Privacy policy

Last updated: 3 July 2026 · Applies to vistraal.com and, unless a product publishes its own policy, to SitesFare, Naadham, PillCycle and the Vistraal AI Marketplace.

1. Who we are

This Privacy Policy describes how Vistraal Private Limited ("Vistraal", "we", "us", "our"), a company incorporated in India with its registered office at 2/3B,Madanapalle,Andhra Pradesh,India,517325, collects, uses, stores and protects your personal data when you use our websites, applications and services (collectively, the "Services").

Individual products may publish product-specific privacy policies (for example, at naadham.ai/privacy). Where a product-specific policy exists, it applies to that product in addition to this policy.

2. Data we collect

Information you provide

• Account data: name, email address, phone number, and password (stored as a hash) when you create an account.
• Billing data: billing name, address, GSTIN (for business customers), and transaction history. Card and banking details are collected and processed directly by our payment processors (Razorpay and Stripe) — we never store your full card number, CVV, or banking credentials on our servers.
• Content you create: websites and files you build on SitesFare, agent configurations and FAQs on Naadham, medication schedules and related health information on PillCycle, and agent listings on the Vistraal AI Marketplace.
• Communications: messages you send us via contact forms, email, or support channels.

Information collected automatically

• Usage data: pages visited, features used, timestamps, and interaction logs.
• Device data: IP address, browser type, operating system, and device identifiers.
• Cookies: we use essential cookies for authentication and session management, and analytics cookies to understand how our Services are used. You can control cookies through your browser settings.

Sensitive personal data

PillCycle and Naadham may process health-related information (such as medication schedules or appointment details). This data is processed solely to deliver the respective service, is encrypted in transit (TLS 1.2+) and at rest, and is never used for advertising or sold to any third party.

3. How we use your data

• To provide, operate, maintain and improve the Services;
• To process payments, issue invoices, and prevent fraud;
• To communicate with you about your account, transactions, and service updates;
• To provide customer support and resolve grievances;
• To comply with legal obligations, including tax, accounting, and regulatory requirements (such as TRAI regulations applicable to Naadham's calling features);
• With your consent, to send product updates or marketing communications — you may opt out at any time.

4. Legal basis and consent

We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000, on the basis of your consent, the performance of a contract with you, or our legitimate and legal obligations. Where processing is based on consent, you may withdraw consent at any time by contacting us or using in-product controls; withdrawal does not affect processing already carried out.

5. Sharing and disclosure

We do not sell your personal data. We share data only with:

• Payment processors: Razorpay Software Pvt Ltd and Stripe, Inc., to process payments securely;
• Infrastructure providers: cloud hosting, content delivery (e.g., Cloudflare), telephony and messaging providers necessary to run the Services;
• Your designated recipients: for example, care-team members you add in PillCycle, or clinics whose Naadham agent you interact with;
• Legal authorities: where required by law, court order, or to protect our rights, users, or the public.

All service providers are bound by contractual confidentiality and data-protection obligations.

6. Data retention

We retain personal data only as long as necessary for the purposes described above, or as required by law (for example, financial records retained per Indian tax law). When you delete your account, associated personal data is deleted or irreversibly anonymised within 90 days, except where retention is legally required.

7. Security

• Encryption in transit (TLS 1.2+) and at rest;
• Row-level access controls and least-privilege access for our systems;
• Passwords, sessions and API keys stored only as hashes;
• Two-factor authentication available on supported products;
• Regular backups and monitoring.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we notify affected users and authorities of data breaches as required by the DPDP Act.

8. Your rights

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you;
• Request correction or completion of inaccurate data;
• Request erasure of your personal data;
• Withdraw consent;
• Nominate a person to exercise your rights in the event of death or incapacity;
• Lodge a grievance with us and, if unresolved, escalate to the Data Protection Board of India.

To exercise any right, email feedback@vistraal.com. We respond within the timelines prescribed by law.

9. Children

Our Services are not directed to children under 18. We do not knowingly collect personal data from children without verifiable parental consent. If you believe a child has provided us data, contact us and we will delete it.

10. International transfers

Your data is primarily stored in India. Where data is processed outside India (for example, by international infrastructure or payment providers such as Stripe), we ensure transfers comply with applicable law and are protected by appropriate safeguards.

11. Grievance office

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDP Act, 2023:

Grievance Office
Email: feedback@vistraal.com
Address: 2/3B,Madanapalle,Andhra Pradesh,India,517325
Grievances are acknowledged within 24 hours and resolved within 15 days.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the website or email. The "Last updated" date at the top reflects the latest revision. Continued use of the Services after changes constitutes acceptance.

13. Contact

Vistraal Private Limited
2/3B,Madanapalle,Andhra Pradesh,India,517325
Email: feedback@vistraal.com