1 Who We Are

For the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act) we act as a Data Fiduciary. For users in the European Economic Area (EEA) and United Kingdom, we act as a Data Controller under the GDPR / UK GDPR.

2 Information We Collect

Account & Profile Information

When you register, we collect your name, email address, username, password (stored encrypted), and any profile details you add, such as a bio, profile picture, social links, or founder background.

Campaign Information (Founders)

When you create or submit a campaign, we collect the information you provide, including your business description, funding goal, use of funds, pitch materials, reward and Star Badge details, team information, and any images or documents you upload.

Backer & Pledge Information

When you back a campaign or become a Star Backer, we collect your pledge details, the campaigns you support, badges earned, and associated transaction records.

Payment & Financial Information

When you make a pledge, pay a success fee, or subscribe to Startup Suite / Jeff Pro, payments are processed by our third-party payment provider, PayPal and UPI. We do not store your full card number, CVV, or bank credentials on our servers. We receive limited transaction data such as the amount, currency, payment status, a masked identifier, and billing details you provide.

AI Interactions (Jeff & Jeff Pro)

When you interact with Jeff or Jeff Pro, we process the messages, questions, business details, and documents you submit in order to generate responses, using third-party AI providers (see Section 5). Please do not enter information you are not comfortable sharing with an AI service.

Comments & Community Content

When you leave a comment, we collect the data shown in the comment form, plus your IP address and browser user-agent string to help with spam detection. An anonymized hash of your email may be sent to the Gravatar service to check whether you use it; see the Gravatar privacy policy. After approval, your profile picture is publicly visible alongside your comment.

Media Uploads

If you upload images, please avoid images with embedded location data (EXIF GPS), as visitors may be able to download and extract that data from images published on the Platform.

Information Collected Automatically

We automatically collect technical data including IP address, browser type, device information, pages visited, referring URLs, and interaction data through cookies and similar technologies (see Section 7).

3 How We Use Your Information

We use your information to:

• Create and manage your account and profile;
• Publish, host, and display campaigns and enable the Star Backer System;
• Process pledges, success fees, and Startup Suite / Jeff Pro subscriptions;
• Provide and improve Jeff, Jeff Pro, and other Platform features;
• Communicate with you about your account, campaigns, transactions, and support;
• Detect, prevent, and address fraud, abuse, spam, and security issues;
• Comply with legal obligations; and
• Analyze and improve the Platform.

Legal bases (EEA/UK users): performance of a contract, your consent (e.g., certain cookies and marketing), our legitimate interests (e.g., security and improvement), and compliance with legal obligations.

4 Payments

Payments — including pledges, the success fee on successfully raised funds, and Startup Suite / Jeff Pro subscriptions — are handled by PayPal and UPI and, where applicable, WooCommerce. The payment provider collects and processes your payment details directly and securely. We receive only the transaction data needed to fulfil your order and maintain records, and we retain transaction records as required for accounting, tax, and legal purposes. We recommend you review the payment provider's privacy policy.

5 How Jeff Uses AI & Third-Party Providers

Jeff and Jeff Pro are powered by large language models from third parties, including OpenAI (GPT models) and Anthropic (Claude / Sonnet models), using a retrieval-augmented (RAG) architecture. When you interact with Jeff:

• The content you submit is sent to these providers to generate a response;
• Your inputs may be processed on servers located outside India;
• We select providers whose business/API terms are designed to limit use of your data for training public models;
• You should avoid entering highly sensitive personal, financial, or confidential third-party information into Jeff.

These providers process data under their own terms: OpenAI Privacy Policy and Anthropic Privacy Policy. Jeff's voice features may additionally use ElevenLabs for text-to-speech, under its privacy policy.

6 Who We Share Your Data With

We do not sell your personal data. We share it only as needed to operate the Platform:

• Payment provider — PayPal and UPI and WooCommerce, to process transactions.
• AI providers — OpenAI, Anthropic, and ElevenLabs, to power Jeff and Jeff Pro.
• Hosting & infrastructure — our website host and WordPress / Automattic services (including Gravatar).
• Community platforms — if you join our Discord or networking servers, your data there is governed by Discord's privacy policy.
• Analytics & communication tools — to understand usage and send transactional or (with consent) marketing emails.
• Legal & safety — authorities or advisors where required by law, or to protect the rights and safety of JustStartUP, our users, or the public.
• Password resets — if you request a password reset, your IP address will be included in the reset email.

Campaign information you choose to publish is, by design, public and visible to other users and visitors.

7 Cookies

• If you leave a comment, you may opt in to saving your name, email, and website in cookies for convenience; these last one year.
• On the login page, we set a temporary cookie to check whether your browser accepts cookies; it contains no personal data and is discarded when you close your browser.
• When you log in, we set cookies to save your login and screen-display choices. Login cookies last two days, screen-option cookies last a year. "Remember Me" extends login to two weeks. Logging out removes login cookies.
• If you edit or publish an article, an additional cookie stores the post ID; it contains no personal data and expires after one day.
• We and our tools may also use cookies for analytics and functionality. You can control cookies through your browser settings.

8 Embedded Content From Other Websites

Pages on the Platform may include embedded content (e.g., videos, images, articles). Embedded content from other websites behaves exactly as if you had visited that other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that content, including tracking it if you are logged in to that website.

9 International Data Transfers

JustStartUP operates from India and serves founders and backers globally. Some service providers (including AI, payment, and hosting providers) may process your data in countries outside your own, including outside India and the EEA. Where required by law, we take steps to ensure appropriate safeguards for such transfers.

10 How Long We Retain Your Data

• Comments: retained indefinitely so we can recognize and approve follow-up comments automatically.
• Registered users: profile information retained until you delete your account. You can see, edit, or delete your data at any time (except your username).
• Campaign & pledge records: retained as long as needed to operate the Platform and meet legal, accounting, and dispute-resolution requirements.
• Transaction records: retained as required by tax and accounting law.
• AI interactions: retained only as long as needed to provide and improve the service, subject to the AI providers' retention terms.

11 Your Rights

Depending on where you live, you may have the right to:

• Access the data we hold about you and request an exported copy;
• Correct inaccurate or incomplete data;
• Request erasure (except data we must keep for legal, administrative, or security purposes);
• Withdraw consent where processing is based on consent;
• Object to or restrict certain processing;
• Nominate another person to exercise your rights in case of death or incapacity (DPDP Act);
• Lodge a complaint with a data protection authority.

To exercise any right, contact us using the details in Section 15. We may need to verify your identity first.

12 Children's Privacy

The Platform is intended for users 18 years of age or older. We do not knowingly collect personal data from children. Under India's DPDP Act, processing a child's data requires verifiable parental consent. If you believe a minor has provided us personal data, contact us and we will take appropriate steps to delete it.

13 Data Security

We take reasonable technical and organizational measures to protect your data, including encrypted passwords, secure payment processing through trusted providers, and access controls. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

14 Automated Spam Detection

Visitor comments may be checked through an automated spam-detection service.

15 Grievance & Contact

For any questions, concerns, or requests regarding this Privacy Policy or your data, contact:

We aim to respond to data requests within the timeframe required by applicable law.

16 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. Material changes will be communicated through the Platform or by email where appropriate. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

© 2026 JustStartUP · juststrtup.com