Privacy policy

• Your deck and documents are stored in India, in the Mumbai region.
• They are encrypted at rest with AES-256.
• They are served only over signed links that expire after fifteen minutes. Nothing sits on a guessable public path.
• Viewer analytics on your share links count people without storing their IP addresses.
• We never sell your content, never share it with other founders or investors, and never use it to train a publicly available model.
• You can delete your documents and share links yourself, and they go.
• You can download a copy of everything we hold about you, or erase your whole account, yourself from Settings in the dashboard. Clause 8 says what that covers.
• The exception is payment records: after you erase your account we keep them for eight years from the payment, with your name and email removed, and then delete them.

ShunyaSe, registered in India, is the data fiduciary for the personal data described here, under India's Digital Personal Data Protection Act, 2023.

Grievances go to our grievance officer at support@shunyase.com. We aim to respond within thirty days.

Account data. When you sign in with Google we receive your name, email address and profile picture from Google. We do not receive, and never see, your Google password. We use your Google account for sign-in only.

Your mailbox, if you connect one for Outreach. To send the emails you approve from your own address, we keep your mailbox's app password, encrypted (AES-256-GCM). Every few minutes we read new mail in that mailbox and keep only replies and bounces to emails Outreach sent for you; anything else is left alone, unread by us and unchanged (nothing is moved, flagged or marked as read). A kept reply is logged on that investor's card in your pipeline. Disconnecting removes the stored password at once and pauses your campaigns.

What you upload and enter. Pitch decks, financial figures, cap table records, documents, company profile details, and the notes and contacts you keep in the CRM. This is the bulk of what we hold, and all of it is data you chose to give us.

Usage data. Which features you use and when, so we can operate and improve the product, plus standard server logs for security and debugging.

Share-link analytics. When someone opens a link you have shared, we record that a view happened, how long it lasted and which pages were read. Unique viewers are counted from a one-way fingerprint of the connection. We can tell you the same person came back twice; we cannot tell you, or anyone, who they are. We do not store the IP address.

• To provide the service: scoring your deck, building your model, matching investors, serving your share links. Basis: performance of our contract with you.
• To keep the service secure: abuse prevention, rate limiting, incident investigation. Basis: our legitimate interest in a service that is not being attacked.
• To meet legal obligations: billing records and tax retention. Basis: legal obligation.

We do not use your content for advertising, and we do not profile you for anyone else's benefit.

Deck analysis, model narration and drafting features send the relevant part of your content to a third-party model provider so it can be processed. That content is sent for the purpose of returning your result, and is not used to train a publicly available model.

If you would rather not have a document processed this way, do not run the AI features on it. The rest of the platform works without them.

Uploaded files, including decks, models and documents, are stored in Oracle Cloud Object Storage in the Mumbai (ap-mumbai-1) region. They do not leave India to sit at rest somewhere else. Files are encrypted at rest with AES-256 using provider-managed keys; nothing is written to disk in the clear.

Files are never served from a public path. Every request mints a signed URL that expires after fifteen minutes, so a link that is copied out of your browser goes dead on its own.

Two processing partners operate outside India: the AI model provider, and email delivery. Where that happens, only the data needed for that specific function is sent.

Only you, and anyone you hand a share link to. Share links are per-document and you can switch any of them off at any moment, which takes effect immediately.

A small number of our staff can access production systems where strictly necessary to operate the service or to resolve a problem you have reported. We do not browse your documents.

We share personal data with third parties only in these cases: our hosting and storage provider, our AI processing provider, our payment provider (which handles card details directly, so we never see or store them), and where the law requires it.

• Content you delete: removed from active systems on deletion, and purged from backups within 30 days.
• An account you close: content deleted within 30 days of closure.
• Payment records: kept for eight years from the date of the payment, to meet Indian tax and accounting record-keeping rules, and then deleted. If you erase your account they are kept with your name and email removed until those eight years are up. While your account is open, your billing history stays on it. They are held separately from your uploaded content.
• Server logs: retained for a short operational window, then discarded.

Under the DPDP Act you can:

• ask what personal data we hold about you, and get a copy of it;
• correct anything inaccurate;
• have your data erased;
• nominate someone to exercise these rights if you cannot;
• complain to us, and then to the Data Protection Board of India.

You can correct your startup profile, delete individual documents and share links, download a copy of everything we hold about you, and erase your whole account, all yourself from Settings in the dashboard. Erasing your account deletes your data and your stored files straight away; payment records are kept for eight years from the payment, with your name and email removed, and then deleted, and copies in our backups are purged within 30 days. For anything a button cannot do, or if you would rather ask, write to our grievance officer at support@shunyase.com and we will respond within thirty days. For anything else, write to support@shunyase.com.

We use browser storage to keep you signed in and to remember small interface preferences. We do not run third-party advertising or cross-site tracking cookies.

If we change how we handle your data in a way that matters, we will update this page and tell account holders. The date at the top always reflects the current version. Your use of ShunyaSe is also governed by our terms of service.