Privacy Policy

1. Personal Data We Collect

We collect data necessary to provide discovery, verification, and consultation services on Vastoco:

• Account Details: Name, email address, phone number, city, user role (Client, Architect, Student, Firm).
• Verification Data: Government IDs (Aadhaar / PAN), COA Registration Numbers, GSTIN Certificates, Degree Marksheets.
• Usage Data: Search queries, saved shortlists, proposal brief submissions, and IP addresses.
• Aadhaar Masking: All uploaded Aadhaar copies have the first 8 digits masked automatically according to UIDAI guidelines.

2. Your Rights Under India's DPDP Act, 2023

As a Data Principal under the DPDP Act 2023, you hold full authority over your personal information:

• Right to Access: Request a summary of personal data processed by Vastoco.
• Right to Correction & Erasure: Update incomplete data or request account and data deletion.
• Right to Withdraw Consent: Revoke processing consent at any time from account settings.
• Right to Grievance Redressal: Escalate privacy concerns to our appointed Data Protection Officer (DPO).

3. Third-Party Data Processors

We share data only with verified infrastructure providers essential for platform operations:

• SendGrid: For transactional verification emails and consultation alerts.
• Razorpay: For processing subscription checkout and escrow payments.
• Cloudinary: For secure storage of media, project portfolios, and private verification documents.
• Google Auth: For single sign-on authentication.

4. Data Retention & Security Standards

Verification documents are encrypted in transit via TLS 1.3 and at rest via AES-256 encryption. We retain active account data for as long as your account remains open, or for up to 7 years for tax and regulatory accounting records.

5. Cross-Border Data Transfers

Some of our infrastructure providers (SendGrid, Cloudinary, Razorpay, Google) may process or store data on servers located outside India. Where this happens, we rely on those providers' own security and compliance certifications, and only share the minimum data necessary for the service they perform (e.g. sending an email, hosting an uploaded file). We do not transfer your personal data to any country the Central Government has restricted under the DPDP Act, 2023.

6. Children's Data

Vastoco is intended for users aged 18 and above, as project and payment decisions require legal capacity to contract under the Indian Contract Act, 1872. We do not knowingly collect personal data from anyone under 18. If we learn that a minor has created an account, we will delete it and the associated data.