Privacy policy
What we collect, why, where it lives and how to make us delete it.
Who we are
XTMA is an operations systems firm. For the purposes of India’s Digital Personal Data Protection Act 2023, XTMA is the Data Fiduciary for the personal data described below.
Questions, requests and complaints about personal data go to hello@xtma.in and are answered within seven working days.
What we collect from this website
- What you type into the brief on /start — your name, company, WhatsApp number and a description of the problem. This is assembled in your browser and is not transmitted anywhere until you choose to send it by WhatsApp, email, clipboard or file.
- Anything you send us directly by email, WhatsApp or phone.
- Standard analytics: pages viewed, approximate region, device and referring source, collected through Google Analytics 4 where it is enabled. We do not use it to identify individuals.
- Server logs kept by our hosting provider, including IP address, for security and diagnostics.
What we collect during an engagement
To diagnose or build an operations system we usually need access to business data: orders, stock, invoices, receivables, dispatch records and the accounts that hold them. That data may contain personal information about your staff, customers and suppliers.
For that data, you are the Data Fiduciary and XTMA acts as a Data Processor on your written instructions. We use it only to deliver the engagement you have asked for. We do not sell it, we do not use it to train general-purpose models, and we do not use one client’s data to serve another.
Why we are allowed to hold it
- To answer an enquiry you sent us, and to follow up on it.
- To perform a contract you have entered into with us.
- To meet our own legal, tax and accounting obligations.
- For our legitimate interest in keeping this website secure and understanding how it is used.
Where it lives, and who else sees it
Enquiry correspondence lives in our business email and messaging accounts. Engagement data lives in your own systems wherever that is possible; where a copy has to sit with us it is held in access-controlled cloud storage.
We use a small number of sub-processors to run the business: cloud hosting and object storage, business email, analytics, and the AI model providers used by the AI Ops Desk. Every sub-processor used on your engagement is named in writing before it touches your data, and you can object to any of them.
We do not sell personal data, and we do not share it with anyone except the sub-processors named for your engagement, or where the law requires it.
How long we keep it
- Enquiries that do not become engagements: 24 months, then deleted.
- Engagement records and correspondence: for the life of the engagement, then as long as tax and contract law requires.
- Client operational data held by us: deleted or returned within 30 days of the engagement ending, or sooner on your written request.
- Analytics: retained for 14 months under the default Google Analytics setting.
Your rights
Under the DPDP Act 2023 you may ask us for a summary of the personal data we hold about you, ask us to correct or complete it, ask us to erase it, nominate someone to exercise these rights on your behalf, and withdraw consent you previously gave.
Write to hello@xtma.in. We will answer within seven working days. If you are not satisfied with our answer you may complain to the Data Protection Board of India.
Cookies
This site sets no advertising or tracking cookies of its own. Where Google Analytics is enabled it sets its own first-party cookies to distinguish sessions; you can block them in your browser without any loss of function on this site.
Changes
If this policy changes materially we will update the date at the top and, where the change affects a live engagement, tell the client in writing.
Contact
Write to hello@xtma.in, WhatsApp or call +91 74269 41235.
The next step
Bring us the messy bit.
- What happens today?
- Where does it slow down?
- What is it costing you?
In twenty minutes we will tell you whether there is something worth fixing — and if there isn’t, we will say so. We reply within four working hours.