Privacy Policy

Last updated 30 August 2026

This policy explains what personal data Vaastukriti collects, why, and what you can do about it. It is written to meet India's Digital Personal Data Protection Act, 2023.

Who is responsible

Vikash Patel, sole proprietor trading as Vaastukriti, is the Data Fiduciary. Contact: support@vaastukriti.com

What we collect and why

Data	Why	Basis
Name, email address, Google account identifier	To create your account and sign you in	Necessary to provide the service you asked for
Your plans, drawings and project data	To save your work and show it back to you on any device	Necessary to provide the service
Subscription status, payment reference numbers	To know what you have paid for	Necessary to provide the service; legal record-keeping
Prompts you send to AI features, and token counts	To generate your plan and to meter usage against your allowance	Necessary to provide the service
Server logs (IP address, request times, errors)	Security, abuse prevention, fixing faults	Legitimate use

What we do not collect

We do not store your card number, UPI ID, CVV or bank details. Those go directly to Razorpay, which is PCI-DSS compliant. We receive only a payment reference and whether the payment succeeded.

Where your data is stored

On Google Cloud Platform, in Google's us-central region (United States). Authentication is handled by Google Firebase Authentication. Secrets are held in Google Secret Manager. Data is encrypted in transit and at rest by the platform.

Who we share it with

Google Cloud / Firebase — hosting, database, sign-in.
Razorpay — payment processing.
Google (Gemini API) — where you use an AI feature, the details of that request are sent to Google's Gemini API to generate the answer. It receives the design details you entered; it does not receive your name or email. We use Google's paid API tier, on which Google states it does not use prompts or responses to improve its products.

We do not sell personal data. We do not share it for advertising. We do not use your designs to train AI models, and the AI provider we use is contractually barred from doing so on the tier we pay for.

How long we keep it

Account and project data: while your account is open, and for 90 days after you delete it, in case of accidental deletion.
Payment records: as long as Indian tax and accounting law requires.
Server logs: 30 days.

Your rights

Under the DPDP Act you may ask us to:

tell you what personal data we hold about you,
correct anything inaccurate,
erase your data,
nominate someone to exercise these rights if you are unable to.

You can delete all of your stored work yourself from the account panel inside the application. For anything else, write to the grievance officer below. We will respond within 30 days.

Grievance officer

Vikash Patel
Grievance Officer, Vaastukriti
⟨FILL IN — registered business address⟩
grievance@vaastukriti.com

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Children

The service is not intended for anyone under 18. We do not knowingly collect data from children.

Changes

If this policy changes materially we will tell you by email before the change takes effect.

Before you take real money: set BUSINESS_ADDRESS in app.yaml — the DPDP Act requires a working contact address for the grievance officer, and Razorpay checks it against your KYC.