Privacy Policy

Unstack is a platform for funded build bounties. This policy covers the marketing pages and the workspace where companies post briefs and engineers answer them. It describes what the pilot service collects today.

Who operates Unstack

Unstack is operated by Startup Gurukul Innovation Private Limited, registered at the address below. That company is responsible for the personal data described in this policy.

What we collect

• Account and company details. Your name, work email address, company name, role and the registration details you submit when you apply. Passwords are handled by our authentication provider and stored as hashes, never as plain text.
• Dossier content. The workflow description, systems, compliance notes, annual cost, acceptance criteria and commercial terms you write into a brief.
• Stackathon entries. If a company chooses to enter a funded brief into a Stackathon, that brief's title, category and public line appear on a page anyone can read, including search engines, alongside the event's dates. The bounty amount, the company's identity and the dossier are never published. Entering is the company's own action, and it can be withdrawn until the event starts.
• NDA signatures and access requests. When a brief is sealed behind a confidentiality agreement, the agreement text the company pins to that brief, the exact text you were shown, a fingerprint of it, the name you type to sign, and when you signed. Where the company approves builders one by one, the request you send and the decision it records against that request.
• RFC and delivery content. Proposals, fixed prices, delivery plans, milestone notes and acceptance decisions.
• Messages and calls on an awarded brief. What the company and the builder write to each other after a pitch is accepted, when each message was sent, when each side last opened the thread, and any call proposed on it — the time, the agenda and the link pasted for it. Messages cannot be edited or deleted by either party, and operations can read a thread when handling a dispute about that brief.
• Payment references. The bank transfer references operations records against a funded, released or refunded escrow event. We do not collect card numbers or bank credentials.
• Session and technical data. Session cookies that keep you signed in, and operational logs covering requests, errors, IP address and user agent.

Why we use it

• To create and review company and builder accounts.
• To publish a funded brief to vetted engineers and collect RFCs against it.
• To keep a sealed brief confidential: to record who signed its agreement, and to decide which builders may see the dossier before they sign.
• To record escrow movements against a provider reference.
• To support you when something goes wrong and to keep the service secure.
• To meet legal, tax and accounting obligations.

Our legal bases

Where the General Data Protection Regulation applies, each purpose above rests on one of four bases.

• Performing our contract. Creating your account, publishing a brief, collecting RFCs, recording escrow events, gating a sealed brief behind a confidentiality agreement and deciding who may read it, and supporting the workspace you signed up for.
• Legitimate interests. Reviewing applications, keeping the workspace and the ledger secure, preventing fraud, and answering enquiries. We weigh those interests against your rights and stop where they are outweighed.
• Legal obligation. Tax, accounting and company records, and answering a lawful request from a court or a regulator.
• Consent. Only where we ask for it separately. We do not send marketing email today; if that changes it will be opt-in, and you can withdraw at any time without losing access.

Who processes it

Four providers process personal data on our instructions. Each is bound by a data processing agreement and may store data outside India.

• Supabase — authentication, and the database that holds accounts, briefs, RFCs, NDA signatures and access requests, and ledger rows.
• Cloudflare — application hosting, traffic handling and the edge cache that serves these pages.
• Resend — delivery of operational email: notices to our team when a release stalls, and the receipt sent to the signer and the brief's company when a confidentiality agreement is signed. No marketing email goes through it.
• Plausible — aggregate page views, and only after you accept analytics on the cookie banner. It sets no cookies and does not follow you across other sites.

We do not sell personal data and we do not share it for advertising.

International transfers

Our providers run infrastructure outside India, the European Economic Area and the United Kingdom. Where personal data leaves those regions, we rely on a lawful transfer mechanism: the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with each provider's own safeguards. The same mechanism covers account details, dossier content and operational logs.

Write to the address below to ask which mechanism covers a specific transfer.

Cookies and analytics

The marketing pages set no advertising cookies. The analytics script loads from Plausible only after you accept on the cookie banner, and it sets no cookies of its own. The workspace uses session cookies from our authentication provider so you stay signed in, and the proxy refreshes them on requests. Blocking them signs you out.

When you choose on the cookie banner, we store that decision in a first-party cookie named unstack_consent for 180 days, together with the time of the choice and the banner version, so we can ask again if the choices change. Until you accept, no analytics, advertising or session-replay script is loaded.

You can change or withdraw that choice at any time.

How long we keep it

Account data is kept while the account is active. Briefs, RFCs and ledger rows are kept after a brief completes, because the ledger is the record of escrow movements. The confidentiality agreement a company pins to a brief stays with that brief. A builder's NDA signature and access request are deleted with the builder's account, along with the decision recorded against the request. Operational logs are kept for a short period and then discarded.

How we protect it

Access to production data is limited to operators. Database access rules restrict each account to its own records, and privileged operations run in server code after an authorization check. Traffic is encrypted in transit. No system is perfectly secure, so report a concern and we will investigate.

If something goes wrong

We keep a breach runbook. If a personal data breach is likely to put your rights at risk, we notify the relevant supervisory authority within 72 hours of becoming aware of it, and we tell you without undue delay where the risk to you is high. A notification says what happened, what data was involved, what we have done and what you can do.

Report a suspected incident through the contact route below. Those reports are treated as urgent.

Your rights

If you are in India, the Digital Personal Data Protection Act, 2023 gives you rights over your personal data, including access, correction, erasure and grievance redressal. Write to us at the address above to use them. Some records, such as ledger rows and completed briefs, may be retained where the law or an active dispute requires it. You can also ask us to stop using your data for a purpose you no longer consent to, though that may end access to the workspace.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to access your data, correct it, erase it, restrict or object to how we use it, receive it in a portable format, and withdraw consent where consent is the basis. We answer within one month and tell you if we need longer.

You can complain to a supervisory authority at any time: the Information Commissioner's Office in the United Kingdom, or the authority where you live or work in the EEA.

Children

Unstack is a business tool for people acting for a company. It is not intended for anyone under 18.

Changes to this policy

We update this page when the service or the law changes. The date at the top shows the current version. Material changes are announced in the workspace before they take effect.

Contact

Privacy questions go to Startup Gurukul Innovation Private Limited at the registered address above. You can also write to privacy@unstack.dev.