Data Processing Terms

Draft — not yet published. Last edited: Oct 16, 2026

These terms apply to the personal data you (the "Controller") enter about your own clients while using Vastu Flow. We ("the Processor") process that data only on your behalf and your instructions, as described below. This is separate from our Privacy Policy, which covers your own account data.

1. Subject matter and duration

We process the client data you enter into the Service for as long as your account is active, plus the retention periods described in the Privacy Policy after deletion.

2. Nature and purpose of processing

Storage, chart calculation, floor-plan/Vastu analysis, invoicing, and export/deletion on your instruction (via the app's own tools — no manual requests needed for these).

3. Categories of data

Name, contact details, birth date/time/place, and any notes you choose to record. Some of this may be considered sensitive depending on local law (e.g. inferred health-related notes) — you are responsible for having a lawful basis to process it.

4. Security measures

• Sensitive client fields (phone, email, address, notes, symptoms) are encrypted at rest.
• Every record is scoped to its owner at the database query level — one consultant's clients are never visible to another.
• Access requires authentication; passwords are hashed, never stored in plain text.

5. Sub-processors

[Hosting provider, error monitoring, email provider — list once finalized]. We'll notify you of material changes.

6. Your instructions

Exporting or deleting client data through the app's own tools (available to you at any time) counts as your instruction to us — no separate request is needed.

7. International transfers

[To be confirmed once hosting location is finalized — planned EU].

8. Contact

[contact email].