Delsivo and India's DPDP Act

Last updated 6 November 2026

The fund is the data fiduciary for founder data. How Delsivo supports notices, consent, rights requests, retention and grievances under the DPDP Act.

1. 01Who is responsible under the Act

   The DPDP Act calls the person who decides why and how personal data is processed the data fiduciary, and a company that processes it on their behalf a data processor. The people the data is about are data principals: here, founders and their teammates who apply through your portal.

   • Your fund is the data fiduciary for founder and deal data. You decide to use Delsivo, what your application form asks, your thesis rubric, who on your team sees each deal and how long data is kept.
   • Delsivo is your data processor. It processes founder data only to run the service for you, on your instructions, under the data processing agreement.
   • Delsivo is a data fiduciary itself only for fund team accounts, billing, visitors to this website, enquiries and the waitlist, as described in the privacy policy.

   A founder who applies to two funds has two separate records. Nothing is shared or matched across funds.

2. 02Notice

   The Act expects a clear notice, in plain language, before or when personal data is collected. Delsivo is designed so that:

   • A portal can't be published until the fund has added its own privacy notice and terms. An unpublished portal can't receive applications.
   • Every portal footer links to the fund's notice and to Delsivo's processor notice, so founders can see who is responsible and who processes their data.
   • The notice version a founder accepted is recorded with their submission, so the fund can show what the founder was told.
   • Every question on a form carries a purpose the founder can read.

3. 03Consent and legitimate uses

   Not all processing rests on consent. A founder who applies to a fund is asking the fund to evaluate them, and the fund decides its basis for that processing and sets it out in its notice. Where consent is the basis, the Act expects it to be free, specific, informed, unambiguous and as easy to withdraw as to give. Delsivo is designed to record it that way:

   • Interview recordings. Before a voice or video interview, the founder sees the purpose, what is recorded, who sees it, how long it is kept and the text alternative. Consent is recorded with the notice version before the microphone or camera starts. No consent, no recording.
   • A text alternative, always. Declining recording keeps the full interview available in text, under the same rubric, and is never shown to the fund as a negative signal.
   • Withdrawal. During an interview, withdrawing stops the recording, discards partial audio and offers text. Afterwards, withdrawing from the founder workspace stops further processing of the recording and starts its deletion.
   • Data room terms. Where a fund turns on an NDA acknowledgement for a data room, it is recorded with the version of the text before first access.

   Each consent and withdrawal is kept as an event with its purpose, the wording version shown and the time, and consent proofs are kept in de-identified form after deletion.

4. 04Purpose limitation and data minimisation

   • Founder data is used only to evaluate the founder for the fund they applied to. Using it for anything else breaks the acceptable use policy.
   • The application form asks only what the fund's published form needs. Sensitive topics such as health, religion, caste or political views need a fund admin's confirmation, and government ID numbers are refused as form fields.
   • Content goes to an AI provider only for the stated task, with founder phone numbers and email addresses removed unless the task needs them, and only the content the requester is permitted to see.
   • Web research receives only company and market terms, never founder contact details or data room files.
   • Interviews are assessed on the substance of each answer and its evidence. Accent, fluency, presentation polish, appearance and background are excluded, and there are no voiceprints, emotion detection or face analysis.
   • Delsivo does not sell founder data, use it for advertising, or use it to train AI models.

5. 05Data principal rights

   Right under the Act	How Delsivo is designed to support it
   Access to a summary of their data and how it is processed (s.11)	The founder asks from Settings, Privacy in the founder workspace on the fund's portal, or writes to the fund. The fund reviews the request and exports the founder's application, answers, files and claims about them.
   Correction, completion and updating (s.12)	Founders can correct facts extracted from their deck and flag transcription errors in their interview. The correction is stored beside the original, so the fund sees both and where each came from. Nothing is silently overwritten.
   Erasure (s.12)	The founder asks for deletion and the fund decides. Deletion disables access at once, then removes the deck, recordings, transcripts, previews, search index entries, embeddings and other derived copies.
   Withdrawing consent (s.6(4))	Where consent is the basis, such as an interview recording, the founder can withdraw it. Recording stops, partial audio is discarded and the text option stays open. After an interview, withdrawal starts deletion of the recording and its transcript unless the fund records another lawful basis.
   Grievance redressal (s.13)	Founders contact the fund first. Delsivo's grievance contact (below) helps when a request reaches us. Every request is tracked with a 30-day due date.
   Nomination (s.14)	A nominee can contact the fund or Delsivo on the founder's behalf. The request is logged for the fund to handle.

   Each request gets a 30-day due date and is marked overdue after it. Requests, exports and deletions are recorded in the audit trail. The fund, as data fiduciary, decides each request, and Delsivo helps it answer.

6. 06Retention and erasure

   The Act asks fiduciaries to erase personal data once it is no longer needed for its purpose. In Delsivo, the fund sets retention for founder content, and audio and video can be kept for less time than transcripts. The defaults are:

   Data	Kept for
   Decks, transcripts and room documents	Kept until the fund deletes the deal, or by the fund's own retention settings
   Interview recordings (camera, microphone and screen)	Set by the fund for each recording, separately from transcripts
   Audit and security logs	1 year
   AI call logs (no document text)	90 days

   Deletion is designed to disable access at once (no new download links, no AI retrieval), then remove file versions, previews, extracted text, search index entries, embeddings and export files. A deletion record notes when the last backup holding the data ages out. De-identified counts and consent proofs remain.

7. 07Security safeguards and breaches

   The Act requires reasonable security safeguards. Delsivo is designed to keep each fund's data apart in the database itself, apply one permission check to pages, search, AI answers, notifications and exports, scan every file for malware before anyone opens it, encrypt private storage at rest, require two-factor sign-in for staff, fund admins and partners, and keep audit logs in a separate database. The full list, with each control marked as planned, is on the security page.

   If a breach affects founder data, Delsivo is designed to tell the fund without undue delay with what is known, and to help it inform the Data Protection Board of India and the founders affected, as the Act and Rules require. A written breach notification runbook is planned.

8. 08Where data is stored

   Delsivo launches with one hosting region, chosen with design partners. Some providers, including the AI providers, process data in other countries, listed on the subprocessors page. The Act allows transfers outside India except to countries the Central Government restricts under section 16. No such restriction has been notified as of this page's date, and Delsivo will stop any transfer to a country that is restricted.

9. 09Children

   Delsivo is meant for adult founders applying to venture funds. Funds must not invite or accept applications from anyone under 18 through Delsivo, since the Act requires verifiable parental consent for children's data.

10. 10Significant data fiduciaries

    The Central Government can name some fiduciaries as significant data fiduciaries, with extra duties such as a data protection officer, an independent audit and impact assessments. If your fund is named, Delsivo will help with the information you need, such as the subprocessor list, the security controls and audit logs. Delsivo itself has not been named.

11. 11Grievance contact

    Founders should contact the fund they applied to first. Delsivo's grievance officer is [TODO: grievance officer or privacy contact name], reachable at [TODO: grievance officer email], or write to hello@delsivo.com. If a grievance is not resolved, a data principal may complain to the Data Protection Board of India.