Privacy Policy

This Privacy Policy describes how Vasudhaiva AI Solutions LLP, a Limited Liability Partnership incorporated under the Limited Liability Partnership Act, 2008, having LLPIN ACL-1443 and its registered office at Office No. 622, 6th Floor, Broadway Empire Building, Bhaily Police Station, Vadodara – 391410, Gujarat, India ("Vasudhaiva", "we", "us", or "our") collects, uses, discloses, retains, and otherwise processes the personal data of individuals ("you", "your", or "the participant") who access or use the Nirmaan AI platform at nirmaan.vasudhaiva.ai (the "Platform" or "Nirmaan AI").

Vasudhaiva is the Data Fiduciary in respect of the personal data described in this Policy, within the meaning of the Digital Personal Data Protection Act, 2023 (the "DPDP Act").

This Policy is published in compliance with the DPDP Act, the Information Technology Act, 2000 and the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

By accessing the Platform, enrolling in Nirmaan AI, or otherwise providing personal data to us, you acknowledge that you have read and understood this Policy. Where applicable law requires consent for any processing, that consent will be sought separately and granularly through the Nirmaan AI consent flow described in Section 6 of this Policy.

This Policy applies to:

• personal data we collect when you visit, register on, or use Nirmaan AI through any web or mobile interface;
• personal data you provide during enrolment, payment, project submission, or AI Mentor interactions;
• personal data generated about you in the course of your participation, including AI-generated review feedback, AI Mentor conversation logs, and portfolio entries; and
• communications between you and Vasudhaiva, including via email, the in-platform messaging system, and (where opted in) WhatsApp.

This Policy does not apply to third-party websites, applications, or services linked from Nirmaan AI. The privacy practices of such third parties are governed by their own privacy notices.

In this Policy, the terms "personal data", "data fiduciary", "data principal", "data processor", "processing", "consent", and "consent manager" carry the meanings given to them under the DPDP Act.

"Nirmaan AI" or the "Platform" means the Nirmaan AI programme offered by Vasudhaiva at the domain nirmaan.vasudhaiva.ai, including all sub-domains, features, mobile applications, and certificate verification systems.

"AI Mentor" means the artificial-intelligence-driven conversational and guidance system provided as part of Nirmaan AI.

"VidyaRaksha" means Vasudhaiva's proprietary AI governance and routing layer through which AI prompts and responses are processed.

Nirmaan AI is a professional development programme. It is not a degree, diploma, or accredited educational qualification within the meaning of the University Grants Commission Act, 1956, the All India Council for Technical Education Act, 1987, or any equivalent Indian or foreign law. Certificates issued by Vasudhaiva on completion of Nirmaan AI are professional programme completion certificates issued by Vasudhaiva in its own capacity, and not by any university or accredited education provider.

This distinction is relevant for privacy purposes because Nirmaan AI processes personal data for the delivery of a professional service, and not as a regulated educational institution.

We collect and process the categories of personal data set out in the table below. We collect only such data as is reasonably necessary for the purposes described in Section 6.

We do not knowingly collect financial account credentials, passwords, biometric data, or any data described as "sensitive personal data" under the Information Technology (Reasonable Security Practices) Rules, 2011, except where such collection is incidental to the operation of the Platform and clearly disclosed at the point of collection.

Each category of personal data is processed only for the specific purposes set out below. The legal basis for each processing activity, in accordance with the DPDP Act, is identified alongside the purpose.

Where our legal basis is consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Withdrawal may, depending on the data and processing in question, render the Nirmaan AI service unavailable to you in whole or in part; this consequence will be clearly indicated at the point of withdrawal.

We retain personal data only for as long as is reasonably necessary for the purposes for which it was collected, or for such longer period as is required by applicable law. The standard retention periods we apply are set out below.

On expiry of the applicable retention period, personal data is either deleted or irreversibly anonymised. Anonymisation is performed in such a manner that the data cannot, alone or in combination with other data, be used to identify a natural person.

Nirmaan AI relies on certain technology service providers whose infrastructure is located outside India, principally in the United States. As a result, your personal data is transferred outside India in the course of our processing. The principal cross-border transfers are:

• AI processing requests routed to OpenAI and Anthropic (United States) for the generation of project briefs, review feedback, AI Mentor responses, placement reports, and other AI outputs;
• Voice generation requests routed to ElevenLabs (United States) where the voice mode of the AI Mentor is enabled; and
• Notification delivery via Meta's WhatsApp Business Cloud API, which uses Meta's global infrastructure.

These transfers are necessary for the delivery of Nirmaan AI. Such transfers are made only to jurisdictions and recipients consistent with applicable Indian law, including any restrictions or directions that may be issued by the Central Government under Section 16 of the DPDP Act. We require each such recipient to maintain appropriate safeguards by way of contractual data processing terms.

By providing the consent described in Section 6, you specifically acknowledge that AI processing of your personal data involves transfer to the recipients listed above.

We engage the following data processors. Each processor processes personal data only on our documented instructions, and is bound by a written data processing agreement consistent with the DPDP Act.

This list is current as at the effective date of this Policy. We will update this Policy when we add or change material processors.

We use cookies and equivalent technologies to operate the Platform, to remember your preferences, and to understand how the Platform is used. Cookies are categorised as strictly necessary, analytics, and marketing. Strictly necessary cookies cannot be disabled because the Platform cannot function without them. You may accept or reject the other categories using the cookie banner presented on first visit, and you may change your choices at any time.

Detailed information about each cookie used on the Platform, including third-party cookies, is set out in our Cookie Policy, which is to be read together with this Privacy Policy.

Subject to the conditions and exceptions in the DPDP Act, you have the following rights in relation to your personal data.

11.1 Right to Access Information

You may obtain from us a summary of the personal data we process about you, the processing activities we undertake, and the identities of any other data fiduciaries with whom we have shared your personal data, together with a description of the data so shared.

11.2 Right to Correction, Completion, and Updating

You may request that we correct inaccurate or misleading personal data, complete incomplete personal data, and update outdated personal data. Many of these corrections may be made directly through your account settings.

11.3 Right to Erasure

You may request that we erase your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn the consent on which the processing was based, except where retention is required by law.

We aim to act on a valid erasure request within thirty (30) days of receipt. On erasure, we will: (a) delete or irreversibly anonymise your account record, (b) delete your project submissions from primary storage and from backups within their normal backup-cycle window, (c) take down your public portfolio, (d) revoke any active subscription, and (e) mark any issued certificate as revoked in our verification database. Records that we are required by law to retain (for example tax records) will be retained for the legally mandated period and processed only for that purpose.

11.4 Right to Grievance Redressal

You may raise a grievance with our Grievance Officer at any time. The contact details are set out at Section 17 of this Policy. We will acknowledge a grievance within seventy-two (72) hours of receipt and provide a substantive response within thirty (30) days, in line with the DPDP Act.

11.5 Right to Nominate

You may nominate another individual who will, in the event of your death or incapacity, be entitled to exercise the rights set out in this Section in your stead. The nomination is to be made through your account settings.

11.6 Right to Withdraw Consent

Where our processing is based on your consent, you may withdraw that consent at any time. Withdrawal is effected through the consent management controls in your account settings. You may also write to us at the contact address in Section 17. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11.7 How to Exercise Your Rights

You may exercise these rights by using the relevant controls in your account settings, or by writing to the Grievance Officer at the address set out in Section 17. We may need to verify your identity before acting on a request, in order to protect your data from being disclosed to others.

Where we rely on consent, we obtain it in a manner that is, in the language of the DPDP Act, free, specific, informed, unconditional, and unambiguous, and given by clear affirmative action.

During enrolment, we present separate, granular consent toggles for: (a) processing of personal data for the delivery of Nirmaan AI, (b) cross-border transfer of personal data to AI processing providers in the United States, (c) WhatsApp service notifications, (d) marketing communications, and (e) use of anonymised submissions for platform improvement. You may consent to any subset of these. Items (a) and (b) are necessary for participation in Nirmaan AI; items (c), (d), and (e) are optional.

You may, at any time, view your current consent status, withdraw any consent given, or update your consent, through the privacy controls in your account settings.

Nirmaan AI is intended for individuals who are eighteen (18) years of age or older. We confirm age at enrolment by way of an attestation.

Where, in our discretion, we permit participation by individuals between sixteen (16) and seventeen (17) years of age, we do so only with the verifiable consent of a parent or lawful guardian, in the manner required by Section 9 of the DPDP Act. We do not undertake behavioural monitoring of, or targeted advertising to, children. We do not knowingly collect personal data of children below sixteen (16) years of age. If we discover that we have collected such data, we will delete it promptly.

We implement reasonable security safeguards to protect your personal data against unauthorised access, use, modification, disclosure, or loss. These include encryption of data in transit (TLS) and at rest, access controls and the principle of least privilege, audit logging, periodic security review of our infrastructure, and contractual security obligations on our processors. Despite these measures, no system can be guaranteed to be entirely secure. We commit to ongoing review of our practices in line with applicable law and prevailing standards.

We maintain a documented incident response plan. In the event of a personal data breach, we will assess the breach without delay; notify the Data Protection Board of India as required by the DPDP Act; notify CERT-In in accordance with the timelines stipulated under the CERT-In Directions of 28 April 2022 and any successor instrument; and notify affected data principals where so required by law or where, in our reasonable view, notification is appropriate. We will provide affected individuals with information about the nature of the breach, the categories of data affected, the steps we are taking, and the steps they may take to protect themselves.

Nirmaan AI relies extensively on artificial intelligence. AI systems are used to generate project briefs, deliver review feedback on your submissions, generate placement reports, and provide AI Mentor guidance. The AI Mentor is an AI system and not a human professional; it is identified as such at first interaction and in our Terms of Service. AI-generated outputs are not reviewed by licensed professionals, and they do not constitute legal, medical, financial, or other regulated professional advice.

Where any AI-generated review materially affects your standing in the programme, that review is subject to a human-overseen appeal mechanism, the details of which are set out in our Terms of Service. You may write to the Grievance Officer to seek review of any decision that you believe was reached on an automated basis.

Inputs to AI systems are processed through Vasudhaiva's VidyaRaksha governance layer, which applies content moderation and routing rules. Vasudhaiva does not use your personal data to train third-party foundation models without your separate, specific consent.

The Grievance Officer designated by Vasudhaiva for the purposes of the DPDP Act is Mrs. Riddhi Darshil Bhatt, Designated Partner and Grievance Officer, reachable by email at legal@vasudhaiva.ai or by post at the Office of the Grievance Officer, Vasudhaiva AI Solutions LLP, Office No. 622, 6th Floor, Broadway Empire Building, Bhaily Police Station, Vadodara – 391410, Gujarat, India. We acknowledge a grievance within 72 hours of receipt and provide a substantive response within 30 days of receipt of a complete grievance.

If you are not satisfied with the response of the Grievance Officer, you may approach the Data Protection Board of India in accordance with the DPDP Act.

Nirmaan AI is offered globally. While Vasudhaiva is established in India and Nirmaan AI is principally governed by Indian law, we acknowledge that participants resident in jurisdictions such as the European Union, the United Kingdom, the United Arab Emirates, Singapore, Australia, and Malaysia may have additional rights under their local data protection laws.

As Vasudhaiva launches in those jurisdictions, supplementary privacy notices will be issued and made available alongside this Policy. Until those notices are issued, participants resident in such jurisdictions may contact the Grievance Officer at legal@vasudhaiva.ai with any privacy queries.

We may revise this Policy from time to time. Where a revision is material, we will give participants at least thirty (30) days' notice before the revised Policy takes effect, by email and by a prominent notice on the Platform. Continued use of Nirmaan AI after the effective date of a revised Policy constitutes acknowledgement of the revised Policy. Your existing rights and consents will not be diminished by a revision without your express opt-in to the change.

This Policy is governed by the laws of India. Any complaint, dispute, or claim arising from or in connection with this Policy will be addressed first to our Grievance Officer, and, failing satisfactory resolution, may be referred to the Data Protection Board of India in accordance with the DPDP Act, or to the competent courts at Vadodara, Gujarat, which will have exclusive jurisdiction subject to applicable statutory rights.