Privacy notice
Written to be read, not to be scrolled past. It follows the itemised format the DPDP Rules require, which happens to also be the clearest way to write it.
This notice explains what personal data InvestMyCity collects, why, how long we keep it, and what you can require us to do about it. It is issued under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
In the language of that Act, you are the Data Principal and we are the Data Fiduciary.
Who we are. InvestMyCity, CIN , registered office . Contact: .
What we collect, and why
We collect only what a specific form needs. Nothing is gathered in the background.
| When | What we collect | Why | How long we keep it |
|---|---|---|---|
| Business application | Business name, city, entity type, sector, years trading, capital sought, your name, role, email, phone, funding requirement, filing status | To assess whether we can help you raise capital and to reply to you | 3 years from last contact, or until you ask us to erase it |
| Investor registration | Name, email, phone, city, accreditation status, investment experience, stated interest | To verify eligibility and to contact you about opportunities you may participate in | 3 years from last contact, or until you ask us to erase it |
| City request | Name, email, city, state, your role | To gauge demand in a city and tell you if it activates | 2 years, or until you ask us to erase it |
| Early access (professionals) | Name, firm, email, city, qualification, placement volume, area of interest, free-text comments | To contact you about the platform and to decide what to build first | 3 years from last contact, or until you ask us to erase it |
| Emailing a tool result | Your email address and the result you asked us to send | To send you that result and, if you tick the box, occasional related guidance | Until you unsubscribe or ask us to erase it |
What we do not do
- We do not sell your personal data. Not to anyone, at any price.
- We do not share it for advertising, profiling or lead resale.
- We do not collect data in the background. The calculators run entirely in your browser and transmit nothing unless you explicitly ask us to email you a result.
- We do not use tracking cookies. Our analytics, if enabled, is cookieless and does not identify you.
- We do not knowingly collect data from anyone under 18.
Consent, and taking it back
We process your data on the basis of the consent you give when you submit a form. That consent is specific to the purpose stated on the form and in the table above.
You can withdraw it at any time, and it must be as easy to withdraw as it was to give. Email with the word withdraw, or use the erasure request form below. Withdrawal does not make our earlier processing unlawful, but we will stop processing and erase the data unless a law requires us to keep it.
Who else sees it
- Our service providers. Email, hosting and spreadsheet services used to receive and store submissions. They process on our instructions only.
- A business you choose to proceed with. If you are an investor and you decide to pursue a specific opportunity, your details are shared with that company so the offer can be made to you by name — which is a legal requirement of a private placement. This only happens on your instruction.
- Regulators and authorities, where a law requires disclosure.
That is the complete list. There is no fourth category.
Your rights
Under the DPDP Act you may:
- Access — ask for a summary of the personal data we hold about you and what we are doing with it
- Correct — have inaccurate or incomplete data corrected, completed or updated
- Erase — have your data deleted where it is no longer needed for the purpose you gave it for
- Grievance — complain to us about how we have handled your data
- Nominate — nominate someone to exercise these rights on your behalf in the event of your death or incapacity
Use the form below, or email . We do not charge for any of this.
Grievances
Our Grievance Officer is our Grievance Officer, reachable at .
We aim to acknowledge within 48 hours and to resolve well inside the 90 days the DPDP Rules allow. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Security and breaches
We apply reasonable security safeguards: access to submission data is restricted to people who need it, accounts use two-factor authentication, and the site is served over HTTPS.
If a personal data breach occurs, we will notify affected Data Principals and the Data Protection Board without delay, and provide the Board a detailed report within 72 hours as the Rules require.
Where your data is held
Submissions are stored on services operated by established providers. Some may process data outside India, as permitted under the Act subject to any restrictions the Central Government notifies. We will update this notice if that position changes.
Changes to this notice
If we change how we use your data we will update this page and change the date at the top. Material changes affecting existing consents will be notified to you directly.
On timing. The DPDP Rules, 2025 were notified on 14 November 2025 with a phased rollout — the substantive Data Fiduciary obligations take effect after an 18-month transition. We are choosing to operate to this standard now rather than at the deadline.
This notice is written to be accurate and useful, but it is not legal advice and it has not yet been reviewed by counsel. Have it reviewed before launch.
Access, correction or erasure request.
No charge, no account needed, no explanation required from you.