Privacy policy

Draft. This page has not been published yet and may change before it is final.

This policy explains how Vatsin Technology Solutions Pvt. Ltd. (“we”, “us”) collects, uses and protects personal data when you visit this website or use Vatsin. We follow the Digital Personal Data Protection Act, 2023 (the DPDP Act), the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000 with its rules on sensitive personal data.

1. Who we are

Vatsin is a product of Vatsin Technology Solutions Pvt. Ltd..

Registered office: 551-551B, 5th Floor, Tower B2, Spaze-I-Tech Park, Sector 49, Sohna Road, Gurugram, Haryana 122018
CIN: U72300HR2016PTC082906
GSTIN: 06AAFCV3704L1Z8
Email: info@vatsintech.com

2. Two roles we play

For website visitors and leads, we decide why and how the data is used. For this data we are the Data Fiduciary.
For customer data, the customer decides. Companies that use Vatsin keep their employees’ and candidates’ data in it. That company is the Data Fiduciary. We process the data only on its instructions, as its Data Processor. Our data processing addendum explains how.

3. What we collect

From website visitors and leads: your name, work email, phone, company, team size, industry, city, the page you came from and your message. To stop spam we also keep your browser type and a scrambled, one-way form of your IP address.

From customers’ admins: name, work email and phone, and billing details such as company name, GSTIN and billing address, for the account and invoices.

Inside Vatsin, entered by the customer or its employees. This depends on the modules the company uses. It can include:

identity and contact details, job, department and manager
attendance, leave and timesheets, including location and a photo at punch-in if the company turns these on
salary, bank account, PAN, Aadhaar, UAN and ESI numbers, tax declarations and payslips
documents uploaded by HR or the employee
details of job candidates

When anyone uses the service: sign-in records, device and browser details, IP address and a log of changes, to keep accounts safe.

4. Why we use it

To reply to you, arrange a demo and send a quote. This is based on the consent you give when you send the form.
To provide the service the customer signed up for, and to support its users.
To keep the service secure, find and fix faults, and stop misuse.
To send invoices and keep tax and accounting records, as the law requires.
To tell customers’ admins about their account, changes to the service and planned maintenance.

We do not sell personal data. We do not use customer data for advertising.

5. AI features

Vatsin has optional AI features, such as an HR assistant. By default the AI model runs on our own servers, and we do not send customer data to outside AI companies. A customer can choose to connect its own AI provider in its settings. If it does, the data goes to that provider under the customer’s own agreement with it.

One company’s data is never used to answer questions for another company. AI answers can be wrong, so please check them before you act on them.

6. How long we keep it

Demo and contact requests: while we are talking with you, and for up to 24 months after our last contact. You can ask us to delete them sooner.
Customer data: for as long as the customer’s account is active. Each customer can set its own rules in Vatsin for removing old data, such as candidates who were not hired or people who left long ago.
After an account ends: the customer has 30 days to download its data. After that we delete the company’s data from the live service.
Free trials that are not continued: we keep the data for 30 days after the trial ends, so the company can still choose a plan and carry on. After that we may delete it.
Backups: deleted data stays in our backups until those backups are replaced in their normal cycle. We do not bring it back into the live service.
Security and audit logs: kept for at least one year (and at least 180 days in India, as CERT-In requires), even after the data they relate to is deleted.
Invoices and payment records: for as long as tax and company law require, usually 8 years.

7. Who we share it with

We share personal data only with service providers that help us run Vatsin, and only what they need. They must keep it safe and use it only for us.

Microsoft Azure: our servers, database and file storage, hosted in India.
Microsoft 365 or our email provider: sending emails such as sign-in codes, payslips and alerts.
Razorpay: online payments. Razorpay handles your card or UPI details; we never see or store full card numbers.
Meta (WhatsApp): WhatsApp messages, only for companies that turn WhatsApp on. Meta may process messages outside India.
Expo, Google, Apple and browser makers: push notifications to the mobile app and browser. The notification text passes through their servers, which may be outside India.
OpenStreetMap: map pictures on attendance and location screens. Your browser loads them from OpenStreetMap’s servers, which see your IP address.
GoDaddy: our domain names. It does not receive personal data from us.

Integrations a customer turns on. If a customer connects Vatsin to another service, such as Google or Microsoft calendars, Slack, Microsoft Teams, Zoho, Microsoft Dynamics 365 Business Central or job boards, the data needed for that link goes to that service on the customer’s instruction.

When the law requires it. We may share data with the government, a regulator or a court when the law requires it.

If our business changes hands. If we merge with or are bought by another company, the data may pass to it, under this same policy.

8. Data outside India

We keep customer data in India. Some of the providers above may handle a small part of it outside India, as noted. The DPDP Act allows this, except to countries the Government of India restricts, and we will not send data to such a country.

9. Your rights

Under the DPDP Act you can:

ask for a summary of the personal data we hold about you and how we use it
ask us to correct, complete, update or erase it
withdraw your consent at any time. This does not affect what we did before you withdrew it
nominate someone to use these rights for you if you die or cannot act
complain to our grievance officer, and then to the Data Protection Board of India

To use these rights, write to grievance@vatsintech.com. We may ask you to prove who you are.

If you work for one of our customers, please ask your employer first. Your employer controls your HR data and can act on most requests inside Vatsin. If you write to us, we will pass your request to them.

10. Children

Vatsin is for businesses and is not meant for children. We do not knowingly collect data of anyone under 18 for our own purposes. If a customer needs to keep data of a person under 18, such as an apprentice, the customer must first get verifiable consent from a parent or guardian, as the DPDP Act requires.

11. Security

We protect data with access controls, encryption of sensitive identity numbers such as Aadhaar and PAN, two-step sign-in, separate data for every company, and audit logs. We report cyber security incidents to CERT-In within 6 hours of noticing them and keep system logs in India for 180 days, as its 2022 directions require. See our security page for details.

If a personal data breach affects a customer’s data, we will tell that customer without undue delay, so it can inform the people affected and the Data Protection Board. If it affects data we control, we will inform you and the Board as the law requires.

12. Cookies

We use only the cookies needed to sign you in and keep your session safe. We do not use advertising or tracking cookies. See our cookie policy.

13. Grievance officer

If you have a question or complaint about your personal data, contact our grievance officer:

Designation: Grievance Officer
Email: grievance@vatsintech.com
Address: Vatsin Technology Solutions Pvt. Ltd., 551-551B, 5th Floor, Tower B2, Spaze-I-Tech Park, Sector 49, Sohna Road, Gurugram, Haryana 122018

We will reply within 30 days. A complaint sent through our grievance form is acknowledged within 24 hours and resolved within 15 days (Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, rule 3(2)). If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

14. Changes to this policy

We will post any change on this page and update the date at the top. If a change is important, we will also tell customers’ admins by email or in the app before it applies.

Complaints. Write to our Grievance Officer at grievance@vatsintech.com or use the grievance form. We acknowledge a complaint within 24 hours and resolve it within 15 days.