Privacy Policy

Vanderline Projects ("the Service") is provided by Avantime Consulting India Private Limited ("Avantime", "we", "us") under the Vanderline brand. This policy explains what personal data we process when organizations and their people use the Service and our website, why we process it, and the rights you have. It is written for the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

• Workspace content (projects, tasks, timesheets, messages, files and the personal data of the customer's users and contacts): the customer organization is the Data Fiduciary, and we act as its Data Processor, processing that data only on its instructions to provide the Service.
• Account, billing, support and website data: we are the Data Fiduciary.

• Account data: name, work email address, designation, profile photo, organization, role and permissions. If you sign in through Vanderline One, we receive these details from it.
• Workspace content: projects, tasks, comments, timesheet entries (hours, categories and descriptions), approvals, milestones, budgets, project chat messages, files, kudos and performance information that the organization records.
• Client accounts: name and email address of people at the organization's own clients who are given read-only access.
• Billing data: plan, seats, payment history, invoices, and the billing name, email, GSTIN and state used on tax invoices. Card and bank details are handled by Razorpay; we never see or store full card or bank details.
• Support and website data: what you send us by email or through the contact form (name, email, company and message).
• Security and usage records: sign-in and sign-out events, an audit trail of actions in the workspace, and IP addresses used for security and rate limiting.
• Device notifications: if you turn on notifications for a device, the browser's push subscription for that device.

We do not sell personal data, use it for advertising, or profile you for marketing.

• to provide, secure and support the Service, and to keep it working reliably;
• to create and manage accounts and sign-in;
• to bill for the Service, issue tax invoices and keep accounting records;
• to send service email such as sign-in codes, invitations, reminders, digests and billing notices;
• to answer your questions and complaints;
• to meet our legal obligations and enforce our Terms and Conditions.

Where we are the Data Fiduciary, we rely on the consent given when an account is created (we record when it was given) and on the legitimate uses the DPDP Act allows, such as meeting legal obligations. You may withdraw consent by writing to us, but we may then be unable to keep providing the Service to you.

We share personal data only with service providers that help us run the Service, under contracts that protect it:

• Razorpay (India): payments.
• SendGrid (Twilio) (USA): email we send, such as sign-in codes, password resets, invoices and billing notices.
• Amazon Web Services: encrypted storage of files, profile photos and logos.
• Cloud hosting providers: application, database and cache infrastructure.
• Sentry (USA), where enabled: error reports, set up so that request headers, cookies and IP addresses are not sent.
• Vanderline One and Vanderline Notify: our own suite services for sign-in and notifications.

An organization may connect its own email provider (SMTP, SendGrid or Resend) so that email is sent from its own domain. That provider is chosen and contracted by the organization, not by us. We may also disclose data where the law requires it.

Data may be processed outside India, for example in Singapore or the USA, by our service providers, as the DPDP Act permits.

• Account and workspace data: for as long as the organization has an account, including while its workspace is read-only.
• Items deleted in the workspace go to the organization's Recycle Bin, where administrators can restore them. Items purged from the Recycle Bin are hidden from the organization but kept in our database as a record until the organization's data is deleted.
• When an administrator asks us to delete the organization's data, we do so within 30 days, and backups roll off within 90 days.
• Records the law requires us to keep, such as our own invoices and payment records, are kept for the period the law requires.

We protect personal data with reasonable security safeguards, including:

• encryption in transit (HTTPS/TLS) for all traffic;
• hashed passwords, and encryption at rest (AES-256-GCM) of credentials stored in a project's Environments tab;
• separation of each organization's data, role-based access controls and permission checks;
• an audit log of security-relevant actions, sign-in lockout after repeated failures, CSRF protection and rate limiting;
• regular backups.

No system is completely secure, and we cannot guarantee absolute security.

Under the DPDP Act you have the right to:

• access a summary of your personal data and how it is processed (you can download a copy of your own data from Profile → Privacy & Data → Export My Data);
• correct and complete your data (your name, designation and photo can be edited in your profile);
• erasure (Profile → Privacy & Data → Delete my account removes your name, email and photo and closes your account; the organization's business records stay, with your name replaced by "Deleted User");
• grievance redressal (section 13);
• nominate another person to exercise these rights if you die or become unable to do so.

Write to support@vanderline.com for anything you cannot do yourself. Requests about workspace content are passed to, and handled with, the organization that controls it, because it is the Data Fiduciary for that content.

The Service uses only what it needs to work. It sets:

• access_token and refresh_token: keep you signed in (httpOnly, secure);
• csrf_token: protects your session against cross-site request forgery;
• vl_signin: a short-lived cookie used while you sign in through Vanderline One.

It also keeps small preferences in your browser's local storage, such as whether you dismissed the cookie notice, sidebar and panel layout, and board display settings. We use no analytics, advertising or third-party tracking cookies.

The Service is for organizations and is not meant for anyone under 18. We do not knowingly process the data of anyone under 18.

If a personal data breach occurs, we will notify affected customers and the Data Protection Board of India as the law requires, with what happened and what we are doing about it.

Our Grievance Officer can be reached at support@vanderline.com with the subject line "Grievance". We acknowledge a grievance within 24 hours and resolve it within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Avantime Consulting India Private Limited · support@vanderline.com

For a material change we will email administrators at least 30 days before it takes effect, and update the date at the top of this page. See also our Refund and Cancellation Policy.