Right of access
You can ask for a copy of the personal information we hold about you.
Legal
Privacy Policy
Your privacy matters. This policy explains how Vedatra Scalable Stacks Private Limited collects, uses, and protects personal information when you use vedatra.com, contact us, or work with us.
Effective Date: 3 September 2026Last Updated: 3 September 2026
Vedatra Scalable Stacks Private Limited (“Vedatra,” “we,” “us,” or “our”) operates the website at vedatra.com, the Insights publication on that site, the operator CMS at /admin, and related professional services and products (together, the “Services”). We are a full-stack engineering company. We design, build, and operate cloud, application, data, and AI systems for startups, enterprises, and governments, from Bengaluru and Lucknow in India, with a European presence in Tallinn, Estonia.
This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you visit the site, submit an enquiry, read Insights, or engage us on a statement of work. Product-specific notices may also apply if you use Watchio or Callfora.
By accessing or using vedatra.com, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the site or submit an enquiry. For paid work, the statement of work and any data processing agreement control where they conflict with this policy.
1. Information We Collect
We collect only what we need to respond to you, operate the site, and deliver contracted work. We do not run a public account system on vedatra.com.
1.1 Information you give us
When you use the contact form, email us, or otherwise write to us, we may collect:
- Full name
- Work email address
- Organisation or company name
- The brief you send — what you are trying to change
- A description of the estate or systems already in place, if you provide one
- Phone number, if you include it in the message or call us
- Any files or links you later send in the conversation
The contact form includes a hidden honeypot field used only to reject automated submissions. We do not use that field for any other purpose.
1.2 Information from engagements
If we work together under a statement of work, NDA, or similar contract, we may receive personal information that is necessary to deliver the engagement. That can include:
- Names, roles, and business contact details of your people
- Access credentials or identity records you provision for our engineers, which we treat as client-controlled secrets
- Logs, configurations, tickets, and operational records you ask us to see
- Personal data that already sits in systems we are engaged to design, migrate, or operate, processed only as your processor and on your instructions
Client personal data in an engagement is governed by the contract, any data processing agreement, and applicable law. You remain the controller of that data unless we agree otherwise in writing.
1.3 Technical and device information
Our servers and hosting providers may automatically record limited technical data when you visit the site:
- IP address and approximate location derived from it
- Browser type and version, operating system, and device class
- Pages requested, referring URL, and timestamps
- Error logs and basic performance data needed to keep the site available
We do not currently operate third-party analytics, advertising pixels, or social tracking on the public site.
1.4 Cookies and similar technologies
We use essential cookies where they are required for security and for authorised operators to sign in to the CMS. We do not currently set analytics or marketing cookies. See Section 9 and the Cookie Policy.
2. How We Use Information
We use personal information for the following purposes.
2.1 Enquiries and conversations
- Reading and responding to the brief you send
- Understanding whether we can help, and with which capability
- Sending an NDA when you ask for one before the first conversation
- Arranging a call or written follow-up
2.2 Professional services
- Scoping, proposing, and delivering work under a written statement of work
- Operating access, environments, and handover as the contract requires
- Invoicing, tax, and statutory records
- Maintaining the evidence and runbooks that the engagement produces
2.3 Site operation and Insights
- Publishing and hosting Insights articles
- Authenticating authorised operators of the CMS
- Keeping the site available, debugging faults, and preventing abuse
2.4 Security and legal
- Detecting spam, fraud, and unauthorised access
- Enforcing our Terms of Use
- Complying with law, including the Digital Personal Data Protection Act, 2023 in India, and responding to lawful requests
- Protecting the rights, property, and safety of Vedatra, our clients, and the public
3. Information Sharing
We do not sell personal information. We do not share it for advertising. We may share information only in the limited cases below.
3.1 Service providers
We use trusted providers to host the website, store enquiry and Insights records, and send transactional email. They may process personal information only to perform the work we have engaged them for, and they are required to protect it. Typical categories include:
- Cloud hosting and application infrastructure
- Managed database hosting for contact submissions and Insights
- Transactional email delivery for enquiry notifications
- Domain, DNS, and TLS certificate services
3.2 Professional advisers and group support
We may share information with lawyers, accountants, or insurers where it is necessary to take advice or meet a legal obligation, and with people inside Vedatra who need it to do the work.
3.3 Legal requirements
We may disclose information if required by law, or if we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation or valid order; (b) protect and defend our rights or property; (c) investigate suspected fraud or a breach of the Terms of Use; or (d) protect the safety of people.
3.4 Business transfers
If Vedatra is involved in a merger, acquisition, reorganisation, or sale of assets, personal information may transfer as part of that transaction. We will take reasonable steps to keep it protected and, where required, to tell you.
3.5 Client engagements
On a client engagement we may use subprocessors (for example a cloud account the client already operates, or a tool named in the statement of work). Those subprocessors are listed or approved in the contract. A data processing agreement is available on request for engagements that need one.
4. Data Retention
We keep personal information only as long as we need it for the purpose collected, or as longer retention is required by law or the contract.
- Contact submissions are kept for operational follow-up and as a business record of the enquiry. If no engagement follows, we typically review and delete or anonymise them within 24 months of the last correspondence, unless we must keep them longer.
- If an enquiry becomes a contract, the record is retained with the engagement file for the term of the contract and the statutory period that follows (including tax and accounting rules in India).
- Engagement materials, logs, and credentials are retained or returned according to the statement of work. Access we were given is withdrawn at handover unless you ask us to keep operating the system.
- Server and security logs are kept for a short operational window, generally up to 90 days, unless an incident requires a longer hold.
- Admin session cookies expire after 24 hours.
When you ask us to delete personal information we hold as a controller, we will delete or anonymise it within 30 days, except where we are legally required to retain it or where it is necessary to resolve a dispute or secure our systems.
5. Security Measures
We apply practical controls proportionate to a professional-services firm and a public marketing site. More detail is on the Security page. In outline:
- HTTPS/TLS for vedatra.com and the admin CMS
- httpOnly session cookies for admin authentication, with a 24-hour lifetime
- Access to contact records and the CMS limited to authorised operators
- Sanitisation of Insights content and rate limits on public APIs
- Least-privilege access on client estates, granted only for the work and withdrawn at exit
- Written handover and an exit clause on engagements so access does not linger
No method of transmission or storage is completely secure. We cannot guarantee absolute security. If you believe a vulnerability exists, please report it as described on the Security page rather than posting it publicly.
6. Your Rights
Depending on where you live — including India under the Digital Personal Data Protection Act, 2023, and the EEA/UK if GDPR or UK GDPR applies — you may have some or all of the following rights.
Right to correction
You can ask us to correct information that is inaccurate or incomplete.
Right to deletion
You can ask us to delete personal information, subject to legal and contractual exceptions.
Right to data portability
Where the law provides it, you can ask for a machine-readable copy of information you provided to us.
Right to withdraw consent and opt out
Where we rely on consent, you can withdraw it. You can also ask us not to use your details for follow-up marketing. We do not currently send marketing lists from the website.
Right to restrict or object
You can ask us to limit certain processing, or object to processing that is based on legitimate interests, including any future direct marketing.
Right to nominate and to grievance redressal
Under Indian law you may have the right to nominate another person in respect of your personal data, and to complain to us and, if unresolved, to the Data Protection Board of India.
To exercise these rights, email hello@vedatra.com with enough detail for us to find your record. We will respond within 30 days, or the period required by the law that applies to you. We may need to verify your identity before we act.
7. Children’s Privacy
vedatra.com and our services are directed at organisations and working professionals. They are not directed at children. We do not knowingly collect personal information from anyone under 18.
If you are a parent or guardian and believe a child has sent us personal information, email hello@vedatra.com. We will delete it promptly.
8. International Data Transfers
Vedatra is incorporated in India. Our engineering and delivery work is done from Bengaluru and Lucknow. We also maintain a European presence in Tallinn, Estonia. If you write to us or engage us from another country, your information may be transferred to, stored, and processed in India and in other countries where our people or service providers operate.
Those countries may have data-protection laws that differ from the laws in your country. We take steps that are appropriate to the transfer, including:
- Limiting access to people who need the information to do the work
- Contractual terms with providers, including data-processing terms where required
- Standard Contractual Clauses or another lawful transfer mechanism when we transfer personal data from the EEA or UK
- A data processing agreement on request for client engagements that need one
If you are in the EEA or UK and have questions about transfers, email hello@vedatra.com.
10. Third-Party Services
The site may link to third-party websites, including client or product destinations. This Privacy Policy does not apply to those sites. Read their policies before you submit information to them.
Insights articles may mention tools, clouds, or vendors. A mention is not an integration and does not mean those vendors receive your personal information from us.
If you use Watchio or Callfora, those products may process operational data under their own terms and any order form you sign. This policy still applies to how we handle personal information as Vedatra.
11. Changes to This Policy
We may update this Privacy Policy when our practices, the site, or the law changes. When we make a material change, we will:
- Update the “Last Updated” date at the top of this page
- Keep the previous effective date visible so you can see that the text has changed
- For people we are already emailing on an active enquiry or engagement, send a note if the change affects how we use their information
Continued use of vedatra.com after a change means you accept the updated policy for website use. Contracted processing changes only if the statement of work or DPA is updated.
12. Contact Information
If you have questions, requests, or complaints about this Privacy Policy or our data practices, contact us.
Vedatra Scalable Stacks Private LimitedPrivacy and legalBengaluru · Lucknow · TallinnThink. Build. Scale.hello@vedatra.com+91 95194 21100