Legal

Privacy Policy

Last updated: June 2026 · Compliant with DPDP Act 2023 and IT Act 2000

1. Who We Are

StartupOSS is operated by [Company Name] (CIN: [CIN]), registered in Hyderabad, Telangana, India. We are a data fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023.

2. Data We Collect

We collect only what is necessary to provide our service:

  • Account data: Name, email, phone number, company name, CIN
  • Business data: State, sector(s), incorporation date
  • Usage data: Tasks completed, grants viewed, doubt submissions
  • Payment data: Transaction IDs only — we do not store card details (handled by Razorpay)
  • Device data: Browser type, IP address (for security purposes only)

3. How We Use Your Data

  • To provide personalised compliance checklists and grant recommendations
  • To send INC-20A deadline reminders and compliance alerts (critical service notifications)
  • To respond to your doubt submissions via WhatsApp and email
  • To process payments and issue GST invoices
  • To improve the Platform (aggregated, anonymised analytics only)

4. Consent and Lawful Basis (DPDP Act 2023)

We process your personal data on the following lawful bases:
  • Contract performance: Data required to provide the service you signed up for
  • Legitimate interest: Service improvement, security
  • Consent: Marketing communications — you can withdraw at any time

5. Data Sharing

We do not sell your data. We share it only with:

  • Supabase: Database and authentication (servers in ap-northeast-1)
  • Razorpay: Payment processing (PCI DSS compliant)
  • Resend / email provider: Transactional emails only
  • Legal requirement: If required by Indian law or court order

6. Your Rights (DPDP Act 2023)

As a data principal under the DPDP Act, you have the right to:
  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Erase your data (right to be forgotten) — submit a request to privacy@startuposs.in
  • Withdraw consent for non-essential processing
  • Nominate a person to exercise your rights on your behalf
We will respond to all data rights requests within 72 hours.

7. Data Retention

We retain your data for as long as your account is active. After account deletion, we retain anonymised usage data for analytics for up to 2 years. Payment records are retained for 7 years as required by Indian accounting law.

8. Security

We use industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest (via Supabase), Row Level Security (RLS) policies, and regular security audits.

9. Cookies

We use essential cookies only for authentication session management. We do not use advertising or tracking cookies.

10. Data Protection Officer / Grievance

Name: [DPO Name]
Email: privacy@startuposs.in
Response time: 72 hours

11. Changes to This Policy

We will notify you of material changes 30 days in advance via email. The updated policy will always be available at this URL.