Privacy Policy

At The Indian Startup, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational platform.

Important: The Indian Startup is an educational platform providing learning resources, guides, and templates. We do not provide professional services such as legal, financial, or business consulting. All information collected is used solely to enhance your learning experience.

1. Information We Collect

Personal Information

When you register for our Service, we collect:

• Name
• Email address
• Phone number
• Password (encrypted)
• Payment information (processed by Razorpay)

Usage Information

We automatically collect:

• Log data (IP address, browser type, pages visited)
• Device information
• Cookies and similar technologies
• Usage patterns and preferences

User Content

Information you provide through the Service:

• Startup portfolio information (your business plan, market research, financial projections, and the outputs of the course tools). Sensitive portfolio fields are encrypted at rest.
• Progress data and achievements
• Support tickets, bug reports, and product feedback you send us
• Where a course involves it, structured records you create in that course — for example patent-portfolio entries in our IP course

We do not currently offer file or document upload, so we do not hold uploaded files.

2. How We Use Your Information

We use your information exclusively for educational platform purposes:

• Provide access to educational content and learning materials
• Process your course purchases and payments
• Send course updates and learning notifications
• Track your learning progress and award achievements
• Improve and personalize your learning experience
• Ensure platform security and prevent fraud
• Comply with legal obligations

We do not use your information to provide professional services or act on your behalf in any business matters.

3. Information Sharing

We do not sell your personal information. We may share your information with:

Service Providers

These are every third party that receives personal data from us, what they get, and where they process it:

• Supabase — authentication and database. Holds all account, course, portfolio and payment data. Hosted on AWS Mumbai (ap-south-1).
• Razorpay — payment processing. Receives your name, email, phone (if you gave one) and the order amount. Processed in India. Card details go directly to Razorpay and are never stored on our servers.
• Vercel — hosting and content delivery. Receives request metadata (IP address, user agent, the page path). Global edge network; our serverless functions run in the iad1 region (United States).
• GoDaddy — outbound transactional email (sign-up confirmations, receipts, password resets). Receives your email address, name, and the contents of those emails. GoDaddy is US-headquartered; we have not independently confirmed the region their mail servers process in.
• Sentry — crash reporting, processed in the United States. Receives error messages and stack traces with email addresses, phone numbers, identifiers and tokens stripped out before sending. No session recording.
• PostHog — product analytics, US ingest. Receives a one-way hashed account identifier (never your email, name or phone), page views and feature-usage events. Only if you turn analytics on in the cookie banner. Turning it off stops it immediately.
• cron-job.org — triggers our scheduled jobs (reminder emails, reconciliation, data retention). Receives no personal data; it only calls our own URLs with a shared secret.

Other Users

The platform is single-player today — community, forums and posts are not enabled. The only place other learners can see you is the optional XP leaderboard, which shows:

• Your display name, your XP total, your streak, and your badges
• If you have not set a display name, the part of your email address before the “@” is used instead. Set a display name in your profile if you would rather that not be shown.

Your portfolio, your course answers and your payment history are never visible to other users.

Legal Requirements

We may disclose your information if required by law or in response to valid legal requests.

4. Data Security

We implement appropriate security measures to protect your information:

• Your phone number and the sensitive fields of your startup portfolio are encrypted at rest with AES-256-GCM
• All connections are HTTPS-only
• Row-level security in the database, so one account cannot read another's data
• Limited internal access to personal information, with an audit trail
• We never see or store your password. Authentication is handled by Supabase Auth, which stores only a one-way hash.

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your information for as long as necessary to provide the Service and comply with legal obligations. These periods are enforced automatically by a daily job, not just stated here:

• Account, course progress, portfolio: while your account is open. Deleted when you delete your account.
• Purchase records in our database: deleted with your account. Razorpay keeps its own transaction record independently, under its own retention policy, because it is the entity that processed the payment.
• Security and audit logs (sign-ins, admin actions, security events): 365 days.
• Sent transactional emails: 30 days, then the stored copy of the message is deleted.
• Background job records: 7 days after the job finishes.
• Notifications: 30 days after you read them, 90 days if unread.
• Payment-provider webhook records: 90 days once processed, 180 days otherwise.
• Blog page-view records: 90 days.
• Crash reports (Sentry):90 days, per Sentry's own retention.
• Analytics events (PostHog),if you enabled analytics: retained under PostHog's configured project retention.

6. Your Rights

We process your personal data as a Data Fiduciaryunder India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). As a Data Principal (the individual to whom the data relates), you have the following rights:

• Right to access: obtain a summary of the personal data we process about you and the processing activities undertaken
• Right to correction and erasure: have inaccurate or incomplete data corrected, updated, or completed, and request deletion of data no longer needed for the purpose it was collected
• Right to withdraw consent: withdraw any consent you previously gave, at any time, as easily as you gave it — withdrawal does not affect processing already carried out before withdrawal
• Right to grievance redressal: a readily available means to raise grievances about our processing (see the Grievance Officer section below)
• Right to nominate: nominate another individual to exercise these rights in the event of your death or incapacity
• Export your data, opt out of marketing communications, and control cookies

Getting a copy of your data: sign in and use the “Download my data” link on your profile page (or call /api/me/export directly). It returns a JSON file containing every row we hold about you, across every table, including the records we retain for audit purposes. Limited to one export per hour.

To exercise any of these rights, or to withdraw consent, contact us at support@theindianstartup.in or our Grievance Officer (below). We will respond within the timelines required by the DPDP Act. You may also lodge a complaint with the Data Protection Board of India if you are not satisfied with our response.

Deleting your account: You can delete your account yourself at any time from your account settings. You will be asked to re-enter your password to confirm. Deletion is scheduled immediately and completed after a 30-day grace period, after which your data is permanently removed. Requesting deletion signs you out everywhere and disables sign-in straight away, so if you change your mind during those 30 days you must email support@theindianstartup.in to cancel — you will not be able to sign in and do it yourself. If you are unable to sign in at all, email support@theindianstartup.in and we will process the deletion on your behalf.

7. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you logged in
• Remember your preferences
• Analyze usage patterns
• Improve the Service

You can control cookies through your browser settings, but disabling them may limit functionality.

8. Children's Privacy

Our Service is not intended for children under 18. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

9. International Data Transfers

Your account, course, portfolio and payment data is stored in India (AWS Mumbai) and payments are processed in India by Razorpay. Some data does leave India:

• United States — Vercel (request metadata, from serverless functions running in iad1), Sentry (scrubbed crash reports), and PostHog (hashed identifier and usage events, only if you enabled analytics).
• Outbound email is sent through GoDaddy, a US-headquartered provider. Your email address, name and message contents pass through their servers.

Under section 16 of the DPDP Act, transfers outside India are permitted except to countries the Central Government specifically restricts. None of the above is in a restricted jurisdiction as at the date of this policy.

10. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before providing any information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email and by posting the new policy on this page. The "Last updated" date will be revised.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

13. Grievance Officer

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address your questions, data-privacy requests, and complaints about how we collect, use, or disclose your information.

We will acknowledge your grievance within 24 hours and aim to resolve it within 15 days of receipt, in line with applicable law. For general support that is not a grievance, you can also reach us at support@theindianstartup.in or via our contact page.