Privacy Policy

CapitalSea is an online marketplace and professional directory that connects verified Indian small and mid-sized businesses with investors and buyers, and with empanelled professionals (CAs, CSs and advocates). This policy explains how we handle your personal data and how you exercise your rights.

CapitalSea is operated from India. We are pre-incorporation: once our operating entity is registered, we will update this page with its registered name, CIN and registered office. Until then, the CapitalSea team is accountable for the processing described here and is reachable at support@capitalsea.in or through our help form.

We act as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), and we follow the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the IT (Intermediary Guidelines) Rules, 2021. The DPDP Rules, 2025 commence in phases through May 2027; we are building to them now rather than waiting.

• Identity and contact details - your name, mobile number, email address, role and organisation. We sign you in with a one-time password sent to your mobile, so your number is required.
• Verification (KYC/KYB) data - PAN, GSTIN, CIN, Udyam registration, professional council registration numbers, business registration details, and a bank-account name match where you ask us to verify payout details. For a PAN or a bank account we store only a masked value and the verification result - never the full number.
• Listing content - whatever you choose to publish or attach to a listing, including business descriptions, photographs and the financial information you decide to share.
• Communications - messages you send through the platform, support and help requests, and any files you attach to them.
• Introduction records - timestamped logs of who requested contact with whom, and when. This is an operational audit log so the introduction mechanism works and disputes can be resolved.
• Technical data - IP address, device and browser information, and server logs, used for security and to keep the service running.

Where a company's directors, signatories or authorised representatives are involved, their details are collected as part of business verification.

• Verifying identity and business standing, and assigning a trust tier.
• Surfacing relevant listings and matching businesses with investors and buyers.
• Operating and auditing the introduction and contact-reveal mechanism.
• Invoicing our own platform fees - listing packages, subscriptions and credit packs.
• Responding to your support and help requests.
• Preventing fraud and abuse, and keeping the platform secure.
• Meeting our legal and regulatory obligations.

We will not use your personal data for a new, incompatible purpose without telling you first and, where required, asking for fresh consent. We do not sell your personal data and we do not build or trade profiles from it.

Our primary lawful basis is your consent, which we ask for in plain language at the point we collect the data. We do not use pre-ticked boxes and we do not bundle unrelated purposes together.

You can withdraw consent at any time - as easily as you gave it - from your account settings or by writing to support@capitalsea.in. Withdrawing consent stops the future processing that depended on it and triggers erasure of the affected data, unless we are required by law to keep it. Withdrawal is not retroactive: it does not undo processing already carried out lawfully.

We use only strictly necessary cookies - the ones that keep you signed in (df_session), hold an in-progress sign-up (cs_signup, cs_google) and authorise our internal admin tools (cs_admin). We also store your light/dark theme preference in your browser.

We run no advertising cookies, no third-party analytics and no tracking pixels. If that ever changes, we will ask for your consent by cookie category before setting anything optional, and you will be able to withdraw it as easily as you gave it.

We share personal data only as needed to run the platform:

• Identity and business verification providers, to check PAN, GSTIN, CIN and similar records.
• Our SMS/OTP provider, to deliver sign-in codes to your mobile.
• A licensed payment aggregator, to collect our own platform fees.
• Cloud hosting and storage providers that run the service.
• Empanelled professionals you choose to engage.
• The user you choose to contact - when you unlock an introduction, we share the contact details you have unlocked. We do not otherwise disclose your details to other users.
• Law enforcement, regulators or courts, where we are legally required to.

Each provider is bound by a data-processing contract and may use your data only for the service they provide to us. We remain accountable for them. Empanelled professionals are independent - for work you engage them to do directly, they are responsible for their own handling of your data, which this policy does not govern.

We do not collect or store bank account numbers, card numbers, UPI IDs, OTPs, PINs or net-banking credentials. Our platform fees are processed by a licensed payment aggregator, which handles the payment rails and holds any such data; we keep only a payment reference or token for accounting.

We also never hold, pool, escrow or settle deal money. Any consideration in a transaction moves entirely off the platform, directly between the business and the investor through their own banking and legal arrangements.

Verification data, listing files and business financials are stored on India-region infrastructure. Some supporting services - for example email or messaging delivery - may process limited personal data outside India. Indian law permits such transfers except to countries the Central Government restricts by notification; no country is restricted at the date of this policy, and we will suspend transfers to any country that becomes restricted.

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. In practice:

• Verification documents - kept for the life of your account, then erased; we retain the verification result and trust tier longer than the source documents.
• Listing content and business financials - kept while the listing is live, then erased after a short wind-down window.
• Messages and support tickets - kept for the life of your account plus a limited dispute window.
• Introduction and consent logs - kept as compliance and dispute evidence, including a 180-day minimum record where the IT Rules, 2021 require it.
• Security and access logs - kept for at least one year.
• Payment references for our own fees - kept as long as accounting and tax law requires.

When you delete your account, we erase your data on this schedule and keep only what a legal obligation or an open dispute requires us to. Where practicable we give you at least 48 hours' notice before erasing account data, so you can log in or object.

We apply reasonable security safeguards: encryption in transit and at rest, role-based least-privilege access, logging and monitoring, regular backups, and expiring signed links for user-uploaded files. No system is perfectly secure, but we work to industry-recognised standards.

If a personal-data breach affects you, we will notify you without delay in plain language - what happened, what it means for you, what we are doing about it and what you can do - and we will notify the Data Protection Board of India, with detailed information within 72 hours of becoming aware.

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct, complete or update your personal data.
• Erase your personal data.
• Nominate someone to exercise your rights if you die or become incapacitated.
• Have your grievance heard and resolved.

You can do most of this yourself from your account settings, including deleting your account. For anything else, write to support@capitalsea.in or use our help form. We may need to verify your identity before we act. We respond within 30 days of a valid, verified request, and in any event within 90 days. If we have to refuse or narrow a request - for example because of a legal hold or because the data involves someone else - we will tell you why.

CapitalSea is a business-to-business platform and is not directed at children. You must be 18 or older and acting for a business to use it. We do not knowingly process children's personal data, and we do not run behavioural advertising or tracking of any kind.

If something has gone wrong, contact our Grievance Officer at support@capitalsea.in or through our help form. We acknowledge grievances within 24 hours and aim to resolve them within 15 days. If you are not satisfied once our process is exhausted, you may complain to the Data Protection Board of India.

We version this policy and will tell you about material changes by email or in-app notice before they take effect, so your consent stays informed. The date at the top of this page always reflects the current version.

Privacy questions, rights requests and grievances: support@capitalsea.in, or use our help form - it reaches the same team and works whether or not you have an account.