Privacy Notice for Students

Vastoco Private Limited is the data fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This notice is for students and is read together with our general Privacy Policy.

Vastoco Private Limited, CIN U63122UW2026PTC259452, registered office at 38, Lokendra Puri, Gari Bhadauriya, Agra, Uttar Pradesh 282002, India. General contact: info@vastoco.in. Grievances and privacy requests: grievance@vastoco.in.

• Account: name, email, mobile or WhatsApp number, password hash and login records.
• Profile: photo, college or institution, course, graduation year and bio.
• Verification: your college or student ID document and the review outcome.
• Uploads and activity: images, videos, descriptions, tags, comments you write and reports you make.
• Technical data: IP address, device and browser details and security logs.

• Public: your name, photo, college, course and graduation year if you enter them, your bio, the Student verified badge and every upload with its description and tags. Search engines may index it.
• Private: your ID document, email, mobile number, login details and internal verification notes.

• To create your account and verify that you are a student.
• To show your profile and uploads on Vastoco and on the Inspiration page.
• To send service messages. Marketing is sent only if you agree separately.
• To prevent fake accounts and copied work, moderate content, handle complaints and meet legal duties.
• To improve the platform.

Anyone can see your public profile and uploads. Only authorised Vastoco reviewers can open your ID document. We use service providers for hosting, storage, database, messaging and email, and they may use your data only to provide that service to us. We may disclose data to courts, regulators or law-enforcement bodies when the law requires. We do not sell your data.

• Account, profile and uploads are kept while your account is active.
• Your ID document is kept private for as long as your account is active, so that we can handle any dispute about your badge, and is deleted within 90 days after you close your account unless the law or a dispute requires longer.
• Complaint and security records are kept for as long as needed for the complaint, security and the law.

• Ask for a summary of the personal data we hold about you.
• Ask us to correct it, or to erase it where we have no legal reason to keep it. You can also delete your own uploads at any time.
• Withdraw consent for optional uses, such as marketing.
• Nominate a person to exercise your rights if you die or cannot act, and make a complaint.

Write to grievance@vastoco.in from your registered email. We aim to reply within 30 days.

You must be 18 or over to register. Under the DPDP Act, a person under 18 needs a parent's or guardian's verifiable consent for their data to be processed, and we do not offer that route. If we find an account held by someone under 18, we will close it and delete the data.

We use HTTPS, access controls, private storage for ID documents and limited staff access. If a personal data breach happens, we will inform affected people and the Data Protection Board of India as the law requires.

We may update this notice when our services or the law change. The new effective date will be shown at the top. We will give reasonable notice of a material change, and where the law requires your fresh consent we will ask for it. A change does not reduce any right you already have under the law.

If you have a complaint about this document, your data or how you were treated on Vastoco, write to our Grievance Officer. You can also use the Grievance Redressal page to see the full process and where to escalate.