Privacy Policy

xcelit operates as a digital platform connecting startup founders, builders, and investors. We are the data controller responsible for personal data collected through xcelit's website and applications.

• Create, authenticate, and secure your account and workspace
• Power the matching algorithm that connects founders with relevant builders (based on skills, interests, location, and activity)
• Generate execution records from GitHub, Stripe, and PostHog data — turning activity into verifiable evidence for investors
• Display your profile and projects to other users on the Platform
• Process subscription payments and manage billing history
• Send operational emails: account confirmations, security alerts, billing notifications, investor digests, and weekly project updates
• Detect, investigate, and prevent fraud, abuse, and policy violations
• Analyze platform-level usage to improve product quality and reliability
• Comply with legal obligations and respond to lawful requests

We process your data under the following legal bases:

• Contract performance — to create and operate your account, process payments, and deliver the services you signed up for.
• Legitimate interests — to improve the Platform, prevent abuse, ensure security, and communicate relevant platform updates, where these interests do not override your rights.
• Consent — for optional data integrations (GitHub App, Stripe Connect, PostHog), marketing communications, and cookie-based analytics. You may withdraw consent at any time.
• Legal obligation — to comply with applicable laws in India, including the Digital Personal Data Protection (DPDP) Act, 2023, and any other applicable data protection frameworks.

We share data only in the following circumstances:

• Within project workspaces — your profile and activity are visible to other members of workspaces you join.
• Investor visibility — founders who publish project listings make their execution records visible to Insights subscribers. Founders control what integrations are connected.
• Service providers — we share limited data with trusted providers: Vercel (hosting), Neon (database), Resend (email), UploadThing (file storage), Inngest (background jobs), and Arcjet (security). All providers are bound by data processing agreements.
• Payment processors — billing data is shared with PayPal, Razorpay, Stripe, and Paddle only as needed to process transactions.
• Legal requirements — we may disclose data to courts, regulators, or law enforcement when required by valid legal process.
• Business transfers — in the event of a merger, acquisition, or asset sale, user data may be transferred as part of the transaction, with advance notice provided.

We do not sell, rent, or trade personal data to third parties for marketing purposes.

We retain personal data for as long as your account is active and for a reasonable period thereafter as required for legal compliance, dispute resolution, and service continuity.

• Account data — retained while your account is active. Deleted within 30 days of account deletion request.
• Execution records — retained while the project is active. Anonymized or deleted upon account or project deletion.
• Billing records — retained for 7 years for financial and tax compliance purposes.
• Security & audit logs — retained for up to 12 months for abuse prevention and legal compliance.
• Backups — may persist for up to 90 days in encrypted backup storage before full deletion.

We implement the following controls to protect your data:

• TLS encryption for all data in transit
• Encrypted storage for sensitive API tokens and third-party credentials (AES-256)
• Role-based access controls within workspaces and internal systems
• Secure OAuth-based authentication via GitHub and Google (no passwords stored)
• Rate limiting and bot protection via Arcjet on sensitive endpoints
• Continuous monitoring and error alerting via our monitoring service
• Database hosted on Neon with automated backups and point-in-time recovery
• Payment card data is never stored — handled entirely by PCI-compliant processors

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to support@xcelit.co.in.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data. Most profile data can be updated directly in account settings.
• Deletion — request deletion of your account and personal data. Initiate this via account settings or email us.
• Data portability — request an export of your personal data in a machine-readable format.
• Withdraw consent — revoke consent for optional integrations or marketing communications at any time.
• Object to processing — object to processing based on legitimate interests where your situation warrants it.
• Restrict processing — ask us to temporarily restrict processing while a dispute is resolved.

To exercise any of these rights, email support@xcelit.co.in. We will respond within 30 days. We may verify your identity before fulfilling the request.

xcelit uses the following types of cookies and tracking technologies:

• Session cookies — required for authentication and maintaining your login state. Cannot be disabled without breaking core functionality.
• Security cookies — used to detect and prevent CSRF attacks and unauthorized access.
• Analytics (PostHog) — used to understand how the Platform is used at an aggregate level (page views, feature engagement, session duration). PostHog is configured in a privacy-respecting mode. You can opt out via browser settings or a Do Not Track signal.

We do not use third-party advertising cookies or share browsing data with ad networks.

For privacy questions, data requests, or concerns, contact us at:

If you are unhappy with how we handle your request, you have the right to raise a complaint with the relevant data protection authority in your jurisdiction. In India, this is the Data Protection Board of India under the DPDP Act, 2023.