Privacy Policy

Vastoco Private Limited ("Vastoco", "we", "us" or "our"), CIN U63122UW2026PTC259452, operates an India-focused marketplace and SaaS platform connecting adult clients with verified Architects, Interior Designers and Vastu Consultants. We determine why and how personal data is processed for the Vastoco website, applications and services.

This policy explains the personal data we collect, its purpose, our service providers, retention practices and your choices. It applies to visitors, clients, professionals, job applicants and people who contact support.

• Account data: name, email, WhatsApp/mobile number, profile photo, role, password hash and authentication records.
• Identity and eligibility: date of birth or age confirmation and information needed to confirm that the account holder is an adult.
• Professional profile: biography, categories, experience, education, service areas, languages, availability, pricing, portfolio and public profile information.
• Verification: identity documents, professional licences, registrations, qualifications, document numbers, issuing authority, issue and expiry dates and verification status.
• Booking and project data: requirements, notes, selected professional, schedule, consultation status, outcome summary, attachments and communications made through Vastoco.
• Payments: amount, currency, invoice and tax information, payment status, refund, payout and processor reference IDs. We do not store full card, UPI PIN or online-banking credentials.
• Content: reviews, questions, answers, complaints, support evidence and content moderation history.
• Careers: resume, contact details, work history, application answers, interview notes and application status.

If you use Google Sign-In, we request only your name, email address, profile photo and Google account identifier to create, connect or authenticate your Vastoco account. Google does not provide us your Google password, age or phone number.

We do not request Gmail, Drive, Contacts or Calendar access for sign-in. Google data is not used for advertising, retargeting, credit decisions, sale or brokerage of data, or training general-purpose AI models. Vastoco's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including Limited Use requirements.

We use your verified number and email to deliver one-time passcodes, security alerts, booking confirmations, verification updates, service messages, consultation reminders and support responses. For an upcoming consultation, we may send more than one reminder at reasonable intervals so both parties have a fair opportunity to attend or reschedule.

Promotional offers and marketing are sent only after separate opt-in where required. You may opt out of marketing without losing essential account, transaction, safety or booking messages. WhatsApp delivery is also subject to Meta's platform rules and approved message templates.

When you use Vastoco, we may collect IP address, timestamps, browser and device type, operating system, referring page, pages viewed, interactions, approximate region, error information and security logs.

Essential cookies maintain sessions, security and preferences. With consent where required, Google Analytics may use cookies or similar identifiers to help us understand aggregated traffic and feature use. Analytics is not used to obtain sensitive professional documents or payment credentials. You may refuse non-essential analytics without losing core platform access.

• Register, authenticate and secure accounts, including Google and WhatsApp sign-in.
• Verify identity, professional credentials and annual licence renewal status.
• Create public professional profiles and match clients with relevant professionals.
• Operate consultations, payments, refunds, professional payouts and SaaS subscriptions.
• Send reminders, transactional communications and consented marketing.
• Provide support, investigate complaints, moderate content and resolve disputes.
• Detect fraud, prevent misuse, enforce platform rules and protect people and systems.
• Measure performance, diagnose errors and improve usability and reliability.
• Meet accounting, tax, corporate, consumer-protection and lawful regulatory obligations.

Information clearly marked for a professional's public profile—such as name, photograph, category, biography, portfolio, service area, experience, verification indicator, availability, pricing and reviews—may be visible publicly and indexed by search engines. Identity documents, document images, personal contact details, internal verification notes and bank details are not made public unless you expressly choose to publish particular information.

We do not sell personal data. We use providers only for defined operational purposes, including:

• Supabase/PostgreSQL: application database and operational records. We may change database infrastructure while maintaining equivalent safeguards.
• Cloudflare R2: access-controlled storage for documents and media.
• Vercel: hosting, deployment and technical logs.
• Razorpay: payment processing, payment status, refunds and payout references.
• Meta WhatsApp: OTPs and account, booking and consented marketing messages.
• Google: Sign-In and, when activated with appropriate consent controls, Analytics.
• SendGrid: transactional and consented marketing email delivery.
• Video or communication providers: live consultation functionality when offered.

We may disclose data to courts, regulators, law-enforcement agencies or professional bodies when lawfully required, and to advisers or a successor in a genuine corporate transaction subject to confidentiality and applicable law.

• Account and profile data is retained while the account is active and during the deletion process.
• Professional verification documents are retained for the account's duration and up to two years after closure, unless law, an active dispute or a professional obligation requires longer.
• Professional licence number, issuing authority, verification outcome and renewal or expiry dates may be retained to manage annual renewal reminders and verification history.
• Booking, payment, refund, payout, invoice and complaint records are retained for the period required by tax, accounting, consumer-protection and dispute-resolution obligations.
• Security and OTP records are retained only as reasonably necessary for authentication, fraud prevention and audit.
• Career applications may be retained for the recruitment cycle and a reasonable period for legitimate hiring records, after which they are deleted or anonymised.
• Backups may retain deleted data temporarily until they cycle out under controlled backup schedules.

You may request account deletion by writing from your registered email address to info@vastoco.in with the subject "Account deletion request". We may verify identity, explain records that must legally be retained, and ordinarily complete eligible deletion within 30 days.

Removing Vastoco from your Google Account permissions stops future Google authorisation but does not by itself delete your Vastoco account. Deleting the Vastoco account removes the linked Google identifier and profile data unless retention is legally required.

• Request access to a summary of personal data we process about you.
• Correct inaccurate or incomplete account and profile information.
• Withdraw consent for optional processing, including marketing and non-essential analytics.
• Request deletion, subject to lawful retention and active dispute requirements.
• Nominate another person to exercise applicable rights in the event of death or incapacity where law provides.
• Raise a grievance and, where available, appeal through the applicable statutory mechanism.

We use measures appropriate to the nature of the data, including HTTPS, password hashing, access controls, private object storage, environment-separated credentials, logging, restricted administrative access and vendor controls. No system is completely secure. If a personal-data breach requires notification, we will notify affected individuals and authorities as required by applicable law.

Some technology providers may process or back up data outside your state or outside India. Where cross-border processing occurs, we use contractual and technical safeguards and comply with restrictions notified under applicable Indian law. Our services remain intended for Indian professionals and Indian projects.

Vastoco is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a minor has submitted personal data, contact us so we can investigate and delete it where appropriate.

Vastoco may use automated tools to detect spam, fraud or suspicious activity and may offer optional assistance such as consultation summaries. We do not rely solely on automated processing to make a legally significant decision about account eligibility without appropriate review. Sensitive verification documents are not used to train general-purpose AI models.

We may update this policy when our services, providers or legal obligations change. The revised policy will show a new effective date. We will provide additional notice before a material change where required.

For privacy requests, questions or complaints, contact:

Please include enough information for us to identify the relevant account or request without sending unnecessary sensitive documents.