1. Scope, Governance & Data Fiduciary Role
This Privacy Policy applies to all services, web applications, APIs, developer tools, and community features operated by VenturLoop Technologies ("VenturLoop", "we", "us", or "our"). Under the Digital Personal Data Protection Act, 2023 (India) and applicable global regulations including the EU General Data Protection Regulation (GDPR), VenturLoop acts as a Data Fiduciary / Data Controller for user identity credentials and platform telemetry, and as a Data Processor for venture-specific datasets managed by registered startup founders.
1.1 Entity Information
- Legal Entity: VenturLoop Technologies Private Limited
- Operating Headquarters: Bengaluru, Karnataka, India
- Data Protection Contact: privacy@venturloop.com / dpo@venturloop.com
1.2 Acceptance & Consent
- By registering an account, publishing a startup profile, or accessing VenturLoop services, you acknowledge having read and freely consented to the data collection and processing activities set out herein.
- Consent may be modified, narrowed, or withdrawn at any time through your Account Security settings or by submitting a request to our Data Protection Officer.
2. Categories of Data We Collect
We collect only data necessary to deliver authenticated founder access, power verified startup profiles, enable structured community feedback, and facilitate verified mentor interactions.
2.1 Identity & Profile Information
- Account Credentials: Full name, professional email address, encrypted password hash, and OAuth authentication identifiers.
- Professional Profile: Role, founder bio, LinkedIn profile URL, avatar image, and contact preferences.
2.2 Startup & Venture Datasets
- Startup Living Profiles: Company name, domain, logo, tagline, pitch summary, target market, business model, and operational stage.
- Venture Metrics & Milestones: Progress updates, product launch timelines, revenue/traction milestones (when voluntarily published).
- Pitch & Validation Assets: Pitch decks, demo video links, problem/solution statements uploaded for feedback review.
2.3 Telemetry, Device & Diagnostic Data
- Technical Identifiers: IP address (anonymized at subnet level), browser user-agent, operating system, and screen resolution.
- Usage Logs: Page views, navigation timestamps, search query logs, and CTA engagement metrics for performance optimization.
- Essential Cookies: Secure session tokens, CSRF validation tokens, and UI preferences (e.g., dark/light theme).
3. Google API Services & OAuth Integrations (Limited Use Disclosure)
VenturLoop incorporates optional Google OAuth and API integrations to streamline founder workflows. We strictly adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3.1 Scopes Requested & Functional Purpose
- Google Sign-In (OpenID/Profile): Used solely to authenticate your identity securely without storing plaintext passwords.
- Google Calendar API: Requested strictly to synchronize and schedule live pitch practice sessions, mentor calls, and founder review calendar events directly from your dashboard.
- Gmail API (Limited Scope): Used exclusively for automated, user-initiated transactional notifications, founder-mentor communications, and platform updates authorized by the user.
3.2 Limited Use Affirmations
- No Human Review: We do not allow human staff or subcontractors to read your personal emails or private calendar details unless explicitly authorized for targeted technical debugging requested by you.
- No Advertising Use: Google Workspace user data is never used or transferred for serving advertisements, retargeting, or data broker sales.
- Zero LLM Training on Google Data: Information accessed via Google APIs is NEVER used to train, retrain, or fine-tune generalized artificial intelligence or machine learning models.
4. AI Data Ethics, LLM Governance & Confidentiality
VenturLoop uses state-of-the-art machine learning models to assist founders with pitch readability suggestions, venture categorization, and startup discovery algorithms.
4.1 Proprietary Data Isolation
- Confidential Sandbox: Any pitch deck or private founder submission processed by our AI validation tools operates in an isolated, stateless compute environment.
- Zero Foundation Model Training: We maintain strict enterprise Data Processing Agreements (DPAs) ensuring that third-party AI providers (e.g., OpenAI, Anthropic, Google Cloud Vertex) do NOT use your proprietary startup submissions to train public models.
- Deterministic Output Verification: Automated AI suggestions are purely advisory and do not represent formal investment ratings or statutory legal advice.
5. Purpose of Processing & Lawful Basis
Under the DPDP Act 2023 and GDPR Article 6, we process your personal and venture data under the following lawful bases:
6. Zero-Sale Commitment & Approved Subprocessors
VenturLoop does not sell, lease, monetize, or trade your personal or venture data to third parties, data aggregators, or advertising networks.
6.1 Approved Infrastructure Subprocessors
- Cloud Hosting & Edge CDN: Vercel Inc. (USA / Global Edge) & Amazon Web Services (AWS Mumbai Region) — ISO 27001, SOC 2 Type II certified.
- Transactional Email & Deliverability: Resend Inc. / Amazon SES — TLS 1.3 encrypted transactional transport.
- Payment Processing: Razorpay Software Private Limited & Stripe Inc. — PCI-DSS Level 1 certified gateways.
- Analytics: Privacy-focused, anonymized analytics engine with IP masking and zero cross-site tracking cookies.
7. Enterprise Security Architecture & Encryption
We enforce defense-in-depth technical, administrative, and physical safeguards designed to guarantee the integrity and confidentiality of your information.
7.1 Technical Safeguards
- Encryption at Rest: All sensitive database records, stored documents, and OAuth tokens are encrypted using AES-256 with managed key rotation.
- Encryption in Transit: All data transferred between client browsers, platform APIs, and database instances is enforced via TLS 1.3 / HTTPS with Strict Transport Security (HSTS).
- Access Control & RBAC: Principle of least privilege with mandatory Multi-Factor Authentication (MFA) and immutable audit logs for all engineering operations.
- Vulnerability Management: Automated dependency scanning, continuous CI/CD security linting, and scheduled third-party penetration testing.
8. User Rights & Data Subject Controls
Regardless of your geographic location, VenturLoop extends comprehensive privacy controls and statutory data rights to all registered users:
8.1 Rights You Can Exercise
- Right to Access & Data Portability: Request an export of your complete account history, startup profile data, and feedback records in machine-readable JSON format.
- Right to Rectification: Correct, update, or complete any inaccurate profile or company information directly in your settings.
- Right to Erasure (Right to be Forgotten): Request permanent deletion of your account and associated venture profiles. Active data will be permanently wiped within 30 days.
- Right to Revoke Integration Permissions: Instantly disconnect OAuth integrations (Google Sign-In, Calendar, Gmail) via account settings or directly via your Google Security portal.
- Right to Restrict or Object: Opt out of non-essential communications, community notifications, and recommendation digests at any time.
9. Data Retention & Archival Policies
We retain personal data only for the duration necessary to fulfill the operational purposes outlined in this Policy, comply with statutory tax and accounting requirements, and resolve formal disputes.
9.1 Retention Windows
- Active Accounts: Retained while the account remains active and in good standing.
- Deleted Accounts: Personal credentials, venture pitch files, and OAuth tokens are permanently purged from active databases within 30 calendar days.
- Encrypted Backups: Disaster recovery backups are automatically overwritten and purged on a rolling 90-day cycle.
- Financial Transaction Logs: Retained for 7 years as required by Indian Income Tax and statutory corporate compliance laws.
10. Grievance Officer & Contact Information
In accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and Consumer Protection (E-Commerce) Rules, the contact details of our designated Grievance Officer and Data Protection Team are provided below:
10.1 Grievance Redressal Mechanism
- Designation: Data Protection & Grievance Redressal Officer
- Legal Entity: VenturLoop Technologies Private Limited
- Official Email: privacy@venturloop.com / dpo@venturloop.com
- Mailing Address: VenturLoop Technologies, Koramangala Innovation Hub, Bengaluru, Karnataka 560034, India
- Resolution Timeline: All written complaints will be acknowledged within 24 hours and resolved within 15 business days.
Official Grievance & Compliance Registry
Under Rule 3(2) of the Information Technology (Intermediary Guidelines) Rules, 2021 and Section 12 of the DPDP Act, 2023: