Privacy Policy

Last updated: 15 July 2026 · Applies to startupniti.com and login.startupniti.com.

Startupniti Media ("Startupniti", "we", "our", "us") operates the news publication at startupniti.com. This policy explains what personal data we collect, why, how long we keep it, and how you can request access to or deletion of your data. We follow India's Digital Personal Data Protection Act 2023 (DPDP), the IT Act 2000 and IT Rules 2021, and — where applicable to EU/UK visitors — the GDPR / UK GDPR.

What we collect

• Email address — when you sign up for an account or request an OTP. Used to send login codes and (in future) newsletter delivery.
• Google account identifier — if you sign in with Google OAuth, we receive your email, display name, and profile picture URL (nothing else). We do NOT receive password, contacts, or drive access.
• Session cookies — a single first-party session cookie (sn_session) issued after sign-in. Used only to identify you as a logged-in reader; not shared with third parties.
• First-party analytics — anonymous page views, referrer, and country (via Plausible-compatible self-hosted analytics). No IP addresses stored, no cross-site tracking.
• Server logs — standard HTTP access logs retained for 30 days, used for security and abuse investigation only.

We do not collect: precise location, contacts, device identifiers, biometric data, financial information (payments will be processed by Razorpay when subscriptions launch in Jan 2027 — that flow will be documented separately).

Why we collect it

• To authenticate you when you sign in (OTP delivery, session cookie).
• To send editorial content you asked for (newsletter, alerts) — only after you opt in.
• To measure aggregate readership (which stories, which sections, roughly which countries) so we can allocate editorial effort.
• To investigate security incidents and abuse.

Legal basis under GDPR: legitimate interest (analytics, server logs), performance of a contract (account features), consent (marketing communications).

How long we keep it

• Account data — until you delete your account, then removed within 30 days.
• OTP records — deleted after use or expiry (max 15 minutes).
• Server logs — 30 days rolling.
• Analytics — aggregated indefinitely; no per-user record retained.

Who we share data with

We do not sell your data. We share it only with the operational infrastructure needed to deliver the service:

• Cloudflare — CDN, edge caching, and DDoS protection for startupniti.com. See Cloudflare's privacy policy.
• Google — only when you choose to sign in with Google OAuth. Google receives the sign-in event; we receive your email and profile.
• Razorpay (from Jan 2027) — payment processing for premium subscriptions. Only if you subscribe.
• Law enforcement — only when compelled by valid legal process from a competent Indian authority.

Cookies

We use one first-party cookie: sn_session, set only after you sign in, used to identify your session. No third-party tracking cookies. Our analytics is cookie-less. You can block sn_session in your browser; you will not be able to sign in.

Your rights

You have the right to:

• Access the data we hold about you.
• Correct inaccurate information.
• Delete your account and all associated data.
• Withdraw consent for optional processing (newsletter, marketing).
• Complain to India's Data Protection Board (once notified) or your local supervisory authority if in the EU/UK.

To exercise any of these rights, email [email protected]. We respond within 30 days.

Data protection contact

For privacy questions, data-subject requests, or complaints: [email protected]. For grievance-officer contact (statutory under IT Rules 2021), see /grievance.

Changes to this policy

We revise this policy when material practices change. The "last updated" date at the top reflects the most recent revision. We will notify signed-in users of significant changes via email.

Operator: Startupniti Media · Bengaluru, India.