Privacy Policy
We ask you to trust us with sensitive company data. Here's exactly what we do — and don't do — with it.
Effective 24 July 2026
Who we are
This website is operated by Orgofin(“we”, “us”, “our”). For the personal data described here, we decide why and how it is processed — under India’s Digital Personal Data Protection Act, 2023, that makes us the data fiduciary.
We are early enough that our registered office is not yet settled, so we don't publish one here rather than publish one that changes next month. The fastest way to reach a human about anything on this page is contact@orgofin.com.
What this policy covers
This policy covers this website only — orgofin.com, its waitlist, and its investor data room.
It does not cover the Orgofin product. The Company Brain, the HRMS and everything else described on this site are in development; they are separate systems with their own data handling, and when they launch they will carry their own terms and their own privacy notice. Nothing here should be read as describing how the product treats your company’s data.
What we collect
There are exactly two places on this site where you can give us personal data, and both are forms you choose to fill in.
The waitlist. Your email address. That is the whole of it. We also record which page you signed up from and the time you did — neither identifies you. We do not ask for your name, your company, or your role.
The investor data room. Your name, your email address, your firm, and — only if you choose to give it — your typical check size, along with the time of the request.
Your IP address, briefly. When you submit either form, we read your IP address to count requests and stop automated abuse. It is held in memory for a few minutes, never written to our database, and never linked to the email you submitted. Our hosting provider logs request data including IP addresses separately, under its own terms.
Analytics, if you allow it.On the live site we use Google Analytics to understand which pages people read — and only after you accept it. See cookies and analytics below.
Your theme preference. If you switch between light and dark mode, that choice is stored in your own browser so the site remembers it. It never reaches us.
What we deliberately don't collect
This is a short list on most websites. On this one it is long, and we would rather you knew it:
- No accounts, no passwords, no logins of any kind.
- No payment or financial details.
- No files you upload — there is nowhere to upload one.
- No advertising or remarketing pixels, and no social trackers.
- No cookies of our own. The only cookies set on this site belong to Google Analytics.
- No logging of what you type into a form. If a submission fails, we record the technical error, never the contents.
- No selling, renting or sharing of your data with anyone for their own marketing. We have never done this and have no plans to.
Why we use it
We process what you give us on the basis of the consent you give by submitting the form, and we use it only for the purpose you submitted it for:
- Waitlist email — to tell you when Orgofin opens up, and to send occasional founder updates about the build.
- Data-room details — to know who has asked for our investor materials, and to follow up with you about them.
- IP address — to rate-limit and protect the forms from abuse.
- Analytics — to see which parts of the site are useful and which are not.
We will not quietly repurpose it. If we ever want to use what you gave us for something materially different, we will ask you first.
Who else processes it
We keep the list of third parties as short as we can. Today it is three:
- Supabase — hosts our database and the private storage holding investor documents.
- Vercel — hosts the site, runs its server-side code, and keeps platform request logs.
- Google — provides Analytics on the live site, and processes that data under its own terms.
Where this happens. Although the site is served to you from infrastructure near you, the server-side code that handles your form submission currently runs in the United States, and our providers may store and process data outside India. Submitting a form means accepting that transfer. We are India-first as a company and expect to bring this processing into India; when we do, we will say so here.
How we protect it
Some specifics, because “we take security seriously” means nothing on its own:
- The whole site is served over HTTPS, with strict transport security enforced.
- Our database tables accept new rows and nothing else. The key that ships to your browser physically cannot read the waitlist or the investor list back — so no one can pull the list out through the website.
- The waitlist endpoint treats an already-registered email as a success, so it cannot be used to test whether someone has signed up.
- Investor documents live in private storage. They are never public; each download is a separate link that we generate on request and that stops working after fifteen minutes.
- Both forms are rate-limited per IP address and screened for automated submissions.
No system is perfectly secure, and we will not pretend otherwise. If we discover a breach affecting your personal data, we will notify you and the Data Protection Board as the law requires. You can read more about our approach on our security page.
How long we keep it
We keep waitlist and data-room records for 24 months from the day you submit them, after which we delete them — unless you have become a customer or an investor and we have a continuing reason to hold them, or the law requires us to keep them longer.
You do not have to wait 24 months. Ask us to delete your record at any time and we will.
Your rights, and how to use them
Under the DPDP Act you can ask us to:
- tell you what personal data of yours we hold and what we do with it;
- correct anything inaccurate, or complete anything missing;
- erase it;
- withdraw the consent you gave — as easily as you gave it;
- nominate someone to exercise these rights on your behalf if you die or become incapacitated.
One address does all of it: contact@orgofin.com. Write to us and we will act on your request, and confirm when it is done, within thirty days. There is no form to fill in and nothing to pay.
If we get it wrong, tell us at that same address and we will try to put it right. If you are still not satisfied, you may complain to the Data Protection Board of India.
Children
This is a website for businesses and investors. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, tell us and we will delete it.
Changes to this policy
We will update this page as the site changes — and it will change, because we are building. The effective date at the top always reflects the current version. If a change materially affects what we do with data you have already given us, we will contact you about it rather than quietly editing this page.
Contact us
Questions about this policy, requests about your data, or complaints — all go to the same place:
A real person reads it. We are a small team, so it may be one of the founders.