1. Who we are
Tech Samrajya, International Finance Centre, 510, VIP Road, Vesu, Surat, Gujarat 395007, is the data fiduciary for the personal data described here. Contact us at support@thevastutool.com or +91 88497 82332.
2. What we collect
- Account data — your name, email address and a one-way hash of your password. We never store your password itself.
- Project data — floor-plan images you upload, plot outlines, orientation, annotations and project names.
- Payment records — plan purchased, amount, transaction reference and status. Card and bank details go directly to our payment gateway and never reach our servers.
- Session data — one record per signed-in device, with the browser’s user-agent string and last-used time, so you can review and revoke your sessions.
- Usage data — the pages visited within the app, with an anonymous session identifier and, when signed in, your account id. Used to understand where the product is confusing. Only collected if you agree when asked on your first visit; decline and nothing is recorded. Your floor plans are never part of it.
- Technical logs — request method, path, status and IP address. Request bodies are never logged.
3. Why we process it
- To provide the service and store your work (performance of our contract with you).
- To take payment and grant the plan you bought.
- To keep accounts secure — rate limiting, lockout after repeated failed sign-ins, session management.
- To send transactional email: email confirmation and password resets.
- To improve the product, using aggregated usage data.
We do not sell your data, do not share it with advertisers, and do not use your floor plans to train machine-learning models.
4. Who we share it with
Only the processors needed to run the service:
- Hosting and database — our infrastructure provider stores the application data.
- Payment gateway — receives your name, email and the amount, in order to process the transaction. Card, UPI and bank credentials are entered on the gateway’s own page under its privacy policy, and never reach us.
- Email provider — receives your email address and the message content, in order to deliver confirmation and reset emails.
We also disclose data where the law requires it.
5. Payments and card data
Payments are taken by an RBI-authorised payment aggregator, acting as an independent data controller for the payment itself. When you buy a plan we send it your name, your email address and the amount; it collects the payment instrument from you directly.
Your card number, CVV, UPI PIN, net-banking password and any other credential are entered on the gateway’s own page, under its privacy notice, and never reach our servers — we could not disclose them if we were asked, because we never hold them. What we do keep is the ledger row for the purchase: the amount, the plan, the date, and the gateway’s payment reference, which is what lets us issue an invoice, answer a billing question, and process a refund.
The gateway processes payment data under its own policies and the RBI’s rules for payment aggregators, including card tokenisation. Its identity and privacy notice are shown on the checkout screen at the moment you pay.
6. How long we keep it
- Account and project data — while your account is open. Deleted projects are recoverable for 30 days, then permanently removed.
- Usage records — 180 days, then deleted automatically.
- Sessions and expired tokens — cleared automatically once expired.
- Payment records — retained as long as tax and accounting law requires, even after account closure.
7. Your rights
You may ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate;
- delete your account and its data;
- nominate someone to exercise these rights if you are unable to.
The first and third of these are self-service: Account → Your data in the dashboard has Export my data, which downloads everything we hold as a single JSON file, and Delete account, which removes it. For anything else write to support@thevastutool.com and we will respond within 30 days. If you are not satisfied with our response you may complain to the Data Protection Board of India.
Deleting your account removes your projects, plan images, folders and sessions immediately. Payment records survive it, with your name and email retained on the invoice, because tax and accounting law requires them — that is the one thing deletion does not reach.
8. Security
Traffic is encrypted in transit. Passwords are stored as bcrypt hashes. Sign-in sessions use httpOnly cookies and rotating refresh tokens, so a stolen token stops working the first time it is reused. Access to the production database is restricted, and every privileged action taken by an administrator is recorded in an append-only audit log.
No system is perfectly secure. If a breach affects your data we will notify you and the Data Protection Board as the law requires.
9. Cookies and consent
We use cookies strictly to keep you signed in — an access cookie, a refresh cookie (both httpOnly) and a small non-secret marker that tells the site a session exists so it can route you correctly. We set no advertising or third-party tracking cookies.
Your analytics choice is stored in your browser’s local storage, not in a cookie, so it never travels with your requests. To change it, clear this site’s data in your browser and answer the prompt again.
10. Children
The service is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes
We will post any update here and change the date at the top. Material changes will also be emailed to you.