Privacy Policy

Last updated: 17 September 2026

This policy describes how Vrutaz Advisors (“Vrutaz”, “we”, “us”) collects, uses, and shares information when you use vrutaz.com, create an account, form or manage a US company through our staff, or contact us.

Contact: info@vrutaz.com · United States +1 850-629-6671 · India +91 95107 03821
US registered office: Vrutaz Advisors LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.

1. Who this covers

It covers visitors, customers who create an account, people whose details are entered as company owners or “people on record,” and staff using the admin panel. It does not cover third-party websites we link to (Secretary of State sites, banks, Google, YouTube, and so on).

2. What we collect

Account

• Name, email address, and a password (stored as a hash by our auth provider — we do not keep a readable copy).
• If you use Continue with Google: the Google account email, display name, and a Google user id. We do not receive your Google password. Google sign-in only works after an operator enables the Google provider in Supabase Auth.
• Staff flag (is_staff) on the profile — a role, not a second password.

Company and formation

• Proposed company name, state, entity type (LLC or C-Corp), owners, ownership percentages, contact phone and email, industry, and mailing addresses you enter in the wizard or dashboard.
• Limited taxpayer identifiers when a filing needs them (for example an SSN/ITIN last four or a nine-digit shape). Do not send full ID card photos in chat unless staff ask through the vault upload.
• Order and plan details, add-ons, and (when card checkout is turned on) payment status from Stripe. Stripe is off in production until the operator enables it; we do not store full card numbers on Vrutaz servers.

Document vault

Formation papers, EIN letters, owner uploads, and staff-uploaded files stored in the document vault under your company. Access is limited by row-level security: customers see their companies; staff see what they need to file and support you.

Support, mail, and compliance

• Chat and email with support, including optional auto-replies to greetings and FAQs.
• Logged US mail (registered-agent / mailroom scans) when that service applies.
• Compliance calendar tasks generated from your filing date, state, and entity, plus staff-set dates.

Technical data

• Browser local storage for the signed-in session and a few UI preferences (see cookies, below).
• Standard hosting logs (IP address, user agent, URL, time) from our host.
• We do not currently run a live advertising or product-analytics pixel on the marketing site. The in-app Analytics page is a demo unless you later connect a channel with us.

3. How we use it

• Create and secure your account, and send you to the customer dashboard or (if you are staff) the admin panel.
• Prepare and file formation, EIN, registered-agent, and other services you request — staff complete those filings; there is no unattended public filing API.
• Store documents, show deadlines, scan mail, and answer support.
• Send transactional email (confirmations, staff replies when you have been off the site, deadline notices if enabled).
• Improve reliability and prevent abuse (session repair, rate limits, fraud checks on checkout if Stripe is on).

We do not sell your personal information. We do not use your vault files to train public AI models.

4. Legal bases (where they apply)

If you are in the EEA, UK, or a similar regime, we typically rely on: contract (providing the service you asked for), legitimate interests (securing the product, staff operations, limited product improvement), consent (optional Google sign-in; any future marketing you opt into), and legal obligation (tax and company-record retention where the law requires it). This summary is not a GDPR Article 13 notice drafted by counsel.

5. Third parties who process data for us

We use processors to run the product. Each has its own terms. We do not put API secrets in this website’s git repository.

• Supabase — authentication, Postgres database with row-level security, file storage (vault and blog images). Project region is currently ap-south-1 (Mumbai).
• Netlify — hosts the static site (https://vrutaz.com and pull-request previews).
• Resend — transactional email (signup confirmation, support and deadline notices) when the operator has configured SMTP / RESEND_API_KEY.
• Google — Google OAuth only if you click Continue with Google and the operator has enabled that provider. Google’s own privacy policy applies to your Google account.
• Stripe — card checkout only after the operator enables it. Until then we do not send card details anywhere.
• YouTube / Vimeo — if a blog post includes a video, playing it loads a privacy-friendly embed (youtube-nocookie.com or Vimeo with DNT) from those companies. We do not load that player on text-only posts.

Secretaries of State, the IRS, banks, and payment platforms receive what is required to complete a filing or application you asked us to make. That is the point of the product.

6. Cookies and local storage

We use strictly necessary storage, not advertising cookies:

• vz-auth (and related Supabase keys) — signed-in session in this browser.
• vz_user — display name/email chip on the dashboard (not your password).
• vz_nav_open and similar keys — which sidebar groups you left open.
• A few company-draft keys so the wizard can resume.

You can clear site data in your browser; that signs you out of this device. It does not delete your account on our servers. Use “Stuck on this screen? Reset and try again” on the login page to drop a bad local session.

7. Retention

We keep account, company, order, vault, and support records for as long as you have an account and as long as we reasonably need them to provide the service, resolve disputes, and meet bookkeeping or legal holds (formation and tax files are often kept for several years). If you ask us to delete an account, we will remove or irreversibly de-identify personal data we are not required to keep. State and IRS filings we already submitted are public or government records and cannot be “un-filed” by deleting the dashboard.

8. Your rights

Email info@vrutaz.com from the address on the account to:

• Access or correct profile and company details (much of this you can already edit in the dashboard).
• Download copies of vault files you or staff uploaded.
• Ask us to delete the account, subject to legal retention.
• Withdraw Google sign-in by disconnecting Google in your Google account and/or asking us to unlink the identity. Email-and-password login remains available.

If you are in the EEA/UK you may also have rights to restrict processing, object, data portability, and to complain to a supervisory authority. We will need to verify that the request is from the account holder.

9. International transfers

We serve founders worldwide. Data may be processed in the United States, India (support and current database region), and the countries where our processors operate. If that is a problem for your situation, talk to us before you upload sensitive documents.

10. Children

The service is for people forming and running companies. It is not directed at children under 16. We do not knowingly collect their data.

11. Security

Access to customer rows is enforced in the database (row-level security). The browser only has a publishable key. The service_role key is not in this website. Staff accounts are ordinary logins with an is_staff flag. No method is perfect; please use a unique password and tell us if you see unexpected access.

12. Changes

We will change the “Last updated” date when this policy materially changes. Continued use of the site after that date is how we treat acceptance of the updated template, until counsel gives us a different process.

13. Contact

Privacy questions: info@vrutaz.com
Phone: +1 850-629-6671 · +91 95107 03821
Mail: Vrutaz Advisors LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.

Related: Blog · Create account · Contact