Privacy Policy

Tejas Mane, Infocity, Gandhinagar 382007, Gujarat, India, is the Data Fiduciary for personal data processed through StartupThrone under India's Digital Personal Data Protection Act, 2023 (the DPDP Act).

Questions and requests go to our Grievance Officer, Tejas Mane, at grievance@startupthrone.com, or through Help. See the Grievance Officer page for response times.

Buyers and visitors never create an account. Only our staff have accounts.

We use no advertising trackers and no third-party analytics, and we do not sell personal data.

• Listing details: the startup's name, pitch, website, logo and category. These are public. We strip the metadata from logo files before they are shown.
• Founder email: the address given when a startup is listed, for the receipt, the private edit link and alerts. Someone who only moves a listing up may leave it out.
• Payment orders and invoices: the amount, tax, status, Cashfree's reference and the invoice for each order.
• Payment events: the messages Cashfree sends us about each payment and refund, as Cashfree sends them.
• Phone number (optional): the number Cashfree may require for your payment receipt.
• Support tickets: your name, email and message when you contact us.
• Reports: the reason and detail a visitor gives when reporting a listing, with a keyed hash of their network address that changes every day, used only to stop duplicate reports. Nothing in it identifies the reporter.
• Launch list: before payments opened, people could leave an email address to hear when listing opens. Those addresses get one email, when it does.
• Staff audit logs: a record of every action our staff take.

Site visits are counted in HyperLogLog sketches, a counting structure fed with a keyed hash of your network address. A sketch can estimate how many different visitors there were, but nothing stored in it can identify a visitor or list who visited.

"Visit" links on the board go through /go/<listing>. That counts one visit per visitor per day, using a keyed hash that changes every day, and stores no address. We add ?ref=startupthrone to the address you are sent to, so the startup can see that you came from us.

Crawlers are not counted.

We process personal data with your consent, given when you enter it, and for the legitimate uses the DPDP Act allows, such as meeting legal duties and preventing fraud. We use it to:

• publish listings and take payments;
• issue invoices and keep the tax records the law requires;
• send the emails described below, only if you gave an address;
• answer support requests and complaints;
• keep the board safe: checking listings, handling reports and preventing abuse.

Only if you gave an email address, we send:

• a receipt when your listing is live, with its place;
• an alert when your listing is passed while it is inside the top 10, at most one every half hour;
• the moderator's decision on your website link and logo;
• a reminder a few days before your listing leaves the board;
• a removal notice with the refund amount, if a moderator removes your listing.

Every email has a one-click link that stops all emails to that address.

We set no cookies for buyers or visitors, except what the payment page needs to take your payment. Staff sign-in uses a session cookie.

We share personal data only with processors that help us run the service:

• Cashfree Payments, for payments and refunds;
• our email provider, to send email;
• our hosting provider, which runs the site and its database;
• Google Safe Browsing, which we ask about website addresses before a listing is accepted;
• where we use one, a content classifier that checks listing text and logos.

We also disclose data when the law requires it.

• Orders, invoices and payment records: 8 years, as India's GST and income-tax rules require. These stay even if you ask us to erase your other data.
• Everything else: only as long as we need it for the purposes above, and erased when you ask, unless the law requires us to keep it.

Under the DPDP Act you can ask for:

• Access: a summary of the personal data we hold about you.
• Correction and completion: for example, a wrong founder email.
• Erasure: for example, removing your founder email. Tax records stay for as long as the law requires.
• Grievance redressal: through our Grievance Officer.
• Nomination: someone to exercise your rights if you die or become incapacitated.

Ask through Help or the Grievance Officer. Because there are no accounts, we may ask you to confirm the request from the email address concerned. To stop emails at once, use the link in any email. If you are not satisfied with our response, you can complain to the Data Protection Board of India after using our grievance process.

You must be 18 or older to pay. We do not knowingly collect personal data from children, and listings may not be about or aimed at children.

Data is encrypted in transit. Staff accounts are created by us, staff sign in with a one-time code sent by email plus an authenticator app, and every staff action is logged. If a personal data breach occurs, we inform the Data Protection Board and the people affected as the DPDP Act requires.

We update this policy when our practices change. The date at the top shows the latest version.