Privacy Policy

1Who we are

The Founder Bottleneck Scorecard is operated by Consult with Krishna (“we”, “us”), a consulting practice reachable at [email protected] and at consultwithkrishna.com.

We are the data fiduciary under India’s Digital Personal Data Protection Act, 2023, the data controller under the UK and EU GDPR, and the business under United States state privacy laws, for everything described here. This policy covers the scorecard only. Other pages on consultwithkrishna.com may collect data under their own terms.

The scorecard is open to founders anywhere. This policy is written to apply wherever you are: sections 2 to 6 and 9 to 12 describe what we do for everyone, and section 7 sets out a baseline set of rights we honour for every visitor, followed by the additional rights particular laws give you.

2What the scorecard collects

The form collects three things, and nothing else.

Your answers

Ten scores from 1 to 10, one per question. They are numbers about how your business runs, not about you personally.

Your contact details

• Email address - required, because the breakdown is emailed to you.
• Name, company and team size - optional. Leave them blank and the form still works.

Technical data

• Your IP address, held briefly to rate-limit the form. Without it, an open form that sends email is a spam relay.
• A reCAPTCHA token, if reCAPTCHA is enabled on this deployment. See section 4.

3Why we use it, and on what basis

• To score your answers and email you the result. You asked for it by submitting the form - consent under the DPDP Act, and performance of a service you requested under GDPR Article 6(1)(b).
• To notify us that a scorecard came in, so Krishna can read it and, where it looks useful, follow up about your result. Legitimate interests under GDPR Article 6(1)(f): you gave us a business email in a business context and expected a reply.
• To keep the form from being abused - rate limiting and spam filtering. Legitimate interests in the security of the service.

We do not use your answers for automated decision-making that has a legal or similarly significant effect on you. The score is a conversation starter, not a credit decision.

4Who else handles it

We use a small number of service providers. They process your data on our instructions only.

• Amazon Web Services (Amazon SES) - sends both emails. Your address and the contents of the email pass through SES.
• Our email provider - receives and stores the notification email in Krishna’s mailbox.
• Our hosting provider - runs the application and keeps standard server logs.
• Google reCAPTCHA, where enabled - checks that the submission is not automated. Google receives the data described in its Privacy Policy, and its Terms of Service apply. The notice under the form tells you when it is active.

Some of these providers operate outside India, the UK and the EEA. Where personal data is transferred across borders, we rely on the providers’ standard contractual clauses and equivalent safeguards.

The typeface used on this site is served from our own servers, so loading the page makes no request to Google Fonts.

5How long it is kept

• Your IP address and email address are held in the rate limiter for up to 24 hours, in memory only. They are discarded automatically, and a restart clears them sooner.
• Your submission - your name, email, company, team size, your ten answers and your score - is written to a file on our own server when you submit it. That file is not a public service, not shared, and not used for anything but answering you and understanding how the scorecard is answered. It is kept no longer than 24 months from your submission, and you can have your entry removed at any time by asking - see section 7.
• The two emails - the copy sent to you, and the notification in Krishna’s mailbox - are separate from that file and are covered below.
• The notification email is kept for as long as the enquiry is live, and in any case no longer than 24 months from your submission, after which it is deleted.

6Cookies

The scorecard sets no cookies of its own. It stores nothing in your browser to identify you, and there is no consent banner because there is nothing to consent to.

Where reCAPTCHA is enabled, Google may set cookies or read existing ones as part of its own abuse detection. That is covered by Google’s policy, linked in section 4.

7Your rights

Write to [email protected] and we will act on any of the following. We answer within 30 days, and there is no charge.

Everyone, wherever you live

These we honour for every visitor, whether or not a law where you live requires it. We do not ask which country you are in before granting them.

• Ask what data of yours we hold, and get a copy of it.
• Have it corrected if it is wrong, or completed if it is partial.
• Have it deleted.
• Tell us to stop contacting you, and be told nothing further.
• Ask who we have disclosed it to.
• Be treated the same either way. Exercising any of these rights does not change the scorecard you get or anything else we would offer you.

Where a law that applies to you gives you more than this, the law wins and the extra rights are listed below. Where it gives you less, this baseline still stands.

If you are in India (DPDP Act, 2023)

• Ask what personal data of yours we hold and who we have shared it with.
• Have inaccurate or incomplete data corrected, updated or erased.
• Withdraw your consent, as easily as you gave it.
• Nominate someone to exercise these rights if you die or become incapacitated.
• Raise a grievance with us first. If our answer does not settle it, you may complain to the Data Protection Board of India.

If you are in the UK or the EEA (GDPR)

• Access a copy of your data, and have it corrected or erased.
• Restrict or object to our processing, including the follow-up email.
• Receive your data in a portable, machine-readable form.
• Withdraw consent at any time, without affecting what was done before you withdrew.
• Complain to your national supervisory authority - the ICO in the UK, or your local authority in the EEA.

If you are in the United States

California, Colorado, Connecticut, Virginia, Texas and a growing list of other states give residents rights over their personal information. Whichever state you are in, we honour all of the following.

• Know. The categories we collect are set out in section 2, the purposes in section 3, and the recipients in section 4. Ask and we will confirm what we hold about you specifically.
• Delete the personal information we hold about you.
• Correct anything inaccurate.
• Opt out of any sale or sharing of your personal information, and of targeted advertising and profiling.
• No retaliation. We will not deny you the scorecard, charge you a different price, or give you a worse result for exercising a right.
• Use an authorised agent to make a request on your behalf, once we can verify they act for you.

If you are somewhere else

Canada (PIPEDA), Australia, Brazil (LGPD), South Africa (POPIA), Switzerland, Singapore, the UAE and others each have their own regime. Rather than list them, we apply the baseline above to everyone, and where your local law grants you more we will honour that too - tell us which law you are relying on and we will treat the request under it. You may always complain to the privacy regulator in your own country.

The fastest way to stop hearing from us is to reply to either email and say so. To have the submission itself erased, ask, and we will delete the notification email.

How we verify a request. We will reply from the address the request concerns, or ask you to confirm from it. That is the only identifier we hold, so we ask for nothing further - we will never require an identity document to action a request.

8Using the scorecard from outside India

The scorecard is operated from India, and the providers in section 4 operate from India, the United States, the European Union and elsewhere. Submitting the form means your data is processed in countries whose privacy laws may differ from those of the country you live in.

Where the law of your country restricts those transfers, we rely on the safeguards our providers offer - standard contractual clauses, the EU-US and UK-US Data Privacy Frameworks where the provider is certified, and equivalent contractual protection elsewhere. Ask and we will tell you which applies to a particular provider.

Wherever the data is processed, the protections in this policy travel with it: the same baseline rights in section 7, the same retention limits in section 5, and the same refusal to sell it in section 2.

9Security

The form is served over HTTPS. Submissions are rate-limited, screened for automated abuse, and validated before anything is sent. Access to the mailbox holding submissions is restricted to Krishna.

No transmission over the internet is perfectly secure. If a breach affects your data and poses a risk to you, we will tell you and the relevant authority, within the timeframes the law sets.

10Children

The scorecard is a business tool for founders and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has submitted the form, write to us and we will delete it.

11Changes to this policy

When this policy changes, the effective date at the top changes with it. Material changes to how we use your data will be described here rather than made quietly.

12Contact and grievances

For any question about this policy, or to exercise a right in section 7, write to [email protected]. Mark the subject line Privacy request and it is routed accordingly.

Krishna Kumar acts as the grievance officer for the purposes of the DPDP Act and is reachable at the same address.