Privacy Policy

1. What this site collects

The booking form is the only point where you give the site personal data. When you submit it, the following is stored:

• Your name
• Your mobile number (Indian format)
• Session type (e.g. Consultation — 15 minutes or 30 minutes)
• Life area you want the conversation to cover
• Your preferred date and time
• Language preference (English or Hindi)
• Your timezone (auto-detected from your browser; defaults to Asia/Kolkata)
• Any notes you choose to include

Two additional fields are recorded for abuse prevention: your IP address at the time of submission, and your browser’s user-agent string. These are kept with the record and not used for tracking across other sites.

2. What this site does NOT collect

• No user accounts. The site has no sign-up or login.
• No birth-chart storage. If you want a reading, the chart is computed at consultation time and discussed live; nothing is saved to the site.
• No ad pixels or cross-site identifiers. The site does not embed advertising trackers or retargeting pixels.
• No payment data. Razorpay handles payment under their own terms (see §4).

3. Why we collect what we collect

Single purpose: so Vipin can contact you to confirm a time and conduct the session. Notes you provide help him prepare — they are not shared further.

IP and user-agent exist to rate-limit submissions and detect automated abuse. They are not used to target advertising or build a profile.

4. Third parties that touch the data

• MongoDB Atlas— stores booking-request records. Hosted in the AWS Mumbai region. Atlas’s own privacy terms apply to the storage layer.
• Vercel— hosts the website and serves the booking API. Standard server logs (date, path, response code, country) are retained per Vercel’s defaults. Vercel Analytics and Speed Insights collect aggregate page-view and performance data; no personally identifiable information is sent.
• Google Analytics 4— measures page visits and navigation patterns using anonymised identifiers. IP addresses are anonymised at collection by Google’s default settings. Event data is retained for 14 months and then automatically deleted. No personally identifiable information is attached to events; field-name dimensions (e.g. whichform field was focused) are sent, field values are never sent. Data is processed by Google under their privacy terms. You can opt out via Google’s opt-out browser add-on or by blocking analytics scripts. If your browser sends the Do Not Track signal, Hotjar behavioural recording is disabled; Google Analytics page-view counting still runs but with the anonymisation above. A note on returning visitors. Google sets an anonymous identifier in your browser (the “GA client ID”) so it can tell a returning session from a new one. When you submit the booking form, we store this anonymous identifier alongside your record so the site can recognise you on a later visit. It cannot be used to identify you off the site, and it never leaves Google’s and our own systems. When the database recognises you (i.e. you have booked before), the site derives a one-way fingerprint from your record — a cryptographic hash of your internal record ID combined with a server-only secret — and sends it to Google Analytics as a user identifier. The fingerprint contains no name, phone, email, or anything reversible. Its only purpose is to let Google merge your sessions across devices so the analytics view is one return visitor rather than two strangers. Alongside the fingerprint we send two aggregate signals: the number of consultations you have had (a count) and the status of your most recent booking (pending / completed / cancelled). These help us understand return-visitor patterns without sending any specifics about the booking. Some events are sent from our server, not your browser. When your booking status changes — confirmed by Vipin, completed after the consultation, cancelled, no-show — the same status change is also reported to Google Analytics. For completed sessions, the amount paid is included so we can match revenue back to the anonymous source you arrived from.
• Hotjar / Contentsquare — records anonymous behavioural sessions (mouse movement, clicks, scrolling) so we can see where the site confuses people. No keystrokes are recorded inside form fields. Sessions are retained for 365 days. Honours the Do Not Track browser signal — if your browser sends it, Hotjar does not load on this site.
• Cloudflare Turnstile— an invisible bot-detection check that runs only on the booking form. Cloudflare receives your IP address and some browser characteristics so it can decide whether to challenge a suspected bot. No data you typed into the form is sent. The check is silent for real visitors; bots are blocked from submitting.
• Razorpay— processes payment when you book. Card and bank details are entered into Razorpay’s flow, not into this site. Razorpay’s privacy policy governs payment data.
• Motherboard (internal)— when a booking request is submitted, the same record is forwarded to an internal notifications service so Vipin sees it on his phone. This is Vipin’s own infrastructure; no third party receives the data through this path.

5. Cookies and local storage

The site sets the following identifiers, all first-party unless noted.

Cookies:

• _ga, _gid— Google Analytics. Distinguish browsers across sessions. Expire in 2 years (_ga) and 24 hours (_gid).
• _hjSession*, _hjSessionUser*— Hotjar. Group page-views into a behavioural session. Expire in 30 minutes and 365 days respectively. Not set if your browser sends Do Not Track.
• cf_clearance, __cf_bm— Cloudflare. Set by the Turnstile bot check on the booking form. Expire when the browser closes (__cf_bm) and after 30 minutes (cf_clearance).

Browser local storage:

• theme— your light/dark preference, so the site doesn’t flash the wrong palette on next visit.
• lang— your English / Hindi preference.

Blocking the Google Analytics or Hotjar cookies disables analytics for your session. Blocking the Cloudflare cookies may cause the booking form to challenge or block your submission. Clearing local storage means the site forgets your theme and language between visits.

6. Retention

Booking-request records are retained for as long as the consultation relationship is active, and for up to 24 months after for record-keeping. After that, records are deleted from the live database. Server logs (Vercel) follow Vercel’s retention defaults.

You may request earlier deletion at any time (see §8).

7. Confidentiality of consultations

What you discuss in a consultation stays between you and Vipin. Notes Vipin gives you are for your own use; no part of your consultation appears anywhere else on this site or elsewhere. The notes are not subject to the retention rule above — they are yours, not the site’s.

8. Your rights (DPDPA 2023)

You have the right to:

• See what personal data we hold about you.
• Correct it if it’s wrong.
• Have it deleted.
• Withdraw consent (which means we delete the data and the booking is cancelled).
• Nominate someone to exercise these rights on your behalf if you cannot.
• Complain to the Data Protection Board of India if you believe your rights have been violated.

To exercise any of these, email contact@vipinkaushik.com with the phone number you booked under so we can identify the record.

9. Children

The booking form is for adults (18+). Vipin Kaushik does not knowingly collect personal data from anyone under 18. If you believe a record was submitted on behalf of a child, contact us and it will be deleted.

10. Changes to this policy

This policy may be updated. Material changes will be notified via the site. The effective date at the top of this page is authoritative.

11. Contact

Data fiduciary: Vipin Kaushik
For data requests, corrections, deletion, or complaints: contact@vipinkaushik.com

Postal: C-29, Omaxe City Centre, Sohna Road, Gurugram 122001, Haryana, India.