Privacy Policy

Draft — not yet published. Last edited: Oct 16, 2026

This Privacy Policy explains what personal data Vastu Flow ("we", "the Service") collects, why, and what rights you have. It applies to two kinds of data, which is an important distinction:

• Your account data (name, email, login activity) — we are the data controller for this.
• Data you enter about your own clients (name, contact details, birth data, consultation notes) — you (the consultant) are the data controller for that data, and we act as your data processor. See the Data Processing Terms.

1. Who we are

[Company legal name], [registered address], [country]. Contact: [privacy@ email].

2. What we collect

• Account: name, email address, password (stored hashed, never in plain text).
• Client records you create: name, gender, contact details, birth date/time/place, notes and other fields you choose to enter. Sensitive fields (phone, email, address, notes, symptoms) are encrypted at rest in our database.
• Project/floor-plan data: property details, floor plan images, Vastu analyses you generate.
• Billing data: handled by our payment provider, [Paddle — details once billing is live]; we do not store card numbers ourselves.
• Technical data: error logs (for fixing bugs), server-side only — no browser tracking/analytics cookies are used today.

3. Why we process it

To provide the Service you signed up for (performance of a contract), to keep the Service secure and working, and — where you've agreed — to send you service-related notifications.

4. How long we keep it

• If you delete a client or project, it is kept for 30 days (in case of accidental deletion) and then permanently erased by an automated process.
• Invoices/quotes are kept longer, as required by accounting/tax law ([X years, per applicable law]) — they are never auto-deleted.
• You can permanently delete your entire account and data at any time from your Profile page (blocked only while unarchived invoices exist, for the legal reason above).

5. Your rights

You can download a full export of your data (Profile → Download my data) or delete your account (Profile → Delete Account) at any time. Depending on your country, you may also have rights to rectify, restrict, or object to processing — contact us to exercise them.

6. Where your data is hosted

[Hosting provider / country — planned: EU-based].

7. Sub-processors

[List: hosting provider, error monitoring (Sentry), payment provider (Paddle) once selected/live].

8. Changes to this policy

We'll update the date at the top of this page when this policy changes. [Notification process once decided].

9. Contact

[privacy contact email].