Privacy Policy

• Account. Your email address and password (stored only as a hash by our sign-in provider). If you sign in with Google, we receive your name, email address and profile photo from Google.
• Profile. Your name, username, photo, and the bio, X handle and website you add, plus what you said you want to do first (list, buy or invest).
• Listings. Everything you enter about a startup, including its logo, the numbers you report and any sale or fundraising details.
• Domain verification. The website domain, the email address at that domain we send a code to (we keep the code only in scrambled form) or the DNS record we check, and when it was verified.
• Revenue data, only if you connect a payment provider. With read-only access we import up to 365 days of payment records for the products you select: amounts, dates, currencies, subscription details and product names. We replace each customer with a scrambled code and don't keep your customers' names, email addresses, addresses or card details. Access keys are stored encrypted.
• Messages. Requests, replies, offer amounts, and any blocks and reports.
• Payments. Your plan, amounts, payment status, invoices and payment references. Card details go to our payment provider and never reach us.
• Email. Which emails we sent you, whether they were delivered, and your email settings.
• Usage. Page views and clicks on some buttons, without cookies. Each visitor gets a code made from their IP address and browser with a key that changes daily and is deleted after 2 days, so visits can't be linked across days. We don't store the IP address or browser for this, and we don't count visits when your browser sends Do Not Track or Global Privacy Control. To stop abuse, we keep IP addresses for about an hour to enforce request limits.

To create and secure your account, publish your listings, verify domains and revenue, deliver messages, process payments, send the emails the service needs (and optional ones you can switch off), order the directory, prevent spam and abuse, fix problems, enforce our Terms of Service and meet legal obligations. We use your data because you asked for the service, with your consent where we need it, or where the law requires it.

• Published listings are public and can be found by search engines and AI assistants, which may keep copies. They show the founder's name, username, photo and X handle, unless the listing is anonymous.
• Numbers you type in, such as user counts, are shown only to signed-in members. Revenue appears only when you choose to share it. See how verification works.
• In a conversation, the other person sees your name, username, photo and X handle and what you write. An anonymous founder's profile is shown only after they agree when accepting. Your email address is never shown to other users.

We don't sell personal data. We share it only with the services that run Ventmark for us, under their own privacy and security terms:

• Supabase: database, sign-in, file storage and live updates;
• Vercel: hosting (our servers run in Mumbai, India);
• Resend: sending email;
• Dodo Payments: checkout, invoices and refunds;
• Google: sign-in, if you use it. Google profile photos load from Google's servers when someone views them;
• Stripe, Dodo Payments or Razorpay: only the one you connect, to read your payment records.

We may also share data when the law requires it, to protect people or the service, or as part of a merger or sale of the business. Some providers process data outside India.

We don't use advertising or tracking cookies. We use only what the site needs:

• sign-in cookies that keep you signed in;
• ventmark_mode (a year) and sidebar_state (7 days), which remember your dashboard mode and sidebar;
• your light or dark theme, saved in your browser;
• unsaved text in forms and messages, kept in the open tab for up to 24 hours and cleared when you sign out.

• Your account, profile and listings: until you delete them. Domain verification records are kept with their listing.
• Conversations: 24 months after their last message. Text from a deleted account is erased within a day; reported messages are kept for up to 180 days for review.
• Revenue data: access keys are removed straight away when you disconnect, or 30 days after your plan ends; imported evidence is deleted after 12 months without activity, or as soon as you erase it.
• Usage records: 180 days. Email records: 90 days.
• Payment records: as long as tax and accounting law requires, even after you delete your account.

We use encryption in transit, encrypted storage for payment provider access, access controls and audit records for moderators. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

• In your dashboard you can edit your profile and listings, unpublish a listing or make it anonymous, and disconnect a payment provider. Switch off optional emails in Settings, or with the unsubscribe link in any of them.
• Delete your account in Settings. This removes your profile and listings; what is kept afterwards is listed above. If one of your listings is suspended, email us and we will close the account.
• Email hello@useventmark.com to get a copy of your data, correct it, withdraw consent or complain. We will reply within the time the law sets. You can also complain to the data protection authority where you live.

Ventmark is for adults. You must be at least 18 to create an account, and we don't knowingly collect data from children. If you think a child has signed up, email us and we will delete the account.

We will update this policy when what we do changes; the date at the top shows the latest version, and we will tell you about important changes. Questions about privacy go to hello@useventmark.com, which also reaches our grievance officer.