1.Who we are and what this covers
VPV (Virtual Plant Visit) is a 360° virtual-tour platform operated by The Next Design, a proprietorship. We help manufacturers host immersive tours of their facilities and share them with their own customers through private links.
This policy explains what personal data we handle, why, who else handles it, how long we keep it, and what you can do about it. It applies to the VPV website, dashboards, tour viewer and presenter tools. We handle personal data in line with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, to the extent each applies and is in force.
2.What we collect, and why
| Data | What it includes | Why we use it |
|---|---|---|
| Account data | Name, work e-mail, mobile number, role, password (stored only as a salted hash), device identifier. | To create and secure your account, sign you in and send service messages. |
| Organisation content | Panoramas, logos, hotspot text, narration audio, media, client names and notes you add. | To render your tours and run your dashboards. |
| Viewer analytics | A random device identifier, approximate country, scenes viewed, hotspot clicks, time spent, the e-mail a Viewer enters for a gated link, and the recipient tag you set on a link. | To show you who viewed your tours and enforce link rules. |
| Presentation sessions | When a presenter turns them on: voice recording, a text transcript, the presenter’s location (coordinates and a place name), duration, outcome and the client the session was for. | To give your team a record of client meetings and to power the optional AI analysis. |
| AI analysis output | Speaker-split dialogue, topics detected, a summary and a score generated from a transcript. | To help you review how a meeting went. |
| Billing data | Billing name, address, GSTIN, billing e-mail, order and invoice details, the payment ID, amount, status and method type (for example UPI or card) returned by Razorpay. | To take payment, issue GST invoices, keep tax records and answer billing queries. |
| Enquiry data | What you submit through the qualification (apply) form or by e-mail: name, company, contact details and your answers. | To assess and reply to your enquiry. |
| Support messages | The content of your e-mails to us and any files you attach. | To resolve your issue and improve the Service. |
| Security and device data | IP address, browser type, sign-in times, failed sign-in attempts, active device sessions, new-device alerts. | To prevent abuse, enforce rate limits and the device cap, and investigate incidents. |
We do not collect your card number, CVV, UPI PIN or net-banking credentials. Those go straight to Razorpay on its secure checkout.
3.What we do not do
- We do not sell personal data, and we do not share it with advertisers or marketing networks.
- We do not use advertising or cross-site tracking, and we do not set tracking cookies.
- We do not fingerprint people across websites. The device identifier is a random ID kept in your own browser and scoped to our domain.
- We do not use your content, recordings or transcripts to train AI models, and we send an AI provider only the transcript text needed to return a result.
- VPV does not join your calls or record Viewers. Recording happens only on a presenter’s own device when the presenter switches it on.
4.Recordings, location and AI analysis
These features are optional and controlled by the presenter and the organisation.
- Recording. The recorder captures the presenter’s microphone. If the presenter also chooses to share a browser tab or system audio, the recording can include the sound of that tab — which may be other participants of a video call. The browser asks for permission each time. Audio is stored in your organisation’s private storage area and is visible only to people your organisation authorises.
- Transcription. Speech is turned into text in the presenter’s browser, using the browser’s built-in speech recognition and, where available, an on-device model. Built-in recognition is provided by the browser maker (for example Google in Chrome, or Microsoft in Edge) and may process audio on its servers under that company’s own terms. VPV does not send the audio file to an AI provider.
- AI analysis. If an organisation asks for it, the transcript text (not the audio) is sent to an AI provider — NVIDIA’s hosted inference service or Google’s Gemini API — to separate speakers and produce a summary and score. If neither is available, a rule-based method runs inside VPV instead.
- Location. If the presenter allows it in the browser prompt, we store the coordinates and look up a readable place name from them. Declining the prompt does not affect the presentation.
Consent. The organisation must inform everyone on a recorded conversation and obtain the consent applicable law requires before recording. Under our Terms this is the organisation’s responsibility, and it can delete any recording at any time.
5.How we use personal data
- To provide, secure and support the Service you have bought.
- To take payments, issue GST invoices and meet tax and accounting duties.
- To send service messages: sign-in and new-device alerts, password resets, invoices, renewal reminders, support replies, and notices of changes to prices, terms or this policy. These are not marketing; you cannot opt out of them while you have an account, because they carry information you need.
- To detect abuse and protect other customers.
- To fix defects and improve the Service, using aggregated or de-identified data where possible.
- To comply with law and respond to lawful requests.
7.Where data is stored and transferred
Your data is stored mainly in Frankfurt, Germany, and processed on global infrastructure operated by the providers above. Because VPV is operated from India, this involves transferring data across borders. We use providers that apply encryption in transit and access controls, and we transfer personal data only to countries and providers permitted under Indian law.
9.How we protect data
Every database table is protected by row-level security so one organisation cannot read another’s data. Traffic is encrypted, panorama files use signed URLs, sign-in is rate-limited, and active devices are capped. Read the full list on the Security page. No online service can promise perfect security; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.
10.How long we keep data
| Data | Retention |
|---|---|
| Account data and organisation content | While your organisation is active, and for 90 days after cancellation so you can return; then deleted. |
| Presentation recordings and transcripts | Until your organisation deletes them, or 90 days after cancellation. |
| Viewer analytics | 24 months. |
| Security logs and device sessions | 30 days. |
| Billing, invoice and payment records | As long as Indian tax and accounting law requires (currently up to 8 years). |
| Support and enquiry messages | 24 months after the last message. |
11.Your rights
You may ask us to:
- give you a copy of your personal data and a summary of how it is used;
- correct or update data that is wrong or incomplete;
- delete data we no longer need to keep;
- stop processing that relies on your consent, by withdrawing it; and
- nominate someone to exercise your rights if you are unable to.
Write to privacy@myvpv.com. We may need to verify who you are, and we reply within 30 days. For tour content and Viewer analytics, the request should come from your organisation’s administrator, because the organisation controls that data. If a Viewer contacts us about a tour, we will pass the request to the organisation that shared it.
12.Children
VPV is a business product and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe we hold data about a child, write to us and we will delete it.
13.Changes to this policy
We may update this policy. For material changes we will e-mail the administrator on record and show a notice on the sign-in page at least 14 days before they take effect. The “Effective” date at the top always shows the current version. Changes to prices are covered separately in the Terms: we give 30 days’ prior notice by e-mail.
14.Grievance officer and contact
If you have a concern about how your data is handled, contact our grievance officer. We acknowledge complaints within two business days and aim to resolve them within 30 days.
- Grievance Officer: Aryan Bansal, The Next Design
- E-mail: privacy@myvpv.com
- Security disclosures: security@myvpv.com
- Everything else: support@myvpv.com or the Contact page