Privacy Policy

01Who we are

“Vilohit Tech”, “we”, “us” and “our” mean Vilohit Technology Private Limited, a company registered in India (U62099KA2024PTC185886) with its place of business at HSR Layout, Bengaluru, Karnataka 560102, India.

We are a product engineering studio. We design and build software for our clients, and we run this website. This policy explains what personal data we handle in both roles, why, and what you can ask us to do about it.

Questions about anything below: hello@vilohittech.in.

02What this policy covers

This policy applies to:

• this website, vilohittech.in, and any form or email link on it;
• enquiries, proposals and contracts with prospective and current clients;
• data we process on a client's behalf while building or operating their product.

It does not cover the products we build for clients once those products are live under the client's own name. Those apps and websites publish their own privacy policies, and the client — not us — decides what data they collect. Where we handle that data, we do so as a processor on the client's written instructions (see section 09).

03Information we collect

Information you give us

• Enquiry details — your name, work email, company name, the type of product you need and the brief you write in the contact form or send by email.
• Engagement details — the names, roles, email addresses and phone numbers of the people we work with at your organisation; contract, billing and tax details; bank or payment references needed to invoice and get paid.
• Anything else you choose to send — documents, designs, access credentials and data sets you share with us during a project.

Information collected automatically

• Server logs from our hosting provider: IP address, date and time, the page requested, referring page, and browser/device user agent. These are standard web-server records used for security and troubleshooting.
• Nothing else, today. This site currently runs no analytics, advertising or tracking scripts, and sets no cookies of its own. If that changes we will update section 05 and this section before the change goes live.

What we deliberately do not collect

• Card numbers, CVVs or UPI PINs — see section 07.
• Government identifiers (Aadhaar, PAN, passport) unless a specific contract requires them, in which case we will tell you why and how long we need them.
• Sensitive categories such as health, biometric, caste, religion or sexual orientation data for our own purposes. We do handle health information inside products we build and operate for healthcare clients — strictly as their processor, never for ourselves. See section 09.

04How we use information

We do not sell personal data. We do not use your data or your project material to train machine-learning models, and we do not share it with anyone for their own marketing.

05Cookies and similar technologies

This website sets no cookies and uses no local storage. There is nothing to consent to, so there is no cookie banner.

Google Fonts is loaded from Google's servers to render the two typefaces used here. That request exposes your IP address and browser to Google under Google's privacy policy. If you would rather avoid it, the fonts can be self-hosted — ask us and we will do it.

If we later add analytics or a marketing pixel, we will add a consent banner that blocks non-essential cookies until you accept, and list each cookie here with its purpose and lifetime.

06Third-party services we rely on

Running a studio means using other companies' services. Each one only receives the data it needs to do its job, under a contract that limits what it may do with that data.

07Payments

Client payments reach us by bank transfer, UPI or through a payment gateway. When a gateway is used:

• the payment page is operated by the gateway, and your card, UPI or netbanking credentials are entered on their systems, not ours;
• we never see or store full card numbers, CVVs, UPI PINs or netbanking passwords, and we do not ask for them by email, phone or chat — if anyone claiming to be us does, it is not us;
• we receive and store only what we need to reconcile the invoice: your name, email, amount, currency, timestamp, payment method type, last four digits and the gateway's transaction reference;
• the gateway processes your data under its own privacy policy and PCI-DSS obligations.

Invoices, receipts and payment records are kept for eight financial years, as Indian tax and company law requires.

08Communications and messaging

We email you about your enquiry, your project and your invoices. Those are service messages, not marketing, and they continue for as long as we are working together.

Where SMS, WhatsApp or push notifications are involved:

• we send them only to people who gave the number for that purpose, or where the message is a transactional message about something they asked for;
• WhatsApp messages we send on a client's behalf are sent through the WhatsApp Business Platform and are subject to Meta's policies, including its opt-in requirements;
• Indian regulations (TRAI TCCCP) apply to commercial SMS and voice calls, including DLT registration of sender IDs and templates — we register these before any campaign runs;
• you can opt out of marketing messages at any time by replying STOP, using the unsubscribe link, or writing to hello@vilohittech.in. Service messages about an active project or unpaid invoice will still reach you.

09Client data we handle on a client's behalf

During a project we often get access to a client's systems and to personal data belonging to their users — a trading app's customers, a service platform's subscribers. For that data:

• the client is the data fiduciary / controller and decides the purpose; we act only on their documented instructions;
• we ask for the narrowest access that gets the work done, and prefer anonymised or synthetic data in development and test environments;
• access is limited to the team members on that project, is logged, and is revoked at handover;
• we do not use that data for our own purposes, and we do not disclose it except as the client instructs or the law requires;
• we will sign a data processing agreement on request, and we will tell the client without undue delay if we become aware of a breach affecting their data.

Health information

Some of the products we build and operate are used by healthcare practices, including practices in the United States. Where such a product handles patient information, we process that information only as the practice's processor, on their documented instructions and under a written data processing agreement. We do not use patient information for our own purposes, do not sell it, and do not use it to train models.

The practice decides what is collected, what messages are sent and to whom, and is responsible for obtaining patient consent and for the healthcare regulations that apply to it. Patients who want their information corrected or deleted should contact their practice; see section 19 for how to reach us if you cannot.

If you are a user of a product we built and want your data corrected or deleted, please contact the company that operates the product — they hold the relationship and the authority. Write to us and we will forward your request to them.

10When we share information

We disclose personal data only in these situations:

• To the service providers in section 06, so they can perform their function.
• To professional advisers — lawyers, auditors, accountants — under a duty of confidence.
• Where the law requires it — a valid court order, or a lawful request from a government authority. We check that requests are properly made and disclose no more than is required.
• To defend our rights — for example, to recover an unpaid invoice.
• In a business transfer — if the business is sold or restructured, records may pass to the acquirer, who remains bound by this policy.

11International transfers

We are based in India. Some providers we use store or process data outside India. Where that happens we rely on the provider's contractual safeguards — standard contractual clauses or an equivalent mechanism — and we keep client project data in the region the client asks for, when they ask.

If you are in the EU, UK or another region with data-export rules and you need specific safeguards documented, write to us and we will confirm what applies to your engagement.

12How long we keep data

13How we protect data

• Encryption in transit (TLS) for this site and the systems we build; encryption at rest for databases and backups we manage.
• Least-privilege access, individual accounts, and mandatory multi-factor authentication on email, cloud, source control and gateway dashboards.
• Secrets in a managed secret store — never in source code, tickets or chat.
• Code review on every change, dependency scanning, and logging with alerts on the systems we run.
• Laptops with full-disk encryption and screen locks; access removed on the day someone leaves.

No system is perfectly secure. If you believe you have found a vulnerability in this site or in something we built, please write to hello@vilohittech.in with the details before disclosing it publicly. We will acknowledge you and fix it.

14Your rights

Under India's Digital Personal Data Protection Act, 2023, and comparable laws elsewhere, you can ask us to:

• Access — tell you what personal data of yours we hold and who we have shared it with.
• Correct — fix data that is inaccurate, incomplete or out of date.
• Erase — delete data we no longer need for the purpose it was collected, subject to records we must keep by law.
• Withdraw consent — where we relied on consent, withdraw it at any time. This does not affect processing already carried out.
• Nominate — name someone to exercise your rights if you die or become incapacitated.
• Complain — escalate to our grievance officer, and then to the Data Protection Board of India. If you are in the EU or UK, you may also complain to your local supervisory authority.

Write to hello@vilohittech.in from the email address we hold for you. We respond within 30 days, and we do not charge for a reasonable request. We may need to verify who you are before acting.

15Grievance officer

As required by the Information Technology Act, 2000 and rules under it, and by the DPDP Act, 2023, the person responsible for complaints about how we handle personal data is:

• Name: Kamlesh Uikey
• Designation: Grievance Officer, Vilohit Technology Private Limited
• Email: hello@vilohittech.in
• Address: HSR Layout, Bengaluru, Karnataka 560102, India

We acknowledge complaints within 24 hours and aim to resolve them within 15 days, as those rules require.

16Children

Our services are sold to businesses and this site is not aimed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, write to us and we will delete it. Where we build a product that is meant for children, the client is responsible for the verifiable parental consent that the DPDP Act requires, and we build the flow to support it.

17Changes to this policy

When we change this policy we update the “last updated” date at the top. For changes that materially affect how we use your data, we will also email the address we hold for you, or put a notice on this site, before the change takes effect. Continuing to use the site or our services after that means you accept the updated policy.

18Contact us

• Email: hello@vilohittech.in
• Privacy and data requests: the same address — put “Privacy request” in the subject line
• Post: Vilohit Technology Private Limited, HSR Layout, Bengaluru, Karnataka 560102, India

See also our Terms of Use and Refund & Cancellation Policy.

19How to delete your data

This section is the deletion procedure for data held by Vilohit Technology Private Limited, including data received through the WhatsApp Business Platform and other Meta APIs. Full instructions, and the form to use, are on our data deletion page.

1. Email hello@vilohittech.in with the subject “Delete my data”.
2. Tell us the identifier the data is held against — the phone number in international format for WhatsApp or SMS, or the email address you contacted us from.
3. Name the product or practice, if you are writing about a product we operate for a client.
4. We acknowledge within 2 business days and confirm deletion within 30 days, and we will tell you if any part must be retained and why.

To stop WhatsApp messages immediately without waiting for a deletion request, reply STOP to any message, or block the sender in WhatsApp.

Where the data belongs to a product we operate for a client, that client is the data controller. We will act on their instruction and will forward your request to them, telling you that we have done so. Records we must keep by law — invoices and tax records — are retained as described in section 12.