Privacy notice

This notice explains what personal data Next Inology Private Limited ("we", "us") collects through vanshikatanwani.com and our WhatsApp channel, why, how long we keep it, and the rights you have under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

Who we are. vanshikatanwani.com is the official website of the artist Vanshika Tanwani and carries her name. It is run by Next Inology Private Limited (CIN U72200RJ2021PTC078220, registered office 304 Shankeshwar Darshan, Inspiring Street, Pali, Rajasthan 306401, India, email [email protected], phone +91 73740 10010), which takes all payments and issues all invoices. Next Inology Private Limited is the Data Fiduciary for the personal data described here.

1. What we collect

• Your WhatsApp phone number. Your number is your account. You log in with a one-time code sent on WhatsApp plus a 6-digit MPIN you choose. One-time codes expire after 5 minutes and are deleted automatically. Your MPIN is stored only as a one-way hash; nobody, including us, can read it.
• Profile details you give us: display name, email (optional, for receipts), language and theme preferences, and whether you want WhatsApp marketing broadcasts.
• Date of birth. Buying, booking and paid memberships are for adults only, so we ask for your date of birth to confirm you are 18 or older.
• Payments. Payments are made to Next Inology Private Limited and processed by Razorpay. We receive the order and payment reference, amount, status and method type. We never see or store your full card number, CVV or UPI PIN. Invoices carry your name, phone number and email.
• ID verification for experiences. Before your first in-person experience (coffee meet, festive meet, group trip) we ask for a government ID and a selfie. These are stored in a private, encrypted store, are visible only to Vanshika and our developer, and every view is logged.
• Bookings and purchases: what you booked or bought, when, seats, check-in status and any incident notes.
• Requests you send: shoutout instructions, brand inquiries and briefs, licensing requests, contact-form messages.
• Messages. Messages you send us on WhatsApp, and delivery and read receipts for messages we send you.
• Comments and club activity: comments, likes, poll votes and reports in the fan club.
• Technical data: IP address, device and browser details, used for security, rate limiting, fraud prevention and enforcing bans. Site analytics use Cloudflare Web Analytics, which is cookieless and does not identify you.
• Shop link clicks: which link, from which post, country and device type, so we know which looks people like.

2. Why we use it

• To log you in and keep your account secure.
• To confirm you are 18+ before any purchase, booking or paid membership.
• To take payments, issue invoices and meet tax and accounting law.
• To run memberships, lives, calls, shoutouts, downloads and experiences you sign up for, and to send the messages those need (login codes, booking confirmations, reminders, receipts, venue details, security notices).
• Service messages are always on. They go to you on WhatsApp, by email and, if you allowed notifications in your browser, as web push. They are part of the service you signed up for, so there is no switch to turn them off.
• To keep experiences safe: verifying who is attending, checking in, and acting on incidents.
• To reply to inquiries and manage brand collaborations.
• To moderate the community and enforce our Terms and Community rules.
• Marketing on WhatsApp only with your consent. The marketing checkbox is separate from login consent and unticked by default. We record when and where you agreed. Reply STOP to any marketing broadcast to stop them.

We use your data for purposes you consented to, or for the legitimate uses the DPDP Act allows (for example, to provide a service you asked for, or to comply with law).

3. Age

vanshikatanwani.com is meant for adults. You must be 18 or older to buy, book, or join a paid tier. If you are under 18, please do not create an account. If we learn that we hold a child's personal data without verifiable parental consent, we will delete it.

4. Who we share it with

We never sell your personal data. We share only what each service needs to do its job for us:

• Vanshika Tanwani, the artist, sees what she needs to run the club, bookings, calls, shoutouts and experiences: your display name, what you booked or bought, your messages to her and, for experiences, your ID verification.
• Razorpay to process payments.
• Konvo (by Naybr), our WhatsApp Business solution provider, to send login codes and messages and receive your replies. Messages travel over WhatsApp, which is run by Meta, so Meta also handles them under WhatsApp's own terms and privacy policy.
• Our email provider to send receipts and invoices.
• Cloudflare and Amazon Web Services to host the site, servers and files.
• 100ms to run live streams and video calls.
• Licensed travel partners, only for group trips you book, and only the details needed for the booking.
• Authorities, when Indian law requires it.

5. How long we keep it

• ID documents and selfies: deleted automatically 30 days after the experience they were collected for, or 30 days after a verification is rejected.
• One-time login codes: 5 minutes.
• WhatsApp message logs and shop click logs: 180 days, after which only anonymous daily totals remain.
• Payment and invoice records: as long as Indian tax and accounting law requires (currently up to 8 years).
• Account and profile data: while your account is active. When you ask us to erase your account (section 6) we erase it, except records the law requires us to keep.
• Backups: encrypted backups roll over every 30 days, so erased data leaves backups within 30 days.

6. Your rights

Under the DPDP Act you can:

• Access a summary of the personal data we hold and how we use it.
• Correct or update it. You can edit your name, email and language yourself in /me/settings; for anything else, write to us.
• Erase it. There is no delete button on the site: write to us and we will close your account and erase your data. Some records (like invoices) are kept as the law requires.
• Withdraw consent to marketing at any time: reply STOP to a WhatsApp marketing broadcast. This does not affect service messages about your account or things you booked or bought.
• Nominate someone to exercise these rights if you die or become incapable.
• Raise a grievance with our Grievance Officer (below). If you are not satisfied with our response, you may complain to the Data Protection Board of India.

How to make a request. Email the Grievance Officer at [email protected] from the email on your account, or include the WhatsApp number you log in with, and say what you want (a copy, a correction or erasure). To protect you, we may ask you to confirm the request on WhatsApp before we act on it. We aim to respond within 30 days.

7. Security

Data is encrypted in transit. Secrets are encrypted at rest. Paid and private media is served only through short-lived signed links. Your account needs a WhatsApp code plus your MPIN; the artist's and developer's accounts also need an authenticator app, and every privileged action is recorded in an audit log.

8. Cookies and local storage

We use one essential cookie to keep you signed in. Your theme and language choices are stored on your device. We do not use advertising or third-party tracking cookies.

9. Grievance Officer and contact

For access, correction or erasure requests and any privacy complaint:

Shreyans Bokadiya, Grievance Officer, Next Inology Private Limited Email: [email protected] Phone: +91 73740 10010 Registered office: 304 Shankeshwar Darshan, Inspiring Street, Pali, Rajasthan 306401, India

10. Changes

If we change this notice in a way that matters, we will update the date on this page and tell you on the site or on WhatsApp.