Privacy, consent and what we keep.

Value before registration, registration before persistence, consent before identity.

You can read GCC Pulse, Explore India, the GCC Directory and Vector Network without an account. You can complete Vector Assess without one. An account exists so that a result, a roadmap and a shortlist survive the tab closing, and so that what you buy from us and the deals you record are kept against your organisation. Your identity reaches another organisation only when you have said, for that organisation and that piece of work, that it may.

A consent is a record, not a setting.

Every consent is stored as its own row with the subject, the purpose, the exact scope, the organisation it concerns, the requirement it belongs to and the moment it was granted. The table is append-only: nothing overwrites a grant, so the history of what you allowed and when stays readable.

A consent granted for one purpose is not evidence of another. Naming yourself to one provider on one requirement does not name you to a second, and it does not permit an introduction. Each check runs against the purpose, the scope, the target organisation and the requirement together.

The consent table also has purposes for requirement disclosure, benchmark contribution, claim verification and marketing. Nothing in this build asks you for any of them, so none is ever recorded.

Withdrawing is one click, and it is recorded as its own event.

A withdrawal writes a new record that supersedes the grant; the grant itself is kept as history. From the moment it is written, every disclosure check reads the withdrawal and answers no — a provider who has not yet seen your name will not see it. Any member of the organisation a consent was made on behalf of may withdraw it, so a colleague being away cannot lock it open.

Three append-only logs, and why each exists.

Consent records

Who allowed what, for which purpose, to whom, and when. The basis for every disclosure.

Domain events

What happened in the product — an assessment started, a requirement created, an invitation accepted. Used to run the platform and to count funnels in aggregate. Payloads carry identifiers and states, not the contents of your documents.

Audit events

Who changed what, especially administrators. Redacted by design: no secrets and no confidential payloads. This is how a verification decision or a rejected claim can be reviewed later.

Vector Assess answers, roadmaps and requirements belong to your organisation and are readable only by its members. Every query against them filters by organisation before it returns a row.

What we keep when you pay us, and what Razorpay handles.

GCC Vector charges buyers for its own services only: the Journey subscription, connection fees and the programme set-up fee. Razorpay processes those payments for us. You type your payment details into Razorpay's own checkout window, under Razorpay's terms; we send Razorpay only the amount, the currency and our reference for the charge.

For each charge we keep what was bought, the amount and currency, its state, who in your organisation started it and when it was paid. For each payment we keep Razorpay's payment and order references, the amount, the currency, the status and, once Razorpay's webhook reports it, the payment method. GCC Vector never stores card details, and keeps no contact or email data from Razorpay. A card payment counts only when our server has checked Razorpay's signature; the browser's word is never enough. An administrator can also record a payment received outside Razorpay, such as a bank transfer, with a reason, and that is audited. A receipt is issued for each charge you pay. Your charges and receipts are shown to members of your organisation, and our administrators see charges in the billing console.

Money you pay a vendor never passes through GCC Vector. After a connection, the deal record holds what you and the vendor enter: quotes, purchase orders, invoices, payments you report, the vendor's confirmation and receipt, and onboarding steps. It stores no files, only links you add. Both sides of that deal see the same record; a platform administrator can read it too, and that read is itself recorded.

A professional profile is yours, hidden until you show it, and then seen only by members of buyer organisations and our administrators.

A professional profile holds your name from your account and what you choose to write: headline, city, summary, kind of work, expertise, sectors, functions, years of experience, experience and education entries, certifications, availability, preferred engagement and a LinkedIn link. There is no photo or file upload. A profile is free.

A new profile is hidden. Once you choose to show it, it can be read and searched only by signed-in members of a buyer organisation (any account can register one) and our administrators, for moderation. A hidden profile is seen by nobody but you. Profiles never appear on a public page, in the sitemap or to search engines, and the pages that show them are never cached. There are no job listings, applications or messages to professionals.

You can edit, hide, export (as JSON) and delete your profile yourself at any time. Deleting removes the profile at once; the audit record notes that a profile was deleted and keeps nothing it said. Edits are audited by which fields changed, not what they say. An administrator can hide a profile from buyers for moderation, with a reason you can see; the reason goes when the profile does.

What the AI sees.

The GCC Navigator answers from published guides, sourced facts and your own organisation's context. Authorization runs before anything reaches the model, so a prompt is assembled only from material you were already entitled to read. Answers carry citations, and where the evidence is thin the Navigator says so rather than filling the gap. It does not give legal, tax or immigration conclusions, and it says so when you ask for one.

Data region

This deployment is configured for the asia-south1 region, and the application and its database run there. We make no blanket data-residency claim: email delivery, Razorpay as our payment processor, and the model provider behind the Navigator are third parties with their own regions, and we are not going to describe them as ours.

Retention, stated honestly.

Your account, your organisation's work and the three logs above are kept while the account is open. V1 has no automated deletion schedule — there is no job that expires old rows, and we are not going to claim one. Deletion and export of an account or an organisation are handled on request by a person, within thirty days of a verified request. A professional profile is different: you export and delete it yourself, from your profile page.

Two things survive a deletion request and we would rather say so now: an audit record of an administrator's decision, and a consent record that establishes a disclosure already made. Both are the evidence that the platform behaved correctly, and both are redacted of content. Everything else goes.

Records of what you paid GCC Vector — charges, payments and receipts — are kept while the account is open, like everything else. What happens to them after an account closes has not been decided yet; when it is, this page will say so, dated.

We link to sources; we do not republish them.

GCC Pulse and Explore India carry metadata and a short transformative summary of each source — never its body. The canonical link to the publisher is always shown, the publication date is always shown, and each source carries a recorded rights basis. A summary is machine-drafted from the metadata and reviewed before it is published. If you are a publisher and want an item removed, write to support@gccvector.in and it comes down while we look at it.

The GCC Directory is built from public sources. Every fact on a profile shows where it came from and when it was last checked, and a fact that has gone stale is labelled stale rather than quietly kept. Anyone can submit a correction, with or without an account, and nothing changes on the public page until an administrator accepts it.

What this page used to say, and what replaced it.

Paid connections, billing and professional profiles went live on 21 Oct 2026 (ADR-008, ADR-009). These sentences were on this page before that date and are no longer true as written; each is quoted exactly. The data-region paragraph also named a third-party service this build does not use; that name is removed.

• Before: “Showing a provider you invited what you wrote and, if you chose it, who you are.”

  Now: An invited provider sees the brief and an anonymous label. Your organisation is named to a provider only when you open a paid private connection with it on a requirement set to name you, and that is recorded as an introduction consent.

• Before: “Deletion and export are handled on request by a person, within thirty days of a verified request.”

  Now: That still holds for accounts and organisations. A professional profile is the exception: its owner exports and deletes it directly, at any time.

How to reach us about your data.

For access, correction, erasure, a withdrawal you could not complete in the product, or a grievance, write to privacy@gccvector.in. Tell us the email address you use here so we can find the account. We answer within thirty days, and we will tell you what we did rather than only that we did something.

Our conflicts, and how ranking and verification are kept apart from money, are on the neutrality page.