Privacy Policy

Sprezox ("Sprezox," "we," "us") operates a discovery and introduction platform connecting founders raising capital with investors. This policy explains what information we collect, why, and how it's handled. Registered entity details: [legal entity name, registration number, registered address].

Account information: email address, hashed password, account role (founder or investor).

Profile information: name, phone number, bio, and — for investors — investor type, ticket size, and preferred industries.

Company and listing information (founders): company name, incorporation details, and startup listing content (industry, stage, business model, location, revenue stage, description).

Verification information: fundraising or investment-preference details you submit, and a link to a Google Drive folder you create and control. Sensitive documents (PAN, Certificate of Incorporation, MOA, AOA, financial statements, shareholding pattern, address proof) are stored in that Drive folder, not in Sprezox's own database or file storage — we store only the folder link and your form submission.

Usage information: which listings are viewed (recorded without identifying you personally on our public pages), pitch deck and meeting requests, and their status.

Cookies: see our Cookies Policy for details — in short, we use a small number of strictly necessary session cookies and no advertising or tracking cookies.

To operate your account, run manual verification review, publish and moderate listings, process pitch deck and meeting requests, send notifications about activity on your account, and maintain security and audit logs of administrative decisions.

We do not use your information for advertising, and we do not sell your information to third parties.

Founder and investor contact details (email, phone) are shared with each other only after a founder explicitly accepts a meeting request — never before, and never automatically.

We share information with service providers who help us operate the platform, including hosting ([Vercel, Railway — confirm data-processing terms with each provider]) and file storage for pitch decks (Supabase). These providers process data on our behalf and are not permitted to use it for their own purposes.

We may disclose information if required by law or to protect the rights, safety, or property of Sprezox or our users.

We retain account and activity information for as long as your account is active, and for a period afterward as required for legal, audit, or dispute-resolution purposes. Specific retention periods: [define retention schedule per data category].

Depending on your jurisdiction, you may have rights to access, correct, or request deletion of your personal information, and to object to certain processing. To exercise these rights, contact us using the details below. [confirm applicable rights and process under India's DPDP Act 2023 and any other jurisdictions where users are located].

Passwords are stored using industry-standard hashing (bcrypt), not in plain text. Sessions use short-lived access tokens with rotating refresh tokens. All administrative approval and rejection decisions are logged with the acting admin, timestamp, and reason for audit purposes. No system is perfectly secure, and we cannot guarantee absolute security.

Sprezox is not directed at, and we do not knowingly collect information from, individuals under the age of 18.

Our infrastructure providers may process data outside your country of residence. [confirm cross-border transfer safeguards required under applicable law].

We may update this policy from time to time. Material changes will be notified through the platform or by email before they take effect.

Questions about this policy: core@sprezox.com.

Grievance Officer (required for compliance in some jurisdictions, including India): [name and contact details].