Privacy notice
SCALE is a startup finance and fundraising operating system operated by Cumma. This notice explains what personal data we process, why, and the choices and rights you have. We follow the principles of India's Digital Personal Data Protection Act, 2023 (DPDPA).
1. Who we are
Cumma (the “Data Fiduciary” for the purposes of this notice) operates SCALE and decides the means of processing personal data described below. Grievance Officer contact details are in section 9.
2. What we collect and why
- Account data — name, work email, role. Needed to create your workspace and authenticate you.
- Operating data — revenue, expenses, headcount, cash balances you enter or import. Used only to compute your metrics.
- Fundraising data — deck, profile, cap table summary, traction. Shared with investors only when you choose to apply or grant access.
- Data room documents — confidential filings you upload for diligence. Visible only to investors you approve, for fundraising and diligence purposes.
- Usage data — pseudonymised feature usage to improve SCALE. You can opt out.
We practise data minimisation — forms ask only for fields necessary for the feature you are using and label optional fields clearly.
3. Lawful basis
We rely on your consent for non-essential processing (investor sharing, analytics, marketing) and on legitimate use for account operation and the metrics you opened SCALE for. Consent is captured per purpose, is never pre-ticked, and can be withdrawn at any time from consent preferences.
4. Sharing
We share data with investors and counterparties only when you initiate or approve the share. We use a small number of sub-processors for hosting, email and analytics; the current list is published in version notes.
5. Retention
We retain operating and fundraising records for the active life of your workspace plus the period needed for tax and statutory requirements. Document-level retention notes are visible in the Data Room. You can request earlier deletion (see section 7).
6. Security
Access to confidential documents is role-based, logged and revocable. We use encrypted transport and storage on managed cloud infrastructure. MVP note: file storage and view logs are wired as designed mocks in the current build; production keys, audit trails and DPA execution are in progress.
7. Your rights (Data Principal)
Under the DPDPA you can request access, correction, erasure, withdrawal of consent, and submit a grievance. Use the in-product forms at /privacy/rights and /privacy/grievance. We aim to respond within 30 days.
8. Children
SCALE is intended for founders, operators and investors aged 18+. We do not knowingly process children's data.
9. Grievance Officer
Email privacy@cumma.in. You can also file a grievance from inside the app — it is tracked with a ticket number you can follow.
10. Changes
Material changes are published as a new version on version history. Where required we will re-ask for consent.