Privacy Policy

This Privacy Policy explains how Ripl Media, [a sole proprietorship] with its place of business at [registered address], India (“Ripl Media”, “we”, “us”), handles personal data on RiplCap, its software platform. It also serves as our notice under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it.

1.1 Whose data. This policy covers personal data of Investors and their team members, Startup founders and team members, contacts at Portfolio Companies, and visitors to our website.

1.2 Our two roles. For account, billing, security, website and product usage data, we decide why and how the data is used, so we act as Data Fiduciary (controller). For personal data inside Content that an Investor uploads or directs us to collect, such as pitch materials and portfolio records, the Investor decides the purposes and we act as Data Processor on its instructions.

1.3 Other laws. Where they apply to you, we also follow the Information Technology Act, 2000 and its rules, the UK GDPR and EU GDPR, Singapore’s Personal Data Protection Act, the UAE Personal Data Protection Law, and US state privacy laws.

1.4 Related terms. Capitalised words such as Investor, Startup, Content and Platform have the meanings given in our Terms of Use.

2.1 We do not ask for sensitive data such as government identity numbers, bank login details, or health information. Please do not upload them unless a feature clearly asks for them.

2.2 Where you must give some data to use a feature, we say so when we ask. If you do not give it, we may not be able to provide that feature.

3.1 Founders and team members. An Investor may add data about a founder or team member, and a Startup may include data about its own team in a pitch. In both cases the person who adds it must have the right to do so and must give any notice the law requires.

3.2 Who is responsible. For data inside an Investor’s pipeline or portfolio, the Investor is the Data Fiduciary and we process it on its behalf. If you want to see, correct or delete that data, you can ask the Investor, or write to us and we will pass your request on.

3.3 How we may have your email. If you receive an automated email sent through RiplCap, the Investor, or the Startup you work with, gave us your contact details so that we could send it. Section 13 explains how to stop these messages.

4.1 India. We rely on your consent for each specified purpose, or on a legitimate use that the DPDP Act allows, such as where you voluntarily give data for a purpose and have not objected, or where the law requires processing. You can withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing done before it. It may stop us from providing a feature that needs the data.

4.2 UK and EU. The bases are those shown in the table: consent, contract, legal obligation and legitimate interests.

4.3 We do not sell personal data, and we do not use it for third party advertising.

5.1 We use automated tools, including artificial intelligence, to summarise pitches, extract data from documents, analyse financial information and calculate metrics. They process Content only to provide these features to the Investor who uses them.

5.2 Our AI and cloud providers act on our instructions and are bound by confidentiality and security duties. [Confirm: our contracts do not allow them to train their models on your Content.]

5.3 Automated Outputs can be wrong, so Investors review them before relying on them. We do not make decisions about individuals that have legal or similarly significant effects based only on automated processing.

5.4 If you think an Output about you is wrong, write to us and we will correct it or pass it to the Investor concerned.

6.1 Investors and Startups. A pitch goes to the Investor whose Pitch Link was used, and to the team members that Investor authorises. Document requests and reminders go to the recipients the Investor chooses. We do not show one Investor’s pipeline or portfolio to another Investor.

6.2 Service providers. We share data with providers who help us run the Platform, under written contracts.

6.3 Legal and safety. We disclose data where the law, a court or a regulator requires it, including to the Data Protection Board of India, and where needed to protect rights, safety and security.

6.4 Business changes. If Ripl Media is converted into a company, merged or sold, your data may transfer to the successor, which must honour this policy. We will tell you first.

6.5 With your consent. We share data in other ways only if you ask us or agree.

7.1 We are based in India. Our providers may store or process data in [countries], and our users are in the UK, US, Singapore, the UAE and elsewhere, so data can cross borders.

7.2 India. The DPDP Act allows transfers outside India except to countries the Government restricts. We will not transfer data to any restricted country.

7.3 UK and EU. Where data from the UK or the EU leaves those regions, we use approved safeguards, such as standard contractual clauses or the UK addendum, where the law requires them.

7.4 Singapore and the UAE. We take steps so that overseas recipients protect data to a standard comparable to local law.

7.5 Ask us at the contact in section 14 for details of the safeguards we use.

8.1 An Investor can delete pitches and portfolio records at any time, and we will remove them from our systems on the schedule above.

8.2 We may keep data longer where the law requires it, or to deal with a dispute, and only for that purpose.

9.1 We use reasonable security safeguards, as the DPDP Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 require. These include encryption in transit and at rest, access controls and logging, separation of each customer’s data, vendor checks, backups and incident response. [Confirm each measure matches what is in place, and add multi factor authentication if offered.]

9.2 If a personal data breach affects you, we will report it to the Data Protection Board and to affected persons as the law requires. We will tell the Investor concerned without undue delay when we process the data for it.

9.3 No system is completely secure. Please use a strong password and keep your login details private.

10.1 India (DPDP Act). You can ask us for a summary of the personal data we process and how we use it, and for the identities of those we have shared it with. You can ask us to correct, complete, update or erase your data. You can withdraw consent, use our grievance process, and nominate another person to exercise your rights if you die or cannot act.

10.2 How to use them. Write to the contact in section 14. We aim to reply within [30] days and in any case within the time the law allows. We may need to confirm your identity first.

10.3 Complaints. If we do not resolve your complaint, you can complain to the Data Protection Board of India. Please use our grievance process first, as the law expects.

10.4 Your duties. Give accurate information, do not impersonate anyone, and do not make false or frivolous complaints.

10.5 UK and EU. You can ask for access, correction, erasure, restriction, portability, and to object to processing. You can complain to the Information Commissioner’s Office or your local supervisory authority.

10.6 United States. Depending on your state, you may have the right to know, delete and correct your data, and to opt out of sale or sharing. We do not sell or share personal data for advertising, and we will not treat you worse for using your rights.

10.7 Singapore and the UAE. You can ask for access to and correction of your data and withdraw consent. You can complain to the Personal Data Protection Commission in Singapore or the relevant authority in the UAE.

10.8 Investor data. Where we only process data for an Investor, we will refer your request to that Investor unless the law requires us to act.

The Platform is for business use by adults. It is not meant for anyone under 18, and we do not knowingly collect personal data of children. If we learn that we have, we will delete it.

12.1 We use essential cookies to keep you logged in and secure the Platform, and preference cookies to remember your settings. We use [analytics tool] to understand how the Platform is used. We do not use advertising cookies.

12.2 Where the law requires consent for non essential cookies, such as in the UK and EU, we ask first and let you change your choice at any time.

12.3 You can also block or delete cookies in your browser settings, but parts of the Platform may then stop working.

13.1 When an Investor uses automated follow ups, we send emails to Startup and Portfolio Company contacts from [sending domain] on the Investor’s behalf. These carry the Investor’s name and details of the request, such as a missing MIS or quarterly report.

13.2 We use the email address the Investor or Startup gave us. We record whether each message was delivered [and whether it was opened, if tracked].

13.3 To stop them. Use the link in the email, reply asking to stop, or write to us at [privacy email]. We will stop automated messages to you, usually within [2] business days. Messages stop automatically once the requested document is received.

13.4 We also send service emails about accounts, security and billing, which you cannot opt out of while you have an account. We send marketing emails only with your consent.

For privacy questions, rights requests and complaints, contact:

Name: [Name], Grievance Officer and data protection contact

Entity: Ripl Media, [registered address], India

Email: [privacy email]

Response time: we acknowledge within [24 hours] and aim to resolve within [30] days, and in any case within the time the law allows

[UK and EU representative: appoint and list here if the law requires one for your users there.]

15.1 We may update this policy as the Platform or the law changes. The date at the top shows the latest version.

15.2 For material changes, we will give at least [30] days’ notice by email or in the Platform. If a change needs your fresh consent, we will ask for it.

15.3 Earlier versions are available on request.