Vaastu Cosmos

Privacy Policy

Last updated: 27 September 2026

1. Introduction

Vaastu Cosmos (“we”, “us”, “our”) provides Vastu consultancy services, educational content, and Vastu remedy products through this website (the “Site”), including an AI chatbot (“VaastuBot”), online consultation bookings, and an e-commerce shop. We are committed to protecting your personal data and being transparent about how we collect, use, store, and share it, in accordance with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules.

By using this Site, booking a consultation, purchasing a product, or interacting with VaastuBot, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Site or provide your personal data to us.

2. Who We Are

Business name: [Vaastu Cosmos — insert registered business/legal entity name]
Registered address: [Insert full business address, India]
Contact email: [Insert business email address]
Contact phone: [Insert business phone number]
Website: https://vaastucosmos.com

[Placeholder — please replace the bracketed details above with your actual registered business details before publishing.]

3. What Personal Data We Collect

We collect personal data (“Personal Data” as defined under the DPDP Act, meaning any data about an individual who is identifiable by or in relation to such data) in the following ways:

  • Contact and booking details: name, email address, phone number, city/address, and property type, when you fill the Contact / Book a Consultation form or a consultation booking form.
  • Account and order details: billing and shipping address, phone number, email, and payment/transaction reference (we do not store your full card or UPI details — these are processed directly by our payment gateway), when you create an account or place an order in the Shop.
  • VaastuBot chatbot conversations: the questions you ask, any name/phone/email you share with the bot, and your stated preferences (e.g. problem area, budget), when you chat with VaastuBot.
  • Newsletter/lead-magnet data: your name and email address, if you sign up for the free beginner course or newsletter.
  • Technical and usage data: IP address, browser type, device information, pages visited, and referring URLs, collected automatically via cookies and similar technologies (see Section 6, Cookies).
  • Comments and reviews: any information you submit when leaving a blog comment or product review.

We do not knowingly collect any special category or sensitive personal data (such as health records, religious beliefs beyond what you voluntarily share for a Vastu consultation, or financial account numbers) beyond what is reasonably necessary to provide our services.

4. Why We Collect and How We Use Your Data

In line with the DPDP Act’s purpose-limitation principle, we use your personal data only for the specific purposes for which it was collected, namely to:

  • Provide, schedule, and follow up on paid or free Vastu consultations;
  • Process, fulfil, ship, and support orders placed in our Shop, including digital downloads;
  • Operate VaastuBot and route your query to a human consultant when needed;
  • Send booking confirmations, order updates, and service-related communications;
  • Send newsletters or course material, only where you have opted in;
  • Improve our Site, content, and product catalogue through aggregated analytics;
  • Detect and prevent fraud, spam, and misuse of the Site;
  • Comply with applicable tax, accounting, consumer-protection, and other legal obligations under Indian law.

5. Consent

We process your personal data on the basis of your free, specific, informed, and unambiguous consent, given through an affirmative action (for example, submitting a form, ticking a box, or clicking “Accept” on our cookie/consent banner). Where processing is necessary to perform a contract with you (such as fulfilling an order you placed) or to comply with a legal obligation, we may process limited data without separate consent, as permitted under the DPDP Act.

You may withdraw your consent at any time, as easily as you gave it. You can do this by:

  • Clicking the “Consent Preferences” tab on the Site to change your cookie choices;
  • Emailing us at [Insert grievance/privacy email] with your withdrawal request;
  • Using the unsubscribe link in any marketing email we send you.

Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, and may limit our ability to provide certain services to you (for example, we cannot process a refund without your order details).

6. Cookies and Similar Technologies

We use cookies and similar tracking technologies to operate the Site, remember your preferences, and (only with your consent) to analyse traffic and personalise content. When you first visit the Site, a consent banner lets you Accept All, Reject All, or Customise your preferences by category (Necessary, Functional, Analytics, and Marketing). Necessary cookies cannot be switched off as they are essential for the Site to function. You can change your preferences at any time using the “Consent Preferences” button visible on every page.

7. Sharing and Disclosure of Personal Data

We do not sell your personal data. We may share it, only to the extent necessary, with:

  • Service providers/data processors: our web-hosting provider (Hostinger), our e-commerce platform (WooCommerce/WordPress), payment gateways, email/SMS/WhatsApp delivery services, and courier/logistics partners for physical product delivery — each bound to process data only on our instructions and for the stated purpose.
  • Our consultants and staff, strictly on a need-to-know basis, to deliver a consultation you have booked.
  • Government or regulatory authorities, where required by law, court order, or to protect our legal rights.
  • A successor entity, in the event of a merger, acquisition, or sale of business assets, subject to equivalent privacy protections.

8. Data Storage, Security and Retention

We use reasonable technical and organisational security safeguards — including access controls, encrypted payment processing, and secure hosting — to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law (for example, invoices and transaction records under Indian tax law), after which it is securely deleted or anonymised.

9. Cross-Border Data Transfer

Some of our service providers (such as cloud hosting or email delivery infrastructure) may process data on servers located outside India. Where this occurs, we take reasonable steps to ensure such transfers comply with the DPDP Act and any government-notified restrictions on cross-border transfer.

10. Your Rights Under the DPDP Act, 2023

As a Data Principal under the DPDP Act, you have the right to:

  • Access a summary of the personal data we hold about you and the processing activities carried out;
  • Correction and updating of inaccurate or incomplete personal data;
  • Erasure of personal data that is no longer necessary for the purpose it was collected, unless we are required to retain it by law;
  • Withdraw consent at any time (see Section 5);
  • Grievance redressal, by raising a complaint with our Grievance Officer (Section 11) before approaching the Data Protection Board of India;
  • Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email us at [Insert grievance/privacy email] with your name, registered contact details, and the specific request. We will respond within a reasonable time and in accordance with the timelines prescribed under the DPDP Act.

11. Grievance Officer

In accordance with the DPDP Act, we have designated a Grievance Officer to address your questions, concerns, or complaints regarding this Privacy Policy or our handling of your personal data:

Grievance Officer: [Insert name]
Email: [Insert grievance email]
Phone: [Insert phone number]
Address: [Insert registered address]

[Placeholder — please appoint and insert your actual Grievance Officer’s details before publishing this page, as required under the DPDP Act.]

12. Children’s Data

Our services are intended for adults capable of entering into a contract. We do not knowingly collect personal data from children (individuals under 18 years of age) without verifiable parental or guardian consent, as required under the DPDP Act. If you believe a child has provided us with personal data without such consent, please contact our Grievance Officer so we can delete it.

13. Third-Party Links

Our Site may contain links to third-party websites (for example, WhatsApp or social media). We are not responsible for the privacy practices of these third parties, and we encourage you to review their privacy policies separately.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The updated version will be posted on this page with a revised “Last updated” date. We encourage you to review this page periodically.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at [Insert business email] or write to us at [Insert registered address].