Subprocessors
The categories of service providers Tatha Vastu uses to run the service, what each one does, and how we tell you about changes.
- Effective
- 1 November 2026
- Entity
- TATHA VASTU PRIVATE LIMITED
- Governing law
- India
- Courts
- Mumbai, Maharashtra
This page lists the categories of third parties that may process customer personal data on our behalf. The named list of providers is shared with customers on request.
What a subprocessor is
A subprocessor is a company we engage to help run Tatha Vastu and that may process personal data inside customer accounts while doing so. Under our data processing agreement, each one works only on our instructions, under a written contract with data protection obligations no less protective than ours.
Categories in use
| Category | What it does | Data it may process | Location |
|---|---|---|---|
| Cloud hosting | Runs the application, the database, file storage for photographs and bill packages, and backups | All customer data | India |
| Email delivery | Sends sign-in links, bill room invitations, approval and certification notices | Names, work emails, the subject of the notice | As stated in the named list |
| WhatsApp Business messaging | Sends approval and bill status notices to users who turn them on | Names, mobile numbers, the text of the notice | As stated in the named list |
| Error monitoring | Records application errors so we can fix them | User identifier, browser and device, the page or action that failed | As stated in the named list |
Customer content, including BOQs, measurements, photographs and bills, is stored with the cloud hosting provider on servers located in India. Email, WhatsApp and error monitoring providers receive only what each message or error report needs, not the bill or the BOQ itself.
Payments for subscriptions are handled by a payment provider that receives the paying company's billing details and the payment itself. Card and bank details go straight to that provider and never pass through our servers. The payment provider acts on its own account for payment processing under the rules that apply to payment systems in India, so it is not a subprocessor of customer content, but it is included in the named list we share so that the full picture is in one place.
What subprocessors never receive
- Login passwords. Sign-in secrets are stored only as one-way hashes in our own database.
- BOQs, bills and measurement sheets, other than through the cloud hosting provider that stores them.
- Bills uploaded for a free bill check, which stay in our own storage and are deleted 30 days after the report.
How we choose them
- We check each provider's security practices and data protection terms before we use it.
- We give each one only the data its job needs.
- We prefer providers that can keep data in India, and we tell you where they cannot.
- We review the list at least once a year.
- We remove a provider's access and ask for deletion of our data when we stop using it.
Asking for the named list
Customers and prospective customers can ask for the current named list of providers, with their locations and the date each was added, through the contact form with the topic set to support. We send it to the account owner or the person who asked, at their work email.
Changes
We give at least 30 days' notice by email to account owners before we add or replace a subprocessor that processes customer personal data. The notice names the provider, the category and the location. A customer that objects on reasonable data protection grounds can tell us within that period, and the data processing agreement sets out what happens next.
Providers that never process customer personal data, such as the tools we use for our own bookkeeping, are not subprocessors and are not listed here.
Contact
Questions about subprocessors go to the Grievance Officer, TATHA VASTU PRIVATE LIMITED, 31, Poddar Chamber, S A Brelvi Road, Horniman Circle, Mumbai, Maharashtra 400001, India, through the Grievance Officer form.