This notice explains what personal data vDPO collects, why, who it is shared with, how long it is kept and how you can exercise your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules).
1. Who we are
vDPO (vdpo.org) is owned and operated by Rohas Nagpal, 410, Supreme Headquarters, Mumbai-Bangalore Highway, Near Audi Showroom, Baner, Pune 411045, Maharashtra, India ("vDPO", "we", "us"). For the personal data described in this notice, we are the Data Fiduciary under the DPDP Act.
When you store your clients' data in a vDPO workspace, you decide what is stored and why. For that data we act on your behalf, as described in the Data Processing Addendum.
2. What we collect and why
| Data | What it includes | Why we use it |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash), account type and access dates. If you sign in with Google or GitHub: the account ID and email they share with us. | To create and secure your account and let you sign in. |
| Payments | What you bought, the amount, the date, and the Razorpay order and payment IDs. Card, UPI and bank details are collected by Razorpay; we never see or store them. | To deliver what you paid for, send receipts and keep accounting records. |
| Client workspaces | Client name, sector, countries and laws, checklist ticks, dates and notes. For real clients, checklist notes and the company registration number (CIN) are encrypted (see Security). | To provide the compliance workspace, scores and reports. |
| vDPO Proof | The SHA-256 fingerprint of each file, the labels and private notes you add, and the blockchain transaction details. Your files never leave your device: fingerprints are made in your browser. | To record and verify proofs. See the vDPO Proof Terms. |
| Readiness checks | Your answers. Before you sign in they stay in your browser; after you sign in they are saved to your account. | To show your results and next steps. |
| Free Policy Generator | The business details and answers you enter, and the policy generated. A policy you publish is public at its link. | To generate and host your privacy policy. |
| Learner Edition | Your study schedule and progress. | To run the course schedule. |
| Plugins | vDPO Auditor and vDPO Advisor work offline and send us nothing. We record only which licence was issued to you and when you last downloaded it. | To issue licences and tell you when an update is available. |
| Security records | IP addresses and a hashed email for failed sign-ins and password-reset requests; who downloaded or restored a client backup, when and from which IP address. | To protect accounts and client data and investigate misuse. |
| Messages | What you send to team@vdpo.org. | To reply and resolve your request. |
We use your data only for the purposes above. We do not sell personal data, show advertising, or use tracking or analytics tools.
3. Consent and other grounds
We process your personal data with your consent (DPDP Act, s. 6) and for the purpose for which you voluntarily provide it, such as creating an account or making a purchase (DPDP Act, s. 7(a)). We also keep some records, such as payment records, where the law requires it.
You may withdraw consent at any time by deleting your account in Settings or by writing to us (DPDP Act, s. 6(4)). Withdrawal does not affect processing that took place before it, and we may need to stop providing the services that depend on that data.
4. Emails
We send emails needed to run your account: welcome and sign-in emails, password resets, payment receipts and subscription renewal reminders. We do not send marketing emails.
5. Who we share data with
We share personal data only with the service providers that help us run vDPO (hosting, email delivery, sign-in, payments and the proof blockchain), and only as much as each needs. The full list, with what each receives, is on the Service Providers page. We may also disclose data where the law requires it, for example to a court or a government authority.
6. Where data is stored
vDPO is hosted by DreamHost in the United States, and some of our service providers are outside India. Transfers are made as permitted under the DPDP Act, s. 16, and will stop for any country the Central Government restricts.
7. How long we keep data
- Account and workspace data: until you delete the client or your account. Deletion removes it from our live systems straight away.
- Payment records: kept for as long as tax and accounting laws require, even after your account is deleted.
- Security records: kept only as long as needed to protect the service; password-reset links expire after 60 minutes.
- Proof fingerprints on the blockchain: permanent and cannot be deleted by anyone. They are fingerprints only, not your files.
- Server backups: deleted data may remain in our hosting provider's backups for a limited period before it is overwritten.
8. Your rights
Under the DPDP Act you can:
- Get a summary of the personal data we hold about you and who we have shared it with (s. 11).
- Correct, complete, update or erase your personal data (s. 12). You can edit your profile and delete clients or your whole account in Settings.
- Raise a grievance with our Grievance Officer (s. 13).
- Nominate someone to exercise your rights if you die or become incapable (s. 14).
Write to team@vdpo.org. We may ask you to confirm your identity first. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process (DPDP Act, s. 13(3)).
9. Security and breaches
We use reasonable security safeguards, described on the Security page. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as the DPDP Act, s. 8(6) and the DPDP Rules require.
10. Children
vDPO is meant for professionals and businesses. It is not intended for anyone under 18, and we do not knowingly collect children's personal data (DPDP Act, s. 9).
11. Cookies and browser storage
| Item | Purpose | Type |
|---|---|---|
| Session cookie | Keeps you signed in and protects forms against forgery. Deleted when you close the browser. | Essential |
| Razorpay cookies | Set by Razorpay only during checkout, for payment security and fraud checks. | Essential, third party |
| Browser storage | Saves gap analysis drafts and remembers that you have seen the cookie notice. Stays on your device. | Functional |
vDPO does not use analytics, advertising or tracking cookies. The jurisdiction maps, fonts and other files are served from vdpo.org itself, so viewing them does not send your IP address to any other service.
12. Changes to this notice
We will update this page when our practices change and show the new date at the top. For significant changes we will also tell signed-in users by email or on the dashboard.
13. Grievance Officer
Shuchi Nagpal, Grievance Officer, vDPO
410, Supreme Headquarters, Mumbai-Bangalore Highway, Near Audi Showroom, Baner, Pune 411045, Maharashtra, India
Email: team@vdpo.org
We acknowledge grievances within 48 hours and aim to resolve them within 30 days, and always within the time the law allows.