Privacy notice

This notice is issued by TATHA VASTU PRIVATE LIMITED (CIN U68200MH2026PTC466986), registered office 31, Poddar Chamber, S A Brelvi Road, Horniman Circle, Mumbai, Maharashtra 400001, India. It takes effect on 1 November 2026.

Who we are

Tatha Vastu is RA bill and measurement software for civil contractors in India. In this notice, "we" means TATHA VASTU PRIVATE LIMITED, and "you" means anyone whose personal data we process: visitors to tathavastu.xyz, people who fill in our forms, account users, and the client engineers who check bills in a bill room.

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), we act in two roles. For our website, our forms, sales and billing, we decide why and how personal data is processed, so we are the Data Fiduciary. For the content our customers put into Tatha Vastu (work orders, measurements, photos, bills and the names of the people on them), the contractor decides the purpose and we process it on their behalf, as their Data Processor under a written agreement. Our data processing agreement sets out that second role.

Personal data we collect

• Details you give us in a form: name, work email, mobile number, company, role, number of live work orders, and anything you write in a message or attach, such as an RA bill sent for a free bill check.
• Account data: your name, work email, mobile number, the work orders you can see and your role on each.
• Activity inside the product: measurements you record, approvals, comments, certifications and edits, each logged with your user, the time and the device. This audit trail is part of the product and is kept with the bill it belongs to.
• Site evidence: photographs, sketches and the location and time recorded with a measurement when the site app is allowed to use them.
• Technical data: IP address, browser and device type, pages visited and error reports, used to keep the service running and secure. See our cookie notice.
• Billing data: the legal name, GSTIN and billing address of the paying company, and payment status. Card and bank details are handled by the payment provider and are not stored by us.

Why we use it

We process personal data only for a lawful purpose, on the basis of your consent or for a legitimate use the DPDP Act allows. When we ask for consent, the request says what data we want and why, and you can withdraw it at any time with the same ease.

• To reply to an enquiry, a demo request, a trial sign-up or a bill check you asked for.
• To provide the service: sign-in, access by work order, bill generation, notifications and sync with your accounting tool.
• To keep the service secure: detect misuse, investigate incidents and keep the audit trail.
• To bill the subscription and meet tax and accounting duties.
• To send product and billing-practice emails, only where you agreed. Every such email carries a way to stop them.

We do not sell personal data. We do not use the content of your bills, BOQs or measurements for advertising, and uploaded bills and BOQs are never sent to analytics tools.

Who we share it with

We share personal data only with service providers who help us run Tatha Vastu, under contracts that limit them to our instructions: cloud hosting in India, email delivery, WhatsApp Business messaging and error monitoring. The subprocessors page lists these categories. Inside the product, data is shared only as the customer sets it: a client's engineer sees a bill only when the contractor shares that bill room with them.

We disclose personal data to a government agency or court only when Indian law requires it, and we tell the affected customer first unless the law forbids that.

Where it is kept and for how long

Customer data is stored on servers located in India. We keep account and product data for as long as the customer's subscription runs, then for the export period described in our terms, after which it is erased, except where a law requires us to keep a record for longer, such as tax invoices.

Form enquiries that do not become customers are erased within 12 months. Bills uploaded for a free bill check are deleted 30 days after we send the report, unless you become a customer and ask us to keep them.

Your rights

As a Data Principal under the DPDP Act, you may:

• Ask for a summary of the personal data we process about you and the processing we carry out.
• Ask us to correct, complete or update inaccurate or incomplete data.
• Ask us to erase data that is no longer needed for the purpose it was given, unless a law requires us to keep it.
• Withdraw consent you gave, for the future.
• Nominate another person to exercise these rights if you die or become unable to.
• Have a grievance heard by our Grievance Officer, and if it is not resolved, complain to the Data Protection Board of India.

If your data sits inside a contractor's work order, we pass your request to that contractor and help them answer it, because they decide what happens to that data. To use a right, write to us through the Grievance Officer form. We may ask you to confirm who you are before we act.

Children's data

Tatha Vastu is built for businesses and is not meant for anyone under 18. We do not knowingly process the personal data of children. If you believe a child has given us data, tell us and we will erase it.

Security and breaches

Data is encrypted in transit and at rest, access is role-based by work order, and every change is logged. The security page describes these measures. If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person in the form and time the DPDP Act and its rules require, and tell our customers without undue delay.

Changes to this notice

When we change this notice, we update the date at the top. If a change affects how we use data you already gave us, we tell account holders by email before it applies.

Contact and grievances

Questions about this notice go to the Grievance Officer, TATHA VASTU PRIVATE LIMITED, 31, Poddar Chamber, S A Brelvi Road, Horniman Circle, Mumbai, Maharashtra 400001, India, through the Grievance Officer form. We acknowledge within 24 hours and resolve within 15 days.