How we collect, use, and protect your information

1. Who We Are

A3 Innovations ("we", "us", or "our") is an India-based technology company. We operate:

• Company website: a3innovations.in
• HuaKya: a team task and accountability app (iOS, Android, and web) at huakya.a3innovations.in / web.huakya.in
• InOutRegister: a physical document inward/outward register app (iOS and Android) at inoutregister.a3innovations.in
• Phirti: a field-duty tracking app for teams (iOS, Android, and web) at phirti.a3innovations.in

This policy covers personal information collected through those websites, apps, accounts, contact forms, support channels, and related communications. HuaKya, InOutRegister, and Phirti are our products, not independent third-party companies.

Depending on how you use a product, we may act as a data controller (for example, for your account, billing, and our website) and/or as a processor on behalf of a company workspace owner (for example, employee task, document, or location data that a business stores in our apps).

2. Information We Collect

We collect information you provide, information created when you use a product, and information from service providers (such as app stores and authentication vendors). Categories include:

Account and identity

• Name / display name, phone number, email address, profile photo, and company or workspace name
• Authentication identifiers (Firebase Auth UID and sign-in provider IDs)
• HuaKya and Phirti: phone number used as the primary login (OTP). InOutRegister: email/password, Google Sign-In, and/or Sign in with Apple
• HuaKya and Phirti may keep a limited public profile index (for example phone and photo) so other signed-in users in the product can match teammates; this is for product features, not a public internet directory

Contact, support, and website inquiries

• Name, email, phone, service interest, and message from our website contact form
• WhatsApp, email, and other messages you send us
• Support tickets, attachments, and contact preferences

Product and workspace content

• HuaKya: tasks, chats, mentions, ETAs, tags, assignees/supervisors, attachments, search content, reports, and company membership/roles (owner, supervisor, member)
• InOutRegister: company labels, document names, parties, dates, notes, status history, and document photos
• Phirti: duty sessions, check-ins, expenses and receipts, meetings (including external contact name/phone where entered), attendance/duty logs, company settings, and member roles (owner, supervisor, member)

Location (HuaKya and Phirti)

• Phirti: precise location while on duty, including background location, GPS breadcrumbs/route history, live position shared with authorized company owners/supervisors, geofence/site data, and related integrity signals (for example, mock-GPS or jump detection)
• HuaKya: optional location shares in chat (for example, a map link) and, where Field Duty features are enabled, similar duty/check-in location and photo data
• Battery or device signals associated with a duty session where the product records them

Device permissions and media

• Camera and photo library (task attachments, document images, check-in photos, receipts, profile photos)
• Contacts (HuaKya and Phirti, for inviting teammates or sharing contact details you choose)
• Microphone / speech recognition (HuaKya, for dictation where enabled)
• Push notification tokens (HuaKya and Phirti)
• Technical data such as app version, device/browser type, IP address, and crash or diagnostic data where enabled

Payments and subscriptions

• Subscription status, plan, purchase or transaction identifiers, and related billing events for Apple App Store and Google Play in-app purchases (Premium/Pro)
• We do not receive your full card number from Apple or Google. Payment is processed by the store

Cookies and local storage (websites)

• Theme preference and similar essential/functional storage
• Analytics or similar cookies if used. See our Cookie Policy

Other

• OTP hashes or similar login-security records, FCM/push tokens, and billing-event logs
• Photos or files that remain on your device (for example some InOutRegister images stored as local paths) in addition to any cloud copy
• Information you include in demo, trial, or App Store review accounts

3. How We Use Your Information

We use personal information to:

• Create and authenticate accounts and workspaces
• Provide, operate, and improve HuaKya, InOutRegister, Phirti, and our website
• Deliver core product features (tasks, documents, duty tracking, maps, notifications, search, reports, exports)
• Process subscriptions and restore purchases
• Send transactional messages (OTP SMS, invites, duty/system notifications, scheduled reports or Excel exports you configure)
• Provide customer support and respond to inquiries and demos
• Maintain security, prevent spam and abuse, and protect the integrity of location/duty data where applicable
• Comply with law and enforce our Terms

We do not sell your personal information. We do not share it with third parties for their own cross-context advertising. We do not use your workspace content to train public generative-AI models.

3A. Legal Bases and Sensitive Data

Where a “lawful basis” is required (including India’s DPDP Act and, if you are in the EEA/UK, GDPR), we rely on one or more of: performance of a contract with you; your consent (including device permissions and optional features); legitimate interests in operating, securing, and improving the services in a way that does not override your rights; compliance with law; and processing on behalf of your organization as a processor when they are the controller of workspace data.

We do not require government ID, health records, caste, religion, or biometric templates to use the products. If you or your organization upload such data into tasks, notes, documents, or photos, you do so at your own risk and must have a lawful basis. Precise location and workplace activity data in Phirti (and HuaKya Field Duty, if enabled) is sensitive operational data: organizations must limit it to on-duty purposes and required notices.

We do not use fully automated decision-making that produces legal or similarly significant effects about you without human involvement (for example, we do not auto-terminate employment). Location-integrity flags may be shown to your organization for them to review.

4. Product-Specific Practices

HuaKya

HuaKya is a team accountability product. Tasks, chats, and attachments in a company workspace are visible to authorized members of that workspace. Owners and supervisors may see company-wide tasks and reports. We may index task and message content with a search provider so you can find work in the app. Invites may be sent by SMS to phone numbers you provide. If Field Duty or live-location features are enabled, authorized managers may see duty status, check-in photos, and location history for team members using those features.

InOutRegister

InOutRegister tracks inward and outward physical documents for a business (it is not an employee attendance or GPS product). Document records and photos you enter are stored in your account. If you enable email export, register data (which may include personal or business details) is sent to the email addresses you configure, including scheduled Excel exports.

Phirti

Phirti is a field-duty product. Precise location is central to the service while a member is on duty, including background collection and live sharing with company owners/supervisors. Members typically see their own live map; supervisors/owners may see the team. Check-in photos, expenses, meetings, and duty logs are visible to authorized workspace roles. Companies may configure report emails. Location is intended for on-duty work tracking; using the product to monitor people off-duty or without appropriate workplace notice is not the intended use.

Company website

When you submit our website contact form, we process the submission through a form-delivery provider (Web3Forms) so we can receive it by email and follow up.

5. Workplace and Company Workspaces

HuaKya and Phirti are designed for organizations. If your employer or another organization invites you, they typically decide who joins, what roles they have, and what work data is stored. They may see information you create in that workspace (including, for Phirti, on-duty location). You should use these products only if your organization has a lawful basis and has informed staff as required (for example, under applicable employment and data-protection laws in India, including the Digital Personal Data Protection Act, 2023, where it applies).

Workspace owners are responsible for the personal data they instruct us to process about their members and any third parties (invitees, meeting contacts, report recipients).

6. How We Share Information

We share information with:

• Other users in your workspace according to product roles and settings (owners, supervisors, members)
• People you choose such as invitees, meeting contacts, or export/report email recipients
• Service providers who help us run the products, including:
  • Google Firebase (authentication, database, storage, cloud functions, hosting, and push messaging)
  • Apple App Store and Google Play (accounts, distribution, and in-app purchases)
  • SMS providers such as MSG91 and Twilio (OTP and invite messages for HuaKya and Phirti)
  • Search providers such as Algolia (HuaKya task/message search)
  • Map, routing, and geocoding providers (for example self-hosted or third-party tiles, OSRM routing, and OpenStreetMap/Nominatim geocoding used by Phirti and related map features)
  • Email delivery providers for reports, support, and InOutRegister exports
  • Website form delivery (Web3Forms) for a3innovations.in inquiries
• Professional advisors or partners only as needed to deliver a service you request
• Authorities when required by law or to protect our rights, users, or the public

Processors are expected to use data only to provide their service to us and to protect it appropriately. If we sell or reorganize the business, personal data may transfer to a successor under this policy or equivalent protection.

We may disclose information to defend legal claims, investigate fraud or security incidents, or enforce our Terms. We will not disclose more than we reasonably believe is necessary.

7. International Transfers

We are based in India. Some infrastructure and vendors (for example Google, Apple, SMS, search, or email providers) may process data in India and other countries, including the United States. Phone numbers from India and the United States may be collected for HuaKya and Phirti login. Where data is transferred, we take steps appropriate to the circumstances, including vendor contracts and security controls. If you are in a region that requires a specific transfer mechanism (such as standard contractual clauses), we will use one when our vendors provide it.

If you are a California resident (or another US state with similar laws), you may have rights to know, delete, and opt out of “sale” or certain “sharing.” We do not sell personal information as those laws typically define sale. To exercise rights, contact us as in Section 16. We will not discriminate against you for exercising privacy rights.

8. Data Retention

We keep information for as long as needed to provide the services, maintain workspaces, handle billing and support, resolve disputes, and meet legal requirements. Typical patterns:

• Website inquiries: kept as needed to respond and for reasonable business records
• App accounts and workspace content: kept while the account or company workspace remains active
• Duty location history, chats, documents, and attachments: kept until deleted by an authorized user or until the workspace/account is removed, subject to backups and legal holds
• Billing records: kept as required for tax, store, and accounting rules

When information is no longer needed, we delete or anonymize it where reasonably possible.

9. Account Deletion

Where an app provides delete-account, we remove or de-identify your login identity and profile data we control. Content you contributed to a shared company workspace (tasks, chats, documents, duty history, photos) may remain because it is part of that organization’s records, unless the workspace owner deletes it or applicable law requires erasure. Store subscriptions must be cancelled in your Apple or Google account settings; deleting the app account does not always stop store billing by itself.

10. Data Security and Incidents

We use reasonable technical and organizational measures, including authenticated access, cloud security controls, encryption in transit where provided by our vendors, and role-based workspace permissions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your device and login (including OTP SMS and store accounts).

If we become aware of a personal-data breach that is likely to cause significant harm, we will take steps required by applicable law, which may include notifying affected users, workspace owners, and/or the Data Protection Board of India or other authorities, without unreasonable delay after we confirm the incident.

11. Your Rights

Depending on applicable law (including India’s DPDP Act where it applies), you may have the right to:

• Access personal information we hold about you
• Correct inaccurate information
• Request deletion, subject to legal, security, or workspace-record limits
• Withdraw consent where processing is based on consent (for example, optional device permissions)
• Nominate another person to exercise rights on your behalf, where the law provides

Employees or contractors using a company workspace should also contact their organization, because that organization may control the workspace data. To exercise rights with us, use the contact details below. We may need to verify your identity.

12. Children's Privacy

Our website and products are built for businesses and working adults. They are not directed to children under 13, or under 18 where a product is used as an employment/workplace tool. We do not knowingly collect personal information from children. If you believe we have, contact us so we can delete it.

13. Device Permissions, Cookies, and Marketing

You can withdraw permission for camera, location, contacts, microphone, photos, or notifications in your device settings. Some product features will not work without those permissions (especially Phirti location). Website cookies and similar technologies are described in our Cookie Policy. We do not currently respond to browser Do Not Track signals.

We use your contact details for service messages. We will not send promotional SMS or email unless you opt in, except where allowed as existing-customer communications. You can opt out of marketing by contacting us; transactional OTP, billing, and security messages may still be sent.

14. Third-Party Links and Stores

Our sites and apps may link to Apple, Google, maps, WhatsApp, or other external services. Those services have their own privacy practices. This policy covers A3 Innovations products listed in Section 1. It does not cover unrelated third-party websites we do not operate. App Store and Play listings may include a privacy “nutrition label” summary; this policy is the detailed notice. If they ever differ, this policy plus in-app prompts control for our processing.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of our websites or apps after an update means you acknowledge the revised policy. Material changes may also be highlighted in-app or on the website where practical. If a change requires fresh consent under law, we will request it.

16. Contact, Grievance, and Complaints

For privacy questions, access/deletion requests, or complaints, contact us. We will try to resolve requests within the time required by applicable law (including, where DPDP applies, the timelines then in force). You may also have the right to complain to the Data Protection Board of India or another supervisory authority.

Until we publish a dedicated Grievance Officer name as required under applicable Indian law, privacy complaints may be sent to the email below and will be handled by our support/privacy contact.