Skip to content
Submit free

Privacy Policy

Notice SL-DN-2026-11-02 · applies to startup submissions, claims and data-rights requests · हिन्दी में पढ़ें

Notice for founders: what we collect when you submit a startup, and why

Who we are. SuperLaunch (superlaunch.in) is run by Hostao L.L.C, 30 N Gould St, Ste 4000, Sheridan, WY 82801, USA. For your submission we decide why and how your personal data is used (a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023, and a "controller" under the EU GDPR). SuperLaunch is an independent platform; it is not affiliated with, endorsed by or operated by DPIIT, Startup India or any government body.

1. The personal data we collect

  • About you: your name, your role at the startup, and your founder email address (we send a 6-digit code to it).
  • About the startup (company data, which can identify you if you run a small firm): legal name, entity type, CIN/LLPIN, registered state, incorporation date, DPIIT recognition number, the DPIIT certificate file you upload, optional Startup India profile link, website, startup name, tagline, description and category.
  • Records we create: the result of each automated check, your consent choices with date, time and notice version, and a one-way hash of your IP address (we do not keep the IP itself with your consent record).

We do not ask for Aadhaar, PAN, passport, bank, health or other sensitive documents. Do not upload them.

2. Why we use it (each purpose separately)

  • Verify your submission (needed): match the certificate, CIN/LLPIN, website and email domain, and contact you about the result.
  • Publish the listing (needed for a listing): we publish the startup name, tagline, description, website, category, logo and verification status. We never publish your name, email, phone, certificate, CIN or DPIIT number.
  • Founder updates by email (optional, off unless you tick it).
  • Partner introductions (optional, off unless you tick it): we share your name, startup name and email with a perk or programme partner only when you asked for that kind of introduction.

You can use the directory without an account. If you do not agree to the two needed purposes we cannot list the startup; refusing an optional purpose changes nothing else.

3. Who can see it

The automated checker and SuperLaunch reviewers with a named, role-based Mission Control account (contact details are masked for read-only roles; every action is logged). Our service providers act only on our instructions: Hetzner Online GmbH (servers and database, Germany/Finland), Cloudflare (DNS), BestEmail by Hostao (transactional email), Google (mailbox for replies; sign-in only if you choose Google; the Safe Browsing check receives your website address only). We do not sell personal data. Partners receive data only under the optional purpose above. Data may be stored outside India and outside your country; we protect it under this notice and, for EU/UK data, with Standard Contractual Clauses.

4. How long we keep it

  • Certificate file: deleted 90 days after the final decision (30 days if rejected or never confirmed). We keep only a small audit record: decision, date, certificate number and a file fingerprint.
  • Unconfirmed submissions: closed after 7 days. Rejected or abandoned submissions: your name and email are erased 180 days after the decision.
  • Published listings: while the listing is live. Ask us to remove it at any time.
  • Consent records and data-rights requests: kept for 3 years after you withdraw or the request closes, to prove what you chose. Security logs: at least 1 year.

5. Your rights and how to use them

You can ask for a summary of your data and who it was shared with, correct or update it, erase it, withdraw any consent, nominate someone to act for you if you die or cannot act, and raise a grievance. Use the data-rights form (identify yourself with the email you submitted with; we confirm the request from that inbox). Withdrawing is as easy as consenting: tick the consent you want to stop and confirm once from your email; it takes effect immediately and does not affect processing before you withdrew. We do not charge for requests.

Response times: we acknowledge within 1 working day, resolve grievances within 15 days and other requests within 30 days (the law allows us up to 90 days for grievances; we aim for far less).

6. Grievance Officer and complaints

Grievance Officer, SuperLaunch (Hostao L.L.C): hello@superlaunch.in or the data-rights form. Please contact us first. If you are not satisfied, you may complain to the Data Protection Board of India (once its complaint process applies; details on the MeitY data protection page) and, in the EU/UK, to your local data protection authority.

7. Security and breaches

Certificates are stored encrypted in private storage with no public access; databases are reachable only by our server with a secret key; staff access is role-based with optional two-factor authentication and an append-only audit log. If a personal data breach affects you, we will tell you without delay by email (what happened, likely impact, what we are doing and what you can do) and inform the Data Protection Board of India and other authorities as the law requires (in India: intimation without delay and a detailed report within 72 hours).

8. Age

Submissions are only for people aged 18 or over. We do not knowingly collect children's data and do not offer parental-consent submissions; if we learn that a submitter is under 18, we delete the submission.

Changes: if this notice changes in a way that affects you, we will tell submitters by email before the change applies. The general privacy policy below continues to apply to the rest of the website.

General privacy policy