Privacy Policy

Last updated: 6 October 2026

1. What we collect

Account: Google email, used only to sign you in.
Profile you choose to store: company details, application answers (including an optional contact phone, used only for your applications and never for signing in), founder names/photos, pitch decks, demo links — stored so the Apply Kit can reuse them for you.
Payments: handled by Razorpay. We never see or store card, UPI or banking details; we keep only the order id, amount and status.
Product analytics: only if you accept analytics cookies, to improve the product we record your sign-in email (when signed in), the pages and listings you view, what you search or filter for, and the buttons you click. Visitors who are not signed in get a random identifier cookie instead. Optional PostHog page analytics uses a random browser identifier in local storage, with automatic click collection and session recording disabled. If you decline, browser analytics are not sent. You can reopen Cookie preferences and withdraw permission at any time. We do not store IP addresses in this data. To have it deleted, write to [email protected].
Usage: basic logs (pages requested, timestamps, IP-derived coarse location) for security and capacity.

2. What we do with it

Run the service: show your library, compute application readiness, fill forms you trigger.
Verification: proposed autofill values are checked server-side before filling; the check sees the field label, the question and your answer — nothing else.
Notify you when stored answers go stale or a link you shared stops being public.

3. What we never do

Sell your data, or share your profile with investors or anyone else without your explicit action (submitting an application is your action).
Store passwords — sign-in is Google OAuth only.
Read your email. The extension works in your browser session and never handles your credentials.

4. Directory data about investors and programmes

The directory lists organisations, public programme facts and the public professional roles of their staff, compiled from the organisations' own pages, each with source and verification date. Corrections: [email protected].

5. Retention and your rights

Your library lives until you delete it or your account; deleting the account deletes the library.
You can export everything you stored as JSON, and request a copy or erasure at [email protected]. We answer within 30 days.
Payment records are kept as long as Indian tax law requires.

6. Infrastructure

Hosted on Microsoft Azure (Central India). Secrets live in Azure Key Vault; traffic is HTTPS end to end. With analytics consent, PostHog receives page analytics through its US ingestion endpoint; this optional browser script does not load before acceptance. Page URL query strings and fragments are removed from these events.

7. Contact

Umla Technologies Private Limited — [email protected]. Material changes to this policy are announced here with the date above.