Skip to content
VestSight
Sign in

Privacy policy

Effective date: 2026-10-21 · Version 2026-09-15

1. Scope and who we are

This policy explains how VestSight processes personal data. It covers two groups of people: people who appear on the site because they took part in an exit of an Indian company, and people who create an account.

VestSight is operated by an individual. It is not yet an incorporated company; until it is, the individual operator is the data fiduciary for the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and can be reached at darshv.mishra@gmail.com. If the project is incorporated, this policy will name the company and the change will be announced as described in section 10.

The site presents facts about exits: secondary sales, acquisitions, offers for sale in initial public offerings, buybacks, sales by founders and employees, and mergers, in companies based in India's Tier-1 cities, from 2018 onwards. It is an information product. It is not a service for contacting the people it names.

2. Data about people who appear on the site

What we process

For a person named in connection with an exit, we process only:

  • the person's name, as the source prints it;
  • their public professional role at the company, as a source states it (for example "co-founder" or "promoter");
  • the fact of their participation in the exit, and the quantities a source states for them: the stake sold, the number of shares offered, and the consideration where a filing states it for that person;
  • links to profiles the person has published themselves (for example a LinkedIn profile), and only once an editor has checked that the link belongs to them. This version of the site locates no such links and shows none;
  • a short professional summary, written ahead of time from the sources above and checked against rules that exclude anything outside professional history;
  • where each item came from (the filing or article) and how it was verified.

Where it comes from and the basis for processing

Every person record states its basis, which is shown on the person's page:

  • Statutory disclosure. Offer documents filed with the Securities and Exchange Board of India name the shareholders selling in an offer for sale and the shares each of them offers, because the law requires that disclosure. Personal data made publicly available by a person who is under a legal obligation to publish it is outside the DPDP Act under section 3(c)(ii) of that Act.
  • Self-published profile. Personal data a person has made publicly available themselves, such as a professional profile, is likewise outside the DPDP Act under section 3(c)(ii).
  • Public reporting. Where a person is named in reporting by a news outlet, we process only the professional fact of the exit as reported, with a link to the report. We rely on the information already being public, we keep it to the exit and the role, and we apply every right in section 7 to it, including removal on request.

Although much of this data is outside the DPDP Act, we treat it as if the Act applied: we keep it minimal, we say where it came from, and we honour requests to access, correct or erase it.

What we do not process

We never collect or show a person's email address, telephone number, postal address, date of birth, government identifiers (such as PAN or Aadhaar), family details, photographs, health, religion, caste, or any other sensitive detail. We do not estimate or display anyone's net worth, income or wealth, we do not work out what a person received from an exit unless a filing states it for that person, and we do not score or rank people as prospects for any service. We never download, copy or store the content of a personal profile page; we store only its address.

3. Data about account holders

An account is optional. Browsing the site never requires one. If you create an account we process:

  • your email address, which is how you sign in;
  • a hash of your password (we never store the password itself);
  • the date you created the account, and the version of this policy you consented to and when;
  • the list of deal pages you have opened while signed in, so that you can return to them.

The basis is your consent under section 6 of the DPDP Act, given by the checkbox at sign-up. You can withdraw consent at any time by deleting your account from the account menu, which erases the account, its sessions and its viewing history immediately. We do not use your email address for marketing, and we do not share it.

Accounts are for people aged 18 or over.

4. Service providers

We use a small number of providers to run the site, each bound to process data only to provide their service to us:

  • a hosting provider, for the servers and database that hold the data described above;
  • a language model provider, which receives the published excerpts, filings and facts about an exit in order to draft its summary and to extract the participants named in the evidence; it receives no account data;
  • a web search provider, which would receive a person's name and company in order to find the address of a profile they have published. This version of the site locates no profiles, so no search provider receives anything; if that changes, this policy will say so before it does.

Some of these providers process data outside India. We transfer data only to countries the Government of India has not restricted under section 16 of the DPDP Act.

5. Cookies and similar storage

The site sets one cookie: a session cookie that keeps you signed in. It is strictly necessary, it cannot be read by scripts on the page, it is sent only over secure connections, and it expires after 30 days or when you sign out. If you do not sign in, no cookie is set.

Your choice of light or dark theme is kept in your browser's local storage and never leaves your device.

We use no analytics cookies and no advertising cookies, and we do not allow third parties to track you on the site.

6. Retention

  • People who appear on the site: we keep a person's record while it relates to an exit on the site. A person with no exit on record for seven years is deleted automatically.
  • Accounts: kept until you delete the account. Deletion is immediate and removes the account, its sessions and its viewing history.
  • Requests about your data: your message and our handling of it are kept only as long as we need them to show that the request was dealt with.
  • Erasure records: when we erase a person, we keep a minimal record of their name and company (no other detail) so that the same public source cannot add them back. That record is what makes an erasure last.

7. Your rights and how to exercise them

Under the DPDP Act you have the right to:

  • access a summary of the personal data we process about you and how we process it (section 11);
  • correct, complete or update personal data that is inaccurate or incomplete (section 12);
  • erase personal data we no longer need, or that you ask us to remove (section 12);
  • grievance redressal, a readily available means to raise a complaint and have it answered (section 13);
  • nominate another person to exercise your rights if you die or become unable to exercise them (section 14).

We extend these rights to everyone who appears on the site, whatever the basis of their record.

To exercise a right, email the grievance officer at darshv.mishra@gmail.com. You may ask us for access to the personal data we hold about you, for a correction, for erasure, and for your name to be removed from the site. Tell us the name and company as they appear on the site. We may ask for information to confirm that a request comes from the person concerned or someone authorised by them, and we use that information only for that purpose. There is no form to fill in: every request is read and actioned by hand, within a reasonable period and ordinarily within 30 days.

When we erase a person, we delete their record and every page shows them no longer, and we keep only the minimal record described in section 6 so that they are not added again.

8. Grievance officer

The grievance officer for VestSight is its operator, who can be reached at darshv.mishra@gmail.com. If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India once our grievance process is exhausted.

9. Security

We protect the data we hold with measures proportionate to what it is:

  • every connection to the site is encrypted;
  • passwords are stored only as one-way hashes using a modern password-hashing algorithm;
  • session identifiers are stored only in hashed form, so a copy of our database cannot be used to sign in;
  • administrative functions require a separate key and are limited to the operator;
  • we collect less data in the first place, which is the most reliable protection of all.

If a personal data breach occurs, we will inform the Data Protection Board of India and the people affected as the DPDP Act requires.

10. Changes to this policy

When this policy changes, we will update the version and effective date at the top of this page. If a change affects how we process account data, we will seek fresh consent from existing account holders before the change applies to their accounts.

11. Governing law and jurisdiction

This policy is governed by the laws of India. The courts at Gurugram, Haryana have exclusive jurisdiction over any dispute arising from it, subject to the rights you have before the Data Protection Board of India.