Last updated: September 20, 2026
Outrank Startups ("we", "us") is the Data Fiduciary for the personal data described below, under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). If you use this Platform, you are a Data Principal with the rights described in Section 6.
1. What We Collect, and Why
- Account & listing details (signup, listing creation): email, password (hashed, never stored in plain text), company name, website, description, category, city, founder name, contact email, and any social handles you add. Used to create your account and publish/manage your listing on the public leaderboard.
- Boost/payment details: the name, email, and phone number you enter when placing a boost, and the payment confirmation from PayU (we never see or store your card/UPI/bank details). Your name, email, phone number, and company name are included in the payment request sent to PayU so it can process the transaction — see Section 3.
- Feedback and lead-form submissions (Feedback, Bye Bye DM, Community, Security Consulting pages): name (where asked), email, and whatever you write in the message/notes field. Used only to act on or respond to what you submitted.
- Consent records: when you check a consent box on any form, we store which purpose you agreed to, the exact wording shown to you at the time, and whether you granted or declined it — so we (and you, via a data-rights request) can always verify what was actually agreed to.
- Basic analytics: an aggregate count of clicks to each listing's website, and a separate aggregate count of overall page loads to the site itself, both recorded with an anonymized IP address (the last part is zeroed before storage) — enough for abuse detection and rough geography, not enough to identify a device or person. If you accept the analytics option in our cookie banner, Google Analytics also runs — see Section 4.
- Security & usage audit log: for every request to the Platform, we record the page/endpoint, timestamp, response status, and an anonymized IP address. For account actions (sign up, sign in) we also record the email used and whether it succeeded. We do not log passwords, payment details, session tokens, or the content of anything you write in a form.
2. Consent
Wherever a form collects personal data, you'll see one or more consent checkboxes — unticked by default — describing exactly what we're asking permission for. A checkbox marked "required" covers the core purpose of that form (e.g. publishing your listing) and must be checked to submit; anything else (e.g. being contacted about unrelated updates) is optional and never blocks submission. You can withdraw any consent at any time — see Section 6.
3. Third Parties
- PayU processes boost payments. Your name, email, phone number, and the listing's company name are sent to PayU as part of the payment request so it can process the transaction. See PayU's Privacy Policy.
- Google Fonts serves the typeface used on this site. Loading a font from Google's servers means your browser contacts Google directly, which can see your IP address for that request — see Google's Privacy Policy.
- Google Analytics runs only if you accept the analytics option in our cookie banner — it never loads by default. See Section 4 and Google's Privacy Policy.
- We do not sell your data to anyone, and we do not use advertising networks.
4. Cookies & Tracking
We run one first-party visit counter (see Section 1) that requires no cookie and no consent. Google Analytics is off by default and only activates after you accept it in the cookie banner shown on your first visit. The PayU checkout script only loads on the page/moment you actually start a boost payment — not on every page. See the full Cookies Policy for every cookie this site sets.
5. Data Retention
- Account and listing records: kept while your listing remains on the Platform, plus a reasonable period after for accounting/legal purposes.
- Boost/payment records: kept as required for accounting and tax law.
- Feedback and lead-form submissions: kept until acted on, then periodically reviewed for deletion.
- Consent records: kept for as long as the underlying data they cover is kept, so we can always show what was consented to.
- Audit log and analytics: kept only as long as needed for security monitoring, then deleted.
6. Your Rights
Under the DPDP Act, you have the right to:
- Access — ask what personal data we hold about you.
- Correct — ask us to fix inaccurate or outdated data.
- Erase — ask us to delete your personal data (subject to what we're legally required to keep, e.g. payment records).
- Withdraw consent — withdraw any consent you previously gave, as easily as you gave it.
Submit any of these requests via our Data Rights Request form. We aim to respond within 30 days. You can also reach our Grievance Officer directly — see the contact details in the footer of every page, and repeated below in Section 8.
7. Security
Passwords are hashed (never stored in plain text), admin and user sessions use short-lived, httpOnly cookies, and every login is rate-limited against brute-force attempts. A full list of security measures and known gaps we're tracking is documented internally — see DPDP_PROGRESS.md for the current list if you'd like more detail than a public policy is the right place for.
8. Grievance Officer
Under the DPDP Act, you can raise a grievance about how your personal data is handled with our Grievance Officer:
Outrank Startups
Submit a grievance via our Data Rights & Grievance form — select "Grievance" as the request type.
We aim to acknowledge grievances promptly and resolve them within 30 days.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Continued use of the Platform after changes are posted constitutes acceptance of the updated policy.