Privacy & Policy

This Privacy Policy applies to personal data processed by Virasat Setu in connection with the Services, regardless of whether the data is provided through the website, mobile application, web forms, WhatsApp or other messaging channels, telephone, email, offline forms, customer-support interactions, document uploads, or other authorised channels.

For purposes of applicable Indian data-protection law, Virasat Setu may act as a Data Fiduciary in relation to personal data for which it determines the purpose and means of processing. Where we process personal data solely on behalf of another Data Fiduciary under a valid arrangement, we may act as a Data Processor to the extent required by Applicable Law.

• –"Personal Data" means any data about an identifiable individual, including information capable of identifying an individual directly or indirectly, to the extent regulated by Applicable Law.
• –"Data Principal" means the individual to whom the personal data relates, as defined by Applicable Law.
• –"Data Fiduciary" and "Data Processor" have the meanings assigned by Applicable Law.
• –"Processing" includes collection, recording, organisation, structuring, storage, retrieval, use, analysis, disclosure, transmission, sharing, restriction, deletion, or otherwise dealing with personal data.
• –"Nominee" means a person designated by the User for receipt of information, alerts, support, or asset-specific information in accordance with the User settings, the Services, and Applicable Law.
• –"Master Nominee" means the primary nominee designated by the User for permitted account-level or verification communications.

Depending on the Services you use, we may collect and process the following categories of personal data, including but not limited to:

• –Identity and profile data: full name, date of birth, gender where provided, photograph, signature, identity-verification information and other identifiers.
• –Contact data: mobile number, email address, postal/correspondence address and preferred communication channels.
• –Account and authentication data: account credentials, OTP-related information, device identifiers, login history, security events and account preferences. We do not intend to store full authentication secrets such as one-time passwords except where technically necessary for secure transmission or logging, and then only for the period required.
• –Family, nominee and relationship data: nominee names, relationships, contact details, master nominee designation, emergency contacts, authorised representatives, and relevant relationship information provided by you.
• –Asset and financial-legacy data: information concerning bank accounts, insurance policies, mutual funds, securities, fixed deposits, property, loans, gold, pensions, digital assets, important documents, liabilities, account references, nominee allocations, and related records that you choose to store.
• –Document data: wills, deeds, policy records, statements, certificates, receipts, identity/address documents, photographs, supporting records, and other files you voluntarily upload or provide.
• –Wellness and verification data: alert responses, non-response events, contact attempts, status confirmations, information received from nominees/emergency contacts, supporting death-related records and other information reasonably necessary for verification or support.
• –Payment and subscription data: subscription plan, transaction identifiers, payment status, billing information and limited payment metadata received through payment partners. Full card or banking credentials may be handled directly by regulated payment providers rather than stored by us, depending on the payment method.
• –Communication data: messages, support tickets, call metadata, call recordings where applicable, consent records, complaints, feedback and correspondence.
• –Device and technical data: IP address, browser/device type, operating system, app version, crash logs, approximate location inferred from technical data where applicable, usage events, referral source, cookies and similar technologies.
• –Information generated by our systems: audit logs, access records, security logs, notification status, preference history, service activity records, subscription-status records, expiry/renewal records, nominee allocation history, nominee statement/report generation records, wellness administration records, and authorised administrative actions or verification status records.

We may receive personal data from sources other than the User, including but not limited to nominees, master nominees, emergency contacts, authorised representatives, service providers, payment processors, communication providers, fraud-prevention providers, public or legally accessible sources, government or regulatory sources where permitted, and documents or information supplied during claim-support or death-verification processes.

Where you provide another person’s personal data to us, you represent that you have the authority or lawful basis to provide that information and that the relevant person may be informed where required by law. Where appropriate, we may request that person to confirm or provide consent or other legally recognised grounds before processing their personal data.

We may process personal data for specified, explicit, lawful and reasonably necessary purposes, including but not limited to:

• –creating and administering your account and Vault;
• –processing onboarding requests and verifying information where required for the Services;
• –organising, storing, displaying and maintaining the asset, nominee, document and legacy information you choose to record;
• –configuring and delivering reminders, alerts, wellness checks and service communications;
• –contacting you, nominees or emergency contacts according to your settings, instructions and Applicable Law;
• –facilitating nominee support, claim assistance, legacy assistance and death-verification workflows;
• –processing subscriptions, payments, refunds, billing, reconciliation and accounting;
• –providing customer support, responding to requests and resolving complaints;
• –protecting the security, integrity and availability of the Services;
• –preventing, detecting, investigating and responding to fraud, impersonation, abuse, security incidents, unlawful activity and misuse;
• –complying with legal, regulatory, judicial, tax, accounting, audit and law-enforcement requirements;
• –enforcing contractual rights, defending legal claims, establishing or exercising legal rights, and maintaining records necessary for disputes;
• –performing internal analytics, service quality review, reliability monitoring, research, testing and product improvement using appropriate safeguards;
• –using AI or automated tools only for permitted purposes described in this Policy and subject to human oversight where appropriate; and
• –other purposes expressly communicated to you at or before the point of collection or otherwise permitted by Applicable Law.

We do not use personal data for a new or materially incompatible purpose merely because the data is available to us. Where a new purpose requires fresh notice, consent, or another legal basis, we will provide the same as required by Applicable Law.

Where processing is based on consent, we will seek consent through clear, specific and informed notices or consent mechanisms and will limit processing to the purposes communicated to you. The DPDP Act permits processing on consent or certain legitimate uses; this Policy does not waive or replace any mandatory notice, consent, security, grievance, or other legal obligation that applies to us.

Consent may be recorded through account creation, a checkbox, button, feature activation, settings selection, document submission, call consent, written instruction, electronic communication, or another legally valid mechanism. We may maintain records of the consent, the notice presented, the purpose, the time, the channel and the version applicable at the time of consent for audit and accountability.

Where processing is necessary for a purpose for which the law permits processing without consent, we may rely on that lawful basis to the extent permitted by Applicable Law. Where we rely on another legal ground, we will not misrepresent that processing as being consent-based.

The consent and notice architecture may evolve as the DPDP Act and DPDP Rules enter into force in stages. The Company will update its mechanisms to comply with the provisions applicable at the relevant time.

Where processing is based on consent, you may withdraw that consent through the same or a comparably simple method by which consent was given, subject to Applicable Law. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

After withdrawal, we will stop or restrict the relevant consent-based processing within a reasonable period, subject to technical feasibility and any continued lawful basis for retention or processing, including legal obligations, fraud prevention, security, dispute resolution, or other purposes permitted by Applicable Law. Withdrawal may result in suspension or unavailability of features that require the withdrawn data or consent.

We seek to collect only the categories of personal data that are reasonably necessary for specified purposes. We will not intentionally require unrelated personal data merely as a condition of using a feature unless the information is necessary for the feature, required by law, or voluntarily provided by you.

Access to personal data within our organisation and by service providers will be restricted on a need-to-know and role-appropriate basis, subject to legitimate business and security requirements.

You are responsible for ensuring that the personal data you provide or cause to be provided is accurate, complete, current and lawfully obtained. Virasat Setu does not independently verify every item of user-entered asset, nominee, relationship or document information and does not certify the truth, title, ownership, succession entitlement, beneficiary status, validity or completeness of such information unless we expressly agree to perform a defined verification service.

We may rely on the information you provide for operating the Services. Where you identify an error, we will provide appropriate means to request correction, completion or updating, subject to verification and Applicable Law. The DPDP Act provides for correction, completion, updating and erasure rights, subject to applicable requirements and exceptions.

Your privacy settings and nominee mapping determine, subject to Applicable Law and the Services, who may receive information concerning your account or specific assets. As a core design principle: information relating to an asset will ordinarily be disclosed only to the nominee(s) mapped to that asset, and not automatically to every nominee of the User.

Where an asset is assigned to multiple nominees, information permitted to be shared concerning that asset may be provided to all such nominees in accordance with the User’s instructions, Applicable Law and operational safeguards. We may also generate nominee-specific statements or reports containing only the assets or information assigned to the relevant nominee. We do not represent that such sharing or reporting creates, confirms or transfers ownership, title, succession rights or legal entitlement in the asset.

A master nominee may be contacted for account-level verification or permitted support where the User has enabled or authorised that function. Other nominees or emergency contacts may be contacted in accordance with the user settings, the relevant service, the verification workflow, and Applicable Law.

We may disclose personal data to a nominee or other recipient where you have provided valid instructions or consent, where the disclosure is otherwise lawfully permitted, or where necessary for the exercise of rights after death or incapacity as permitted by Applicable Law. The DPDP Act expressly recognises nomination by a Data Principal for exercising rights in the event of death or incapacity, subject to the Act and Rules.

Where you activate wellness services, we may process scheduled check-in dates, response status, non-response events, alert history, contact attempts, follow-up actions and related information for the purpose of administering the wellness service. The current wellness service uses scheduled check-ins throughout the year rather than a fixed 45-day interval. The current scheduled dates are 1 January, 15 February, 1 April, 15 May, 1 July, 15 August, 1 October and 15 November, with timing and operational details subject to change through applicable service procedures or notices. A response window may apply to each check-in; under the current workflow, the response window closes at 23:59:59 IST on the seventh day after the check-in.

Death-verification information

If a user does not respond within the applicable response window, we may contact the user and, where authorised, the master nominee, other nominee(s) or emergency contacts. Follow-up and administrative actions may be recorded in our systems. The exact operational flow may be amended from time to time and will be governed by the applicable service terms and the procedure adopted by the Company.

A report from a nominee or other contact that a User may be deceased is treated as a verification trigger or important lead, not by itself as conclusive proof of death. We may seek supporting evidence such as a death certificate, hospital record, cremation/burial receipt, police or municipal record, or other reasonably reliable supporting information. Where practicable, we may confirm information with multiple available contacts and cross-check available evidence before updating status.

Until the Company has sufficient confirmation under its then-current procedure, the relevant status may be maintained as "Death Under Verification" or an equivalent internal status. The final verification procedure may be changed, supplemented or formalised through a separate service policy as the product evolves.

We may contact you using the channels and contact details you provide for service delivery, account security, wellness alerts, operational notices, billing, support, fraud prevention, claim assistance, verification, and other permitted purposes. Communications may include automated calls, SMS, email, WhatsApp or in-app notifications where supported.

Where calls are recorded, we will provide notice and/or obtain consent where required by Applicable Law and will use recordings for the stated purposes, including quality assurance, training, fraud prevention, dispute resolution, evidence of instructions or consent, and service verification. Where you decline recording and the law permits, we may offer another channel; however, certain services may become unavailable if recording is operationally necessary.

We may use cookies, SDKs, pixels, local storage and similar technologies to keep you signed in, remember preferences, secure the Platform, measure usage, diagnose failures, improve performance, and understand how features are used. Certain cookies may be essential for providing the Services, while others may be optional depending on the Platform.

Optional analytics, including Google Analytics 4, is used only after you choose Accept all or enable analytics in Cookie settings. Choosing Reject optional keeps analytics off. You can change this choice at any time from Cookie Preferences in the footer. Essential cookies for sign-in, session security, verification, and checkout continue to work either way. You may also manage cookies through your browser or device settings. Disabling essential technologies may affect functionality, security or availability.

We may disclose personal data only where reasonably necessary for the purposes described in this Policy, where authorised by you, or where otherwise permitted or required by Applicable Law. Recipients may include, without limitation:

• –cloud hosting, storage and infrastructure providers;
• –payment gateways and banking/payment service providers;
• –communications, SMS, email, WhatsApp, telephony and call-recording providers;
• –technology, software, analytics, security, fraud-detection and customer-support vendors;
• –professional advisers, auditors, insurers and consultants where reasonably necessary;
• –group entities, affiliates, successors or transaction counterparties in a merger, acquisition, restructuring or transfer of business, subject to appropriate safeguards and legal requirements;
• –law-enforcement, judicial, regulatory, tax or government authorities where disclosure is required or lawfully requested; and
• –persons expressly designated by you, such as nominees, emergency contacts or authorised representatives, in accordance with the applicable settings and law.

We do not sell personal data merely as a data product. Any marketing-related sharing, where proposed, will be subject to Applicable Law and the choices/consents applicable to that activity.

Where service providers process personal data on our behalf, we will seek appropriate contractual, technical and organisational safeguards, including confidentiality, restricted use, security, incident cooperation and deletion/return obligations as appropriate to the relationship and Applicable Law.

Our cloud infrastructure may be hosted wholly or partly on Amazon Web Services (AWS) and related AWS services, together with other authorised technology providers. Data may therefore be stored, backed up, processed or transmitted through infrastructure operated by such providers in accordance with our instructions, contractual controls, technical configurations and Applicable Law.

The use of AWS or another processor does not transfer ownership of your personal data to that provider. Providers may have limited access where necessary to provide infrastructure, security, support or other contracted services, subject to appropriate safeguards.

Personal data may be processed or stored outside India where permitted by Applicable Law and subject to safeguards appropriate to the nature of the processing. We may use global cloud, communications, security, analytics, support and other service providers whose infrastructure may operate across jurisdictions.

The DPDP Act restricts certain transfers based on countries or territories notified by the Central Government and preserves other Indian-law restrictions that may impose a higher degree of protection or additional limits. We will comply with applicable transfer restrictions and directions in force at the relevant time.

We maintain reasonable technical and organisational measures appropriate to the risks of the processing. Depending on the service and risk, controls may include encryption in transit and at rest where appropriate, access controls, authentication, role-based permissions, logging, monitoring, backup and recovery, vulnerability management, secure development practices, vendor controls, confidentiality obligations, incident response procedures and periodic review.

No electronic transmission, storage system or internet service can be guaranteed to be completely secure. We therefore cannot promise absolute security, but we will implement safeguards required by Applicable Law and appropriate to the processing. The DPDP Rules 2025 prescribe specified security safeguards including measures such as encryption/masking/tokenisation, access control, monitoring, backups, contractual safeguards and technical/organisational measures; we intend our control framework to be aligned to such requirements as they become applicable.

If we become aware of a personal-data breach, we will assess, contain, investigate, remediate and document the incident and provide notices or reports to affected Data Principals, the Data Protection Board of India, or other authorities as required by Applicable Law and applicable timelines.

The DPDP Rules 2025 provide for notice to affected Data Principals without delay and specified reporting obligations to the Board, including an initial notification and follow-up information within the prescribed framework. The Company will follow the legally applicable incident-notification requirements in force at the relevant time.

We retain personal data only for as long as reasonably necessary for the specific purpose for which it was collected, to comply with Applicable Law, to maintain legally required records, to prevent fraud and abuse, to resolve disputes, to establish or exercise legal rights, to enforce agreements, or for other lawful purposes.

Where the service or relevant record does not require further retention, we may delete, anonymise or otherwise dispose of personal data in a secure manner, subject to backups, legal holds and applicable retention requirements. Subscription expiry does not by itself require immediate deletion of Vault or account records where continued retention is necessary or lawfully permitted. Depending on the applicable service state, access to the Vault or related features may become restricted while relevant records are retained for renewal, support, security, legal, audit, dispute or other permitted purposes. The DPDP Act contemplates erasure when the specified purpose is no longer served, subject to lawful retention requirements. The DPDP Rules 2025 also provide purpose-linked deletion and specified minimum retention periods for certain logs and processing records.

Non-payment / outstanding dues

Where an account has unpaid subscription charges, disputed payments, chargebacks, failed payments, fraud indicators, or other outstanding financial obligations, we may retain relevant account, transaction, communication, consent, audit and dispute records for up to ten (10) years, or such longer period as may be required by Applicable Law, contractual obligations, legal claims, fraud prevention, audit or regulatory requirements. We will not retain unrelated personal data merely because a non-payment event occurred.

Deletion limitations

A deletion request does not require us to erase information that we are legally required or otherwise lawfully entitled to retain, including records needed for legal claims, fraud prevention, security, audit, tax/accounting, regulatory compliance, evidence preservation, or other applicable exceptions. Where full deletion is not possible, we may restrict, anonymise or segregate the information to the extent appropriate.

Subject to Applicable Law and any prescribed procedures, you may have rights including:

• –right to access or obtain a summary of personal data being processed and prescribed information about processing;
• –right to request correction, completion and updating of inaccurate, incomplete or outdated personal data;
• –right to request erasure of personal data where legally applicable and where retention is not required or otherwise permitted;
• –right to withdraw consent where processing is based on consent;
• –right to grievance redressal;
• –right to nominate another individual to exercise rights in the event of death or incapacity, where applicable; and
• –other rights that may be prescribed under Applicable Law from time to time.

The DPDP Act expressly recognises rights of access, correction/completion/updating/erasure, grievance redressal and nomination, subject to the Act, Rules and applicable procedures.

Requests may require reasonable authentication or verification so that we do not disclose or modify personal data at the request of an unauthorised person. We may refuse, limit or defer a request where permitted by law and will explain the applicable basis where required.

The Services are intended primarily for adults. We do not knowingly seek to process children’s personal data except where necessary and lawfully permitted. Where the DPDP Act requires verifiable consent of a parent or lawful guardian before processing a child’s personal data, we will seek to implement such verification in accordance with Applicable Law and the DPDP Rules. The DPDP Act also restricts processing likely to harm a child’s well-being and prohibits tracking, behavioural monitoring and targeted advertising directed at children, subject to statutory exceptions.

If a child’s or a person-under-guardianship record is provided to us through a User, the User represents that they are authorised to provide the information and any required consent. If we learn that such data was collected in a manner contrary to Applicable Law, we may restrict, delete or otherwise remediate the processing.

We may use artificial intelligence, machine-learning, automation, document-processing or decision-support tools for limited purposes including classification, search, summarisation, customer support, fraud detection, security, quality assurance, workflow assistance and product improvement, including but not limited to tools provided by third-party service providers.

AI-generated or automated outputs may be incomplete, incorrect, outdated or unsuitable for a particular legal, financial, tax, insurance, succession or other decision. Unless expressly stated otherwise, such outputs are assistive and do not constitute professional advice, ownership certification, death certification, succession determination or an authoritative record of an external institution.

Where appropriate, we may use human review, controls, validation or escalation for higher-risk workflows. We will not intentionally use personal data to train third-party public models in a manner inconsistent with Applicable Law or the consent/notice provided for the relevant processing.

Where permitted, we may use information from public sources, government portals, registries, authorised databases or third-party sources to support a service. Such information may be incomplete, delayed, unavailable, inaccurate or subject to access restrictions. Unless expressly offered as a defined verification service, we do not warrant that information retrieved from a third-party or government source is complete, current, authentic or determinative of ownership, entitlement or legal status.

The Platform may contain links, integrations or references to third-party services. Their collection and use of personal data are governed by their own terms and privacy policies, not this Policy, except to the extent we ourselves process the data as part of the integration. We encourage you to review the relevant third-party privacy documentation before sharing personal data with them.

We may use analytics and measurement tools to understand service performance, usage patterns, technical failures and user experience. Where implemented, this may include Google Analytics 4 (GA4) and related measurement technologies that collect events such as page views, navigation and technical/usage information, subject to applicable settings, notices and law. Where we use advertising or remarketing technologies, we will do so subject to Applicable Law, the settings we provide and the permissions/consents required for the relevant activity. We do not intentionally use the confidential asset information stored in your Vault as an advertising audience or sell your Vault records to advertisers as a data product.

You may request closure of your account through the available support channel. Closing an account may make the Services inaccessible and may trigger the deletion, anonymisation or restriction of personal data, subject to lawful retention requirements, including the retention provisions described in this Policy. Where a subscription expires, the account and relevant Vault records may continue to be retained and access may be restricted according to the applicable service state until renewal, closure, deletion or another lawful retention event.

Where a deletion or closure request affects shared information concerning nominees, claims, disputes, security incidents or other persons, we may retain the minimum information necessary to protect rights and comply with Applicable Law.

We will maintain a readily accessible mechanism for privacy and data-protection grievances. Where required by Applicable Law, we will publish the business contact details of the person responsible for answering questions concerning personal-data processing and/or the Data Protection Officer, as applicable.

The DPDP Act requires an effective grievance redressal mechanism, and the DPDP Rules prescribe a means through which Data Principals can make rights requests and grievances. We will maintain such mechanisms in accordance with the provisions applicable to us from time to time.

We may update this Policy from time to time to reflect changes in the Services, law, technology, data practices, security measures, or regulatory requirements. The updated version will be published through appropriate channels with a revised "Last Updated" date. Where a change materially affects your rights or the purposes for which we process personal data, we will provide additional notice and/or obtain fresh consent where required by Applicable Law.

This Privacy Policy shall be governed by the laws of India. Subject to any mandatory rights or forums available under Applicable Law, disputes concerning this Policy shall be subject to the courts having jurisdiction at [Insert City, State, India]. Nothing in this clause limits any statutory right of a Data Principal to approach the competent authority or forum prescribed by Applicable Law.

Virasat Setu Pvt. Ltd. Registered Office: 273, Rajbag Extension colony, Ratlam, Madhya Pradesh-457001 Email: support@virasatsetu.com

Grievance Officer: Bhupendra Gehlot Email: support@virasatsetu.com

For privacy requests, correction/deletion requests, consent withdrawal, security concerns, data-access requests, or complaints, please use the official privacy/grievance contact published above.

By using the Platform, creating an account, providing personal data, activating a feature, or otherwise interacting with the Services, you acknowledge that you have been provided this Privacy Policy and that processing will take place in accordance with the applicable notices, consent choices, legal bases, settings and Applicable Law. Where explicit consent is required, use of the Services alone will not be treated as a substitute for the consent required by law.

This Privacy Policy is not intended to reduce or contractually waive any non-waivable rights available to a Data Principal under Applicable Law.

Legislative references in this Policy are to the versions of the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 available from the Ministry of Electronics and Information Technology, Government of India, as consulted for this draft. The Company should update this Policy when laws, rules, notifications, or regulatory directions change.