Privacy Policy
What We Collect, Why We Collect It, And What You Can Ask Us To Do With It.
Last Updated — 15 September 2026
01
Who This Policy Covers
Orangeful is a venture architecture firm operating from Gurugram, India. This policy explains what personal data we collect when you use orangeful.com, why we collect it, how long we keep it, and the choices you have over it.
It applies to this website and to the enquiry, application and subscription forms hosted on it — including partner enquiries, BeanStalkx founder applications, career enquiries and newsletter sign-ups.
Some of the ventures and platforms we reference — BeanStalkx, Domainza, GoDotly, Domaincook, PrismIndex, PlumJob and others — run on their own domains under their own terms and privacy notices. When you leave orangeful.com for one of them, that platform's notice governs what it collects, not this one.
In this policy, 'we', 'us' and 'our' mean Orangeful. 'You' means anyone visiting the site or submitting information through it.
02
Information We Collect
We collect only what a given interaction needs. Most visitors never give us anything beyond the technical data every website receives.
| Category | What it includes | How we get it |
|---|---|---|
| Identity and contact | Name, work email, phone number, company, role, country. | You give it to us in a form or by writing to us. |
| Enquiry content | The message, brief, deck, portfolio or application you send, and anything attached to it. | You give it to us. |
| Venture and application data | Company details, stage, sector, traction and funding context submitted through BeanStalkx or partner applications. | You give it to us. |
| Technical data | IP address, browser and device type, operating system, referring page, timestamps. | Collected automatically by our servers and hosting provider. |
| Usage data | Pages viewed, time on page, navigation paths, broad geographic region. | Collected automatically by analytics, where enabled. |
| Communication records | Emails, meeting notes and correspondence relating to a live enquiry or engagement. | Created in the course of working with you. |
We do not ask for sensitive personal data — government identifiers, financial account numbers, health information or biometric data — through this website. Please do not send it to us in a form or an attachment. If a live engagement ever requires it, we will ask for it separately, through a channel built for it, and tell you why.
03
How We Use Your Information
We use personal data for the following purposes, and no others:
- To answer your enquiry, and to carry on the conversation it starts.
- To assess applications to BeanStalkx, partner programmes and open roles, and to tell you the outcome.
- To provide, operate and secure this website, including diagnosing faults and preventing abuse.
- To send you material you asked for — a newsletter, a blueprint, an insight note or an event invitation — until you tell us to stop.
- To understand which pages and topics are useful, so we can improve them.
- To keep records of our dealings with you, and to meet legal, tax, audit and regulatory obligations.
- To establish, exercise or defend legal claims where that becomes necessary.
We do not sell personal data. We do not rent or trade mailing lists. We do not use your enquiry content to train third-party machine learning models.
04
Our Legal Basis For Processing
Where the Digital Personal Data Protection Act, 2023 applies, we process personal data on the basis of the consent you give when you submit it, or for legitimate uses recognised under that Act. You may withdraw consent at any time; withdrawal does not affect processing already carried out.
Where the UK or EU General Data Protection Regulation applies to a visitor, we rely on the following bases:
- Consent — for marketing email and for non-essential cookies.
- Performance of a contract, or steps taken at your request before entering one — for responding to enquiries and progressing applications.
- Legitimate interests — for site security, fraud prevention, aggregate analytics and ordinary business administration, balanced against your rights each time.
- Legal obligation — for retention, tax and regulatory record-keeping.
05
Cookies And Analytics
A cookie is a small file a site stores in your browser. We use as few as we can.
Strictly necessary
These make the site work — routing, load balancing, security and remembering a preference you have set. They cannot be switched off from within the site, and they carry no advertising function.
Analytics
Where analytics are enabled, they tell us which pages are read, how people move through the site and which devices they use. We configure them to collect at an aggregate level and to truncate IP addresses where the tool supports it.
Your controls
Every mainstream browser lets you see the cookies a site has set, delete them, and refuse new ones. Blocking strictly necessary cookies may break parts of the site; blocking the rest will not.
We do not run third-party advertising or cross-site behavioural tracking on orangeful.com.
06
When We Share Information
We share personal data only in these situations:
- Service providers — hosting, email delivery, form handling, analytics, applicant tracking and document storage, each working on our instructions and bound by contract to protect what they process.
- Within the Orangeful group — where the venture, division or programme you approached is the right team to answer you.
- Professional advisers — lawyers, accountants and auditors, where they need the information to advise us.
- Corporate transactions — if a business or a venture is reorganised, acquired or merged, information may transfer as part of it, subject to this policy.
- Legal requirement — where disclosure is required by law, regulation, court order or a lawful request from a public authority.
We do not give your information to anyone for their own marketing.
07
Third-Party Platforms We Link To
Parts of the Orangeful model run on platforms that are separate products, some of them operated by third parties. Following a link to one takes you outside this policy:
- Career applications are posted and tracked on PlumJob, which collects and holds applicant data under its own notice.
- Valuation and index data is served by PrismIndex.
- BeanStalkx material and applications may be hosted on beanstalkx.com.
- Domain marketplaces and tools — Domainza, GoDotly, Domaincook, DN.chat and DroppedNow — operate their own accounts and notices.
- Embedded media, maps and social links load from the provider hosting them.
We choose the platforms we work with carefully, but we do not control what they collect. Read their notices before you submit anything to them.
08
How Long We Keep It
We keep personal data only as long as the purpose we collected it for lasts, then delete it or anonymise it.
| What | How long |
|---|---|
| General enquiries that do not progress | Up to 24 months from the last exchange. |
| Live engagements and partner relationships | For the relationship, then 7 years for legal, tax and audit purposes. |
| Applications that are not taken forward | Up to 12 months, so we can come back to you about a later role or cohort. |
| Newsletter and subscription data | Until you unsubscribe, plus a suppression record so we do not re-add you. |
| Server logs | Up to 12 months. |
Where a longer period is required by law, or where information is needed for a claim that is live or reasonably anticipated, we keep it for that period instead.
09
How We Protect It
We apply technical and organisational measures proportionate to the data we hold: encryption in transit, access limited to people who need it, authentication on administrative systems, logging and monitoring, vendor review, and staff obligations of confidentiality.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data and the law requires it, we will notify you and the relevant authority within the time the law allows.
Email is not a secure channel. Please do not send passwords, identity documents, bank details or other confidential material to us by ordinary email.
10
Your Rights
Subject to the law that applies to you, you may:
- Ask what personal data we hold about you and get a copy of it.
- Ask us to correct data that is inaccurate, incomplete or out of date.
- Ask us to erase data we no longer have a reason to hold.
- Withdraw consent you previously gave, including for marketing email.
- Object to, or ask us to restrict, processing we carry out on the basis of legitimate interests.
- Ask for a portable copy of data you gave us, in a machine-readable format.
- Nominate another person to exercise these rights on your behalf in the event of your death or incapacity, where the Digital Personal Data Protection Act, 2023 applies.
- Complain to us, and then to your data protection authority or to the Data Protection Board of India, if you are not satisfied.
Use our contact page to exercise any of these. We will verify your identity before acting, and respond within 30 days. There is no charge unless a request is manifestly excessive or repetitive.
Every marketing email we send carries an unsubscribe link, and it works. You will still receive replies to enquiries you started and messages about a live engagement.
11
International Transfers
We operate from India and work with clients, founders and partners across several countries. Some of our service providers store or process data outside the country you are in.
Where personal data moves across a border, we transfer it only to a country not restricted by the Central Government under the Digital Personal Data Protection Act, 2023, and — where UK or EU rules apply — under an adequacy decision or Standard Contractual Clauses with the additional safeguards those clauses require.
12
Children
This site is built for a professional audience. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
If you believe a child has given us personal data, tell us through our contact page and we will delete it.
13
Changes To This Policy
We update this policy when our practices, our platforms or the law change. The date at the top of the page is the date of the current version, and it is the authoritative one.
Where a change materially affects how we handle data you have already given us, we will tell you directly rather than rely on this page.
14
Contact And Grievance Redressal
For anything in this policy — a question, a rights request or a complaint — use our contact page, or post to Orangeful, Gurugram, Haryana, India.
Our Grievance Officer, appointed under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, is reached the same way. Mark your message for the Grievance Officer and we will acknowledge it within 48 hours and resolve it within 30 days.
If we cannot resolve it, you may escalate to the Data Protection Board of India, or to the supervisory authority in your country if you are outside India.
This policy is a general description of our practices and is not legal advice. Registered entity details, the named Grievance Officer and the current list of processors should be confirmed with Orangeful before you rely on them.