VTKRO ("we", "us", "our", or "Company") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use our website builder SaaS platform at vtkro.com and its subdomains (the "Platform").

This Privacy Policy applies to all Users of the Platform, including website builders, Agents, Content Creators, and visitors. By accessing or using the Platform, you consent to the collection and use of your information as described in this Privacy Policy.

This policy is structured in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and other applicable Indian data protection laws.

We collect various types of information to provide and improve our Services. The information we collect falls into the following categories:

We use the information we collect for the following purposes:

We value your privacy and do NOT sell your personal data to third parties. However, we may share your information in the following limited circumstances:

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• TLS/SSL encryption for all data transmitted between your browser and our servers (data in transit)
• AES-256 encryption for sensitive data stored on our servers (data at rest)
• Role-based access controls limiting who can access personal data within VTKRO
• Multi-factor authentication for administrative access to systems
• Regular security audits, vulnerability assessments, and penetration testing
• Automated intrusion detection and monitoring systems
• Regular backups with encrypted storage
• Employee security training and awareness programs
• PCI DSS compliance through our payment gateway partners (we never store card details)
• Incident response procedures for prompt handling of any security breaches

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Account Data: Retained as long as your Account is active and you are using the Platform.
• Deleted Account Data: After Account deletion, your data enters a 30-day grace period, after which it is permanently deleted from our active systems.
• Backup Data: Data persisted in encrypted backups may persist for up to 90 days after deletion before being purged.
• Published Website Data: Your Website content is removed from our servers within 24 hours of Account deletion or termination.
• Tax & Invoice Records: Retained for 7 (seven) years as required by Indian tax laws (GST Act, Income Tax Act).
• Agent/KYC Data: Retained for 5 (five) years after the termination of your Agent or Creator relationship, as required by financial regulations.
• Marketing Consent Records: Retained for 3 (three) years after your last interaction to demonstrate compliance with your consent choices.
• Anonymized/Aggregated Data: May be retained indefinitely as it cannot be used to identify you personally.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian laws, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at privacy@vtkro.com. We will respond to your request within 30 days of receipt. We may ask you to verify your identity before processing your request.

We use cookies and similar tracking technologies to enhance your experience on the Platform. Here is how we use them:

The VTKRO Platform integrates with several third-party services. Each service has its own privacy policy governing how your data is handled:

We exercise due diligence in selecting third-party service providers and ensure they maintain appropriate security measures and comply with applicable data protection laws. However, we encourage you to review the privacy policies of these third-party services.

The VTKRO Platform is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children or minors.

• If we become aware that we have inadvertently collected personal information from a child under 18 without parental consent, we will take immediate steps to delete that information from our systems.
• If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at privacy@vtkro.com.
• VTKRO may ask for age verification during registration and reserves the right to restrict access to users who do not meet the minimum age requirement.
• We comply with the provisions of the DPDP Act, 2023 regarding the processing of personal data of children and parental consent requirements.

VTKRO offers AI-powered features to assist in building your Website. Here is how your data is handled in relation to these features:

• Content you provide to AI features (business descriptions, prompts, preferences) is processed in real-time to generate suggestions and outputs.
• AI-generated content is provided to you as suggestions. You review and approve all content before publishing.
• VTKRO does NOT use your uploaded content or AI prompts to train or improve AI models without your explicit, opt-in consent.
• AI processing may be performed by third-party AI service providers. Your data is subject to their data processing agreements, which prohibit using your data for model training.
• AI-generated suggestions are not stored beyond the current session unless you choose to save them as part of your Website content.
• VTKRO does not use AI to make automated decisions that have legal or significant effects on you without human oversight.
• You may opt out of AI features entirely and build your Website manually.

Your personal data may be processed on servers located outside of India, depending on the third-party service providers we use. Here is how we protect your data in such cases:

• We ensure that any international data transfer complies with the DPDP Act, 2023 and other applicable Indian data protection laws.
• All third-party service providers with servers outside India are contractually bound to protect your data to standards equivalent to Indian data protection requirements.
• We use Standard Contractual Clauses (SCCs) or equivalent data transfer mechanisms where required.
• Data encryption is maintained both in transit and at rest, regardless of server location.
• We prioritize using service providers with data centers in India where feasible.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes:

• Material changes will be communicated via email and/or a prominent notice on the Platform at least 14 (fourteen) days before they take effect.
• The updated policy will be posted on this page with a revised "Last Updated" date and version number.
• Non-material changes (clarifications, formatting, minor updates) may be posted without advance notice.
• Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
• If you disagree with the updated Privacy Policy, you must stop using the Platform and request deletion of your data before the changes take effect.
• Previous versions of this policy will be archived and available upon request.

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the name and contact details of our Grievance Officer are as follows:

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us: