🔒 Privacy Policy

Last updated: September 6, 2026

Your privacy is critical to us. This policy explains what data we collect, how we use it, and your rights.

1. Information We Collect

1.1 Information you provide

  • Account: name, email, password (hashed), board/curriculum, profile photo (optional).
  • Payment: handled exclusively by Razorpay. We never see your card/UPI PIN. We store only the last 4 digits, payment ID, and subscription status.
  • Content: code you write in our editor, chat messages with the AI tutor, quiz answers, notes.

1.2 Information we collect automatically

  • Device type, OS, browser version
  • IP address (for security and fraud prevention)
  • Pages visited, time spent, click patterns
  • Crash logs and performance data

1.3 Information from third parties

  • Google or GitHub: name, email, profile picture (only if you sign in with those services)
  • Razorpay: payment status, subscription ID, transaction history

2. How We Use Your Information

  • To provide, maintain, and improve the Service.
  • To personalize your learning experience and recommendations.
  • To process payments and prevent fraud.
  • To send you important updates (security, billing, course changes).
  • To respond to support requests.
  • To send marketing emails (you can opt out anytime).
  • To comply with legal obligations.

3. Cookies & Local Storage

We use cookies and local storage for:

  • Keeping you logged in
  • Remembering your preferences (theme, language)
  • Analytics (via privacy-respecting tools like Plausible)

You can clear cookies/storage anytime, though this will sign you out.

4. Data Sharing

We do not sell your personal data. We share it only with:

  • Razorpay — for payment processing (PCI-DSS Level 1 certified)
  • Google Gemini / OpenAI — for AI tutor features. Your messages are sent to these providers to generate responses. We do not send your personal info beyond your message text.
  • Cloud hosting — for data storage (AWS Mumbai / Google Cloud Mumbai)
  • Email service — for transactional and marketing emails
  • Analytics — for understanding usage (anonymized where possible)
  • Law enforcement — only when legally required

5. Data Storage & Security

  • Data is stored on servers in India (AWS Mumbai / GCP Mumbai).
  • All traffic is encrypted via TLS 1.3.
  • Passwords are hashed using bcrypt (cost factor 12).
  • Payment data is tokenized — we never see full card/UPI details.
  • Regular security audits and penetration testing.
  • 2FA available for all accounts.

6. Your Rights (GDPR & Indian IT Act)

You have the right to:

  • Access a copy of your personal data
  • Correct inaccurate data
  • Delete your account and data (right to be forgotten)
  • Export your data in JSON format (data portability)
  • Opt out of marketing emails (unsubscribe link in every email)
  • Withdraw consent at any time
  • Lodge a complaint with a data protection authority

To exercise any of these rights, email privacy@vastaviklearning.online or visit Settings → Privacy.

7. Children's Privacy

Vastavik is designed for students aged 13+. We do not knowingly collect data from children under 13. Parents/guardians can request deletion of their child's data at any time.

8. International Transfers

Some of our service providers (e.g., Google Gemini) may process data outside India. We ensure adequate safeguards (Standard Contractual Clauses) are in place.

9. Data Retention

  • Account data: while your account is active + 30 days after deletion (for recovery)
  • Payment records: 7 years (as required by Indian tax law)
  • Chat history: 12 months (then anonymized)
  • Analytics: 26 months

10. Changes to This Policy

We will notify you via email of any material changes at least 14 days before they take effect.

11. Contact

Data Protection Officer: dpo@vastaviklearning.online
Address: Vastavik Education Pvt. Ltd., Bengaluru, Karnataka 560001, India