-Based Access Control (RBAC).
• To assign, track, and manage factory floor and administrative tasks.
• To facilitate internal communications through comments, queries, announcements, emails sent from the Email Center, and automated email notifications.
• To notify you of scheduled maintenance and to diagnose and fix defects in the software.
• To generate productivity metrics and operational reports for management.
• To maintain comprehensive audit logs for security, troubleshooting, and compliance.

Data Sharing & Third-Party Services

Prayagh FactoryFlow does not sell, rent, or share your data with external marketers, advertisers, or unauthorized third parties. Data is only processed through approved infrastructure providers necessary to run the application:

• MongoDB Atlas: Used as the primary secure database hosting provider.
• Sentry: Used strictly for error tracking, application performance monitoring, to help developers identify and fix bugs.
• Gmail SMTP: Used to dispatch emails, including automated operational emails (e.g., task reminders, password resets, maintenance notices), department announcements, and emails sent by users from the Email Center.
• Redis: Used for rate limiting, short-lived caching, and delivering real-time updates; it holds transient operational data.

These providers process data on behalf of Prayagh Consumer Care Pvt. Ltd. and operate under their own terms, security practices, and retention policies. Once an email has been handed to the mail provider, the provider’s own copies and the recipients’ mailboxes are outside the control of Prayagh FactoryFlow and Orvantia. Information may also be disclosed where required by law or to protect the security of the platform.

Data Retention

Data within Prayagh FactoryFlow is retained according to Prayagh Consumer Care Pvt. Ltd.’s internal policies and system constraints:

• Activity Logs: General system activity logs (who updated what) are retained for exactly 2 years to conserve database storage.
• Security Events: Audit logs of authentication attempts, IP addresses, and account lockouts are retained for exactly 1 year.
• Operational Records: Tasks, queries, user profiles, and comments are retained indefinitely as part of the permanent business record, unless manually archived or deleted by a Super Admin.
• Sent Email Records: The application’s record of each sent or failed email (including recipients and content) is deleted automatically 7 days after it was last updated; emails still waiting to be sent are kept until they are processed. This does not affect the provider’s or recipients’ own copies.
• Drafts, Templates, and Notifications: Retained until deleted by you or an administrator, or removed with the related account or record.
• Password Reset Tokens: Expire and are deleted automatically.
• Diagnostic Data: Retained by the monitoring provider according to its standard retention schedule.

Security Measures, Monitoring, & Audit Logging

We employ enterprise-grade security to protect internal data:

• Encryption: Passwords are never stored in plaintext; they are securely hashed using bcrypt.
• Authentication: The system uses short-lived, stateless JSON Web Tokens (JWT) stored in strict, secure, HttpOnly cookies.
• Rate Limiting: A distributed Redis-based rate limiter prevents brute-force login attacks.
• Monitoring & Audit Trails: Every significant action (task creation, status change, query resolution) is recorded in an immutable Activity Log. System administrators can monitor this data to ensure compliance with company policies.

User Rights & Responsibilities

As an employee, you are responsible for maintaining the confidentiality of your login credentials. You must not share your password or attempt to bypass the Role-Based Access Controls (RBAC) implemented in the system.

If you notice any inaccuracies in your employee profile (such as department or designation errors), please contact your reporting manager or a system administrator to have it corrected.

Changes to this Policy

This policy may be updated as the application, its features, or its service providers change. The “Last updated” date at the top of this page shows when it last changed. Continuing to use Prayagh FactoryFlow after an update means you accept the updated policy.

Contact Information

If you have questions about this Privacy Policy or how your data is handled within Prayagh FactoryFlow, please contact Orvantia.

For technical issues or bugs related to the software platform itself, please submit a support ticket so the issue can be escalated to Orvantia.