Privacy Policy

01Who we are

Fayvar is a network where startups, investors and the people who follow them meet. In this policy, “Fayvar”, “we” and “us” mean the company that runs fayvar.com legal entity name and registered address to be confirmed. Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the Data Fiduciary for the personal data described here: we decide why and how it is used.

This policy also follows the Information Technology Act, 2000 and the rules made under it, including the rules on reasonable security practices and sensitive personal data.

02What we collect

Your account

• Your name, email address, headline and profile photo.
• Your date of birth, only to confirm you are 18 or older. It is never shown to anyone.
• How you sign in: a one-time code sent to your email, Google sign-in if you choose it, and an optional password. We store a password only as a one-way scrypt hash, never the password itself. If you turn on two-step sign-in, its secret is stored encrypted.

Your company or fund

• Company name, sector, stage, city, website, your brand page (logo, colours, story, photos and videos) and the posts and reels you publish.
• Startups: the numbers and round details you enter (revenue, users, round size, terms, monthly updates). Investors: your thesis, sectors, stages and cheque size.

Verification documents

To verify a company or fund we ask for documents such as a certificate of incorporation, GST or PAN details of the business, SEBI registration for funds, and proof that you can act for the organization. These are seen only by Fayvar’s verification team. They are never shown on your page, never shared with other members and never sent to an AI service.

Messages, meetings and documents

• Connection request notes, chat messages and attachments, and meeting times and agendas. Calls are not recorded.
• Data room documents a startup shares with particular funds, and a log of who opened them, when and for how long.

How you use Fayvar

• Pages you view and follow, posts you like, save or comment on, and that you searched (we keep that a search happened and how many results came back, not the words).
• Your device and browser type, IP address and times of activity, used for security, rate limits and fixing problems.

03Why we use it

We use personal data only for these purposes:

• Running your account: signing you in, showing your page and posts, delivering messages, booking meetings and sending the emails you ask for.
• Verification: checking that every startup and investor is real before they get a verified badge.
• Matching: our own model, on our own servers, suggests startups and investors that fit each other. No outside AI service is used for matching.
• Analytics for your company: telling a startup which funds viewed its page (the fund’s name and the date, never the person) and how its posts perform.
• Safety: stopping spam, fraud and abuse, handling reports, and keeping accounts secure.
• Meeting the law: answering lawful requests and keeping records the law requires.

We process your data on the basis of the consent you give when you create an account and when you turn on optional features, and for the legitimate uses the DPDP Act allows (such as complying with the law). You can withdraw consent at any time (see Your rights); this does not affect what was done before.

04Who sees what

Anyone, signed in or not

Your published brand page, public posts and reels, your company’s name, sector, stage and city, and follower counts.

Signed-in members

Posts shared with members, and your name and headline next to your comments.

Verified investors only

A startup’s numbers, round size and terms, and monthly updates. Round details are never shown to the public.

Funds a startup chooses

Data room documents. Each copy opened is watermarked with the viewer’s fund, name and time, and the startup sees who opened what.

The startup whose page you view

If you are an investor: your fund’s name and the date, never your own name. Turn on private browsing in Settings to be counted without being named.

Your team

Members of your company or fund share the team inbox, pipeline and data room settings.

Fayvar staff

Only what they need for verification, reports and support. Staff access is limited by role and recorded in an audit log.

05Outside services we use

A few companies process data for us, only to provide their service and under contract (Data Processors under the DPDP Act):

• Amazon Web Services (AWS) hosts Fayvar: servers, database and file storage.
• Resend delivers our emails (sign-in codes, notifications, digests). It receives your email address and the email’s content.
• Google, only if you choose “Continue with Google”: we receive your name, email address and profile photo from Google.
• AI writing (optional, Anthropic): when a founder uses Fayvar’s writing tools with AI turned on, the provider receives only what that founder has published or asks the tool to use (for example their own page text and the numbers they choose). It never receives data room documents, verification documents or messages, and under its commercial terms it does not train its models on what we send. Without AI turned on, the tools write from Fayvar’s own templates and nothing leaves our servers.

Voice and video calls run on our own servers. Matching runs on our own servers. We will list any new processor here before we start using it.

06Where your data is stored

Your data is stored in India, in AWS data centres in Hyderabad (the Asia Pacific – Hyderabad region). Email delivery and the optional AI writing service may process the specific items listed above outside India; we only use providers that the DPDP Act and government rules allow transfer terms to be confirmed.

We protect data with encryption in transit (HTTPS) and at rest, encrypted secrets, one-way password hashes, per-viewer watermarks on data room documents, role-based staff access and audit logs. If a personal data breach happens, we will tell affected people and the Data Protection Board of India as the law requires, and report security incidents to CERT-In.

07How long we keep it

We keep personal data only as long as we need it for the purposes above or as the law requires. Proposed periods to be confirmed:

• Your account and page: while your account is open. When you delete it, we remove your profile and page within 30 days and from backups within 90 days.
• Messages: while your account is open, so both sides keep their conversation. After you delete your account, your messages show as from a former member.
• Verification documents: while your organization is verified, then up to 3 years if needed to resolve disputes or meet legal duties.
• Security logs: 180 days, as CERT-In directions require.
• Sign-in codes expire after 10 minutes; sessions end when you sign out or after a period without use.

08Your rights

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you and how we use it, and know which processors we share it with.
• Correct and update it. Most of it you can change yourself in Settings and the brand page editor.
• Erase it, by deleting your account or asking us, unless we must keep something by law.
• Withdraw consent for any optional use.
• Nominate someone to exercise these rights if you die or cannot act.
• Complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.

Fayvar is only for people aged 18 and over. We do not knowingly collect data from children.

09Cookies

We use no advertising or tracking cookies. We set only:

• fv_sid, a session cookie that keeps you signed in. It holds a random id, not your details; your sign-in tokens stay on our servers.
• fv_vid, a random id used only to count one view per browser per day on company pages. It is not linked to your account.

Your light or dark theme choice is saved in your own browser, not on our servers. Blocking cookies will sign you out.

10Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect, and ask for fresh consent where the law requires it. The date at the top shows the latest version. Please also read our Terms of Use.