Last updated: 8 July 2026
In short
Vastu Sense ("we", "our", or "us") operates the Vastu Sense mobile application and the website vastusense.xyz. This policy explains what data we collect, why we collect it, and how we protect it. By using our app or website you agree to the practices described here.
Depending on how you came to use our services, we act in one of two roles under the DPDP Act: as the Data Fiduciary (for homeowners using our app directly), or as a Data Processor acting on behalf of a real estate developer, who is the Data Fiduciary (for buyers who received a report during a site visit — see Section 7).
Account data. When you sign in we collect your mobile phone number. We do not collect passwords. Authentication is via one-time passcode (OTP) only.
Profile data. Your display name, optionally provided by you.
Property and floor plan data. Floor plan images you upload, property addresses, floor numbers, and directional labels you enter.
Resident data. Names, birth years, and gender of family members you add to a property. This data is used solely to personalise the Vastu analysis for your household.
Usage data. In-app actions, feature usage patterns, and session logs — used to improve the product. No keystroke or screen-recording data is collected.
Device data. Device type, operating system version, and push notification token (for Firebase Cloud Messaging). We do not collect your device's precise GPS location.
Payment data. Payments are processed by Razorpay. We store your plan tier and payment status. We do not store your card number, UPI ID, or bank details — these are handled entirely by Razorpay under their own privacy policy.
We do not use your data for advertising profiling, third-party data brokering, or any purpose not listed above.
Your floor plan images are processed by Amazon Rekognition and Anthropic Claude (vision) to detect rooms and directions. Your resident data and room layout are processed by our deterministic rule engine — not by an AI model — to compute your Vastu score.
Anthropic Claude API is used to generate the narrative text in your report (descriptions, remedy explanations). Your floor plan images and resident names are not sent to Anthropic. Only anonymised room layout data and score inputs are used in AI-generated text.
All data is stored in AWS infrastructure (DynamoDB and S3) in the ap-south-1 (Mumbai) region. Data does not leave India unless you explicitly share a report link externally.
We share your data with the following sub-processors, strictly to operate the service:
We do not sell your data to any third party.
Our website uses cookies to understand how visitors use the site so we can improve it:
_ga and _gid) to measure page visits and traffic sources. These cookies may process your IP address and a randomly generated identifier.Analytics cookies are disabled by default. On your first visit, a consent banner lets you Accept or Reject them. Using Google Consent Mode, analytics remain denied until you choose Accept — no analytics cookies are set before then. Strictly necessary functionality does not rely on these cookies.
You can withdraw consent at any time by clearing this site's cookies and local storage in your browser; the consent banner will then reappear on your next visit. For any questions, email support@vastusense.co.in.
If you are a buyer who received a Vastu report during a site visit, your details were collected by a real estate developer's sales representative using our rep-facing app — not by you signing up directly. This section explains how that data is handled and who is responsible for it.
Roles: who is responsible for your data. The real estate developer is the Data Fiduciary for your personal data — they decide to collect it and are responsible for obtaining your consent and honouring your rights. Vastu Sense acts only as the developer's Data Processor: we process your data solely to generate the report, the verification page, and related analytics, strictly on the developer's instructions.
What is collected. Your name (printed on the report), your phone number (optional — used only for the developer's own CRM follow-up, never printed on the report or shown on the public verification page), the unit you were shown, and — only if you choose to share them, with consent captured at the time — the names and wellness focus areas (health, career, education, or peace of mind) of family members, used solely to personalise your report.
What we never do with your data. We never print or display your phone number on any report, PDF, or public page. We never show any buyer-identifying information on the public verification page. We never use your data for advertising, profiling, or for any developer or project other than the one where it was collected. We never sell your data.
Consent. Before your report is generated, the representative must confirm your consent via an explicit checkbox in the rep app, unchecked by default — it is never pre-selected on your behalf. We store the consent timestamp, the representative's ID, and the app version as evidence that consent was captured. Developers are responsible for training their representatives to obtain this consent genuinely and only after explaining what data is being collected.
Retention and deletion. Your phone number, if collected, is retained for 180 days by default (a developer may configure a different period under their agreement with us). Your analysis record and related audit logs are retained for the duration of our engagement with the developer, plus a reasonable window to handle any disputes. To request deletion, please contact the developer first, as they are the Data Fiduciary responsible for your data; you may also contact us at support@vastusense.co.in and we will support the developer in actioning your request. Once your report is delivered, any further sharing (for example, if you forward it to family) is your own choice and outside our control.
The public verification page. Every report links to a public verification page (reached via the QR code printed on the report) at a unique web address. By design, this page shows only the unit, scores, relevant dates, the scoring engine version, and status — it never shows your name, phone number, or any other personal information.
Scan analytics. When the verification page is scanned, we log the page's unique token, the timestamp, the visiting device's user-agent, and a coarse (city-level, not precise) location. We do not use cookies for this in the current version, and no scan event is tied to your identity.
Suppression and integrity logging. If a unit's score falls below the reporting threshold, no buyer-facing report is generated for it. We log this event internally (the unit, the representative, the timestamp, and a hashed reference to the buyer) purely to maintain the integrity of our scoring process — this is an internal audit log, not marketing data, and it is not used to profile you.
Your rights as a buyer. Because the developer is the Data Fiduciary, they are your primary point of contact for accessing, correcting, or requesting erasure of your data, and for any grievance. We support the developer, as their processor, in responding to these requests.
You may, at any time:
All data in transit is encrypted via TLS 1.2+. Data at rest in DynamoDB and S3 is encrypted using AWS-managed keys. API endpoints require a valid JWT signed by AWS Cognito. We do not store OTPs or session tokens beyond their validity window.
In the event of a data breach that affects your personal data, we will notify affected individuals and the relevant authorities without undue delay, in accordance with the Digital Personal Data Protection Act, 2023 and its rules.
Under the Digital Personal Data Protection Act, 2023, a "child" is anyone under 18. Vastu Sense accounts require you to be 18 or older (see our Terms of Service). Resident data for a child (birth year, name) entered into the app by their parent or lawful guardian for the purpose of personalised Vastu analysis is processed on the basis of that parent's or guardian's verifiable consent. We do not use children's data for behavioural monitoring, tracking, or targeted advertising. If you believe we have inadvertently collected a child's data other than as described here, contact us at support@vastusense.co.in.
We will notify you of material changes to this policy via a push notification and an in-app banner at least 7 days before the change takes effect. Continued use of the app after the effective date constitutes acceptance of the updated policy.
For any privacy questions, rights requests, or complaints, contact our Grievance Officer at:
support@vastusense.co.in
Spatiq AI Private Limited
Pune, India - 411045
If you are not satisfied with our response, you may escalate your grievance to the relevant authority under the Digital Personal Data Protection Act, 2023.