Privacy Notice for Clients

Vastoco Private Limited is the data fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This notice is for clients and is read together with our general Privacy Policy.

Vastoco Private Limited, CIN U63122UW2026PTC259452, registered office at 38, Lokendra Puri, Gari Bhadauriya, Agra, Uttar Pradesh 282002, India. General contact: info@vastoco.in. Grievances and privacy requests: grievance@vastoco.in.

• Account: name, email, mobile or WhatsApp number, password hash and login records. If you use Google Sign-In, your name, email, photo and Google ID.
• Your project: city, requirement, budget, preferences, files and photos you upload, and messages through Vastoco.
• Bookings and payments: professional chosen, time slot, status, amount, invoice details, refund records and Razorpay reference IDs. Not your full card, UPI PIN or banking password.
• Reviews and complaints: what you write, evidence you attach and our notes about the complaint.
• Technical data: IP address, device and browser type, pages viewed and security logs.

• To create and secure your account and verify your mobile number or email.
• To match you with professionals and to process your enquiry or booking.
• To take payments, issue invoices and handle refunds.
• To send confirmations, reminders and service messages. Marketing is sent only if you agree separately.
• To handle support, complaints, fraud checks and legal duties.
• To measure and improve how the platform works.

• For a booking you confirm, the professional sees your name, the requirement and files you shared, your time slot and the contact details needed to run the consultation.
• For an enquiry, a professional on a paid plan can view its details. A professional on a free plan can see that an enquiry exists but not what it says.
• Professionals must use your data only for that consultation or project and must keep it secure.

We do not sell personal data. We share it with service providers who help us run Vastoco, such as Razorpay for payments, Meta WhatsApp and SendGrid for messages, and our hosting, storage and database providers. They may use it only to provide their service to us. We may also disclose data to courts, regulators or law-enforcement bodies when the law requires. The full list is in our Privacy Policy.

• We use your data for the purposes above based on your consent, or where the law allows use without consent, such as meeting a legal duty.
• Marketing messages and non-essential analytics need your separate consent. You can withdraw consent at any time, and it is as easy to withdraw as to give.
• Withdrawing consent does not affect past use, and it may mean we can no longer provide a service that needs that data.

• Account data is kept while your account is active and during deletion.
• Booking, payment, refund and invoice records are kept for as long as tax, accounting and consumer law require.
• Complaint records are kept for the dispute period and as the law requires.
• Security and one-time passcode logs are kept only as long as needed for security and audit.

• Ask for a summary of the personal data we hold about you and who we shared it with.
• Ask us to correct or complete your data, or to erase it where we have no legal reason to keep it.
• Withdraw consent, and nominate a person to exercise your rights if you die or cannot act.
• Make a complaint about how your data was handled.

Write to grievance@vastoco.in from your registered email. We may confirm your identity first. We aim to reply within 30 days and will tell you if we need longer and why.

Vastoco is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.

We protect data with HTTPS, access controls, private file storage and limited staff access. No system is completely secure. If a personal data breach happens, we will inform affected people and the Data Protection Board of India as the law requires.

We may update this notice when our services or the law change. The new effective date will be shown at the top. We will give reasonable notice of a material change, and where the law requires your fresh consent we will ask for it. A change does not reduce any right you already have under the law.

If you have a complaint about this document, your data or how you were treated on Vastoco, write to our Grievance Officer. You can also use the Grievance Redressal page to see the full process and where to escalate.