Privacy Policy

1. Who this policy is about

This policy explains how VASAH handles personal data — the data of the businesses that use VASAH and the people who run them, and the data those businesses keep in VASAH about their own customers and team. VASAH is provided by The Krishna's Collection.

2. Our two roles

Under the Digital Personal Data Protection Act, 2023 we play two different parts:

• For your account — who you are, how to reach you, what you pay — we are the Data Fiduciary: we decide how that data is used, within this policy.
• For the records a shop keeps in VASAH about its customers, team, suppliers and sales, the shop is the Data Fiduciary and we are its Data Processor. We process those records only on the shop's behalf, to run VASAH for it.

If you are a customer of a shop that uses VASAH, the shop decides how your data is used. Please contact the shop first; we help it answer you.

3. What we collect, and why

• When you sign up: the owner's name, mobile number and email address, and the business's name, address, state and GSTIN if you give one — to open and run your account and to contact you about it. The mobile number is proved with a one-time code.
• When you pay: your plan and the state of your subscription, from Razorpay — to bill you. Card and bank details go to Razorpay; we never see or store them.
• When you and your team use VASAH: sign-in records (time, device and network address) and a log of changes — to keep accounts secure, and to show your shop what was done and by whom.
• When you ask for a demo: your name, mobile number and language, your shop's name and city, what it sells, how many shops you have and when to call — to call you back about the demo, as you ask us to when you send the form.
• When one of our ads or links brought you: the campaign tags in the address you arrived by (utm_source, utm_medium, utm_campaign, utm_content, utm_term) are kept with your sign-up or demo request, to learn which of our campaigns bring shops to VASAH — never Google's click id (gclid).
• When you look for your shop: the mobile number you type, proved with a one-time code — to show you the shops where that number signs in. So that staff can find their shop too, each shop sends us its staff's mobile numbers, which we keep only as a keyed hash, never as the numbers themselves, and replace whenever the shop sends them again.

4. What we never do

We do not sell personal data, rent it out or use it for advertising. We do not use one shop's records for another shop, and we do not look through a shop's records. Our team signs in to a shop only when the shop switches on support access, for the hours it chooses, and everything done then is written to the shop's audit log.

5. Where it is kept

All of it — databases, uploaded files and backups — is kept in India, in Microsoft Azure's Central India region. It travels encrypted (HTTPS), passwords are stored only as one-way hashes, and backups are encrypted. Each shop's database has a login of its own, which cannot open any other shop's.

6. Who else handles it

We use a few service providers, each only for its own job and bound to protect the data:

• Microsoft Azure — hosting and storage, in Central India
• Cloudflare — the network in front of vasah.app addresses
• Razorpay — subscription payments to VASAH
• MSG91 — sign-up and sign-in codes by SMS and WhatsApp, and telling our team on WhatsApp of a new demo request
• Google — counting visits to the vasah.app website (Google Analytics), only for visitors who agree to it

A shop can also connect providers of its own — payments, messaging, couriers, marketplaces — with its own accounts. Those providers work for the shop, under its agreements with them.

7. How long we keep it

Account details are kept while your account is open, and after that only as long as tax and accounting law requires for our billing records. A demo request is erased once nobody has touched it for 365 days. A shop's records are kept while its account is open, and deleted within 30 days of its closing. Inside a shop, the shop sets how long its customers' details are kept — by default three years after their last order — and VASAH erases them when that time is up.

8. Your rights

You can ask us to show you the personal data we hold about you, to correct or complete it, or to erase it where the law does not require us to keep it. You can withdraw consent you have given, and nominate someone to act for you if you cannot. To do any of this, write to [email protected]. We reply within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

9. Cookies

vasah.app sets only the cookies needed to keep you signed in. If you agree on the website's banner, Google Analytics also sets cookies to count your visits, so we learn which pages help; without your agreement it does not run at all. You can change your mind at any time from "Analytics choices" at the foot of the website's pages. There are no advertising cookies.

10. Children

VASAH is a service for businesses. It is not meant for children, and we do not knowingly collect children's personal data for our own purposes.

11. Changes to this policy

When we change this policy we post the new version here with its date, and tell account owners about important changes before they take effect.

12. Contact and grievances

For questions about this policy, to use your rights, or to raise a grievance, write to [email protected].