Privacy Policy &
Data Governance
At rank.llmlab.in (operated by llmlab.in), we respect your fundamental right to privacy. This comprehensive policy explains how we collect, process, secure, and safeguard Personally Identifiable Information (PII) under the Digital Personal Data Protection (DPDP) Act, 2023 (India), the General Data Protection Regulation (GDPR - EU/UK), and the California Consumer Privacy Act (CCPA/CPRA).
🛡️ Privacy Commitments at a Glance
- Data Minimization: We only collect information strictly necessary to host your public startup directory listing, record boost contributions, and calculate anti-fraud visitor counts.
- Zero Storage of Financial Credentials: We never collect, process, or store credit/debit card numbers, CVVs, net banking credentials, or UPI PINs. All financial channels are processed through certified PCI-DSS Level 1 / NPCI gateways.
- Zero Sale of Personal Data: We never sell, rent, monetize, or disclose your personal data or email addresses to advertisers, data brokers, or marketing networks.
- Unconditional Right to Deletion: Any founder or data subject can request immediate profile removal and data purging with a simple email to
privacy@llmlab.in, completed within 48 business hours.
1. Categories of Personal Information Collected
Depending on how you interact with rank.llmlab.in, we collect and process the following categories of information:
A. Founder & Submitter Contact Information (PII)
When registering a startup or claiming a profile, you provide a founder or submitter email address and optional name. This data is used solely to verify listing legitimacy, send transaction notifications, and communicate critical status updates regarding your listing.
B. Business & Product Directory Data
Public entity information including startup/product name, canonical website URL, marketing tagline, product description, brand logo URL, primary industry category, and country of origin. This information is intended for public indexing on the leaderboard.
C. Payment & Boost Reference Information
When you contribute a boost, we receive transaction metadata:
- UPI (Domestic India): 12-digit UPI Transaction ID / UTR number submitted by you for verification, timestamp, and boost amount.
- BuyMeACoffee / Stripe (Global): Supporter handle, supporter email address, order reference ID, and net contribution amount.
D. Technical, Anti-Fraud & Telemetry Data
To compute legitimate unique visitor metrics for listed startups and prevent click-farming or DDoS abuse, our backend analyzes the client IP address (from headers such as x-forwarded-for), browser user-agent, and UTM attribution source. IP addresses are processed in volatile memory and hashed for uniqueness counting rather than stored as permanent identity profiles.
2. Payment Security & Zero Credential Storage
🛡️ rank.llmlab.in never touches, processes, or stores sensitive financial credentials.
• UPI Rails (India): Handled entirely on the contributor's personal mobile device via certified National Payments Corporation of India (NPCI) applications (Google Pay, PhonePe, Paytm, BHIM, Cred). We have no access to your banking passwords, account numbers, or MPINs.
• Card & International Rails: Handled securely by BuyMeACoffee through Stripe, an audited PCI-DSS Level 1 Service Provider. We receive only transaction completion confirmations and webhook notifications.
3. Legal Grounds for Processing
We process personal and commercial data under the following recognized legal bases:
🇮🇳 DPDP Act 2023 (India)
Processed with affirmative consent given by the Data Principal during startup listing submission and voluntary payment verification under Sections 6 & 7 of the Digital Personal Data Protection Act, 2023.
🇪🇺 GDPR (EU & UK)
Processed under Article 6(1)(a) (Consent for directory listing) and Article 6(1)(f) (Legitimate Interests to ensure platform security, anti-fraud visitor computation, and algorithmic integrity).
4. Third-Party Subprocessors & Data Sharing
We do not sell personal data. We share necessary operational data only with audited subprocessors that uphold strict privacy protections:
- Hosting & Edge Infrastructure: Vercel Inc. and Cloudflare Inc. for content delivery, DDoS protection, and SSL/TLS encryption.
- Database Infrastructure: MongoDB Atlas (encrypted at rest using AES-256 and in transit via TLS 1.3).
- Payment Gateways: BuyMeACoffee Inc. and Stripe Inc. for processing international cards and digital wallets.
- Analytics: Google Analytics (configured with IP anonymization enabled to analyze aggregated audience traffic trends without personally profiling individuals).
5. Founder Rights & 48-Hour Data Deletion / Opt-Out
Under the DPDP Act 2023, GDPR, and CCPA, you possess comprehensive rights over your personal data:
• Right to Erasure ("Right to be Forgotten"): You may request the immediate and permanent deletion of your startup listing, founder email, and associated visitor history.
• Right to Rectification: You may request corrections to company taglines, descriptions, or URLs.
• Right to Withdraw Consent: You may withdraw consent for public directory listing at any time without penalty.
• Right of Grievance Redressal: Rapid escalation and review of any data handling concern.
🗑️ How to Submit a Data Deletion / Opt-Out Request
To request permanent profile deletion, email us directly with the subject line format below. Requests are verified via domain ownership (e.g., sending from an @yourcompany.com address or providing DNS verification) and fulfilled within 48 business hours free of charge:
To: privacy@llmlab.in (or support@llmlab.in)
Subject: [Data Deletion Request / DPDP Opt-Out] - <Your Startup Slug>
Body: I request the permanent removal of <Startup Name> and all associated contact records from rank.llmlab.in.
Upon fulfillment, all public records are purged immediately from the active database.
6. Cookies & Browser Storage
We believe in non-intrusive browsing. We do not use third-party advertising cookies, cross-site trackers, or behavioral profiling pixels. We use standard browser localStorage strictly for functional preferences:
user_currency: Stores your preference between INR (₹) and USD ($).user_country: Remembers your selected country filter for the leaderboard.
You can clear these values at any time through your browser settings or privacy controls.
7. Data Retention Schedule
- Public Startup Listings: Maintained on the index until deleted or requested by the founder.
- Visitor IP Telemetry: Anonymized and aggregated into integer counters; raw IP logs are purged regularly.
- Statutory Tax Records: Transaction reference IDs and amounts are archived for 7 years solely to satisfy statutory accounting obligations under the Indian Income Tax Act, 1961.
Data Protection Officer & Grievance Redressal
In compliance with Section 13 of the DPDP Act, 2023 and Article 37 of the GDPR, you may address any data privacy concerns, deletion inquiries, or grievances to:
Officer: Privacy Grievance Officer, llmlab.in
Primary Email: privacy@llmlab.in
Support Email: support@llmlab.in
Response Turnaround: Maximum 48 business hours
Jurisdiction: New Delhi, Republic of India