Privacy Policy
BuildGara Tech Pvt. Ltd. ("BuildGara," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website, mobile applications, and all related services (collectively, the "Platform").
Last updated: August 31, 2026
1. Information We Collect
a) Account & Profile Information
When you register for an account, we collect:
- Full name, username, email address, phone number
- Password (stored in encrypted form using bcrypt)
- Country, city, and timezone
- Role selection (founder, investor, service provider, consultant)
- Profile biography, skills, LinkedIn URL, and portfolio links
- Profile photographs and avatar images
b) Company & Business Information
If you register a company, we collect:
- Company name, registration number, and business type
- PAN/VAT numbers and tax identification documents
- Company logo, team size, and business description
- Registered address, industry, and stage of development
- Cap table details (total shares, par value, founder equity percentages)
- Bank account details for payouts and transactions
c) Know Your Customer (KYC) Documents
To verify your identity and comply with regulations, we may collect:
- Government-issued identification (national ID, passport, driver's license)
- Selfie photographs for liveness verification
- Proof of address (utility bills, bank statements)
- Business registration and incorporation documents
- Bank account statements and verification documents
- Accredited investor certifications
KYC documents are stored in encrypted, access-controlled directories. Only you and authorized BuildGara administrators can access these files. They are served via short-lived, signed URLs that expire after 10 minutes.
d) Financial & Transaction Information
- Payment method selections (eSewa, Khalti, Stripe, bank transfer)
- Transaction records, order history, and payment confirmations
- Payout bank account details for vendors and consultants
- Commission rates and revenue data
- Invoice and receipt information
We do not store raw credit card numbers or payment gateway credentials. Payment processing is handled by certified third-party gateways (eSewa, Khalti, Stripe) in compliance with PCI-DSS standards.
e) Platform Activity & Usage Data
- Login timestamps, session duration, and device information
- IP addresses and browser user-agent strings
- Pages viewed, features used, and navigation patterns
- Search queries, filter selections, and listing interactions
- Messages sent through the platform (support, pitch, consultation)
- Files uploaded (documents, pitches, résumés, service deliverables)
- Reviews, ratings, and feedback submitted
- Push notification subscription tokens
f) Communications
- Support ticket messages and live chat transcripts
- Messages between founders, investors, and consultants
- Email communications with BuildGara
- Feedback, survey responses, and reported issues
2. How We Use Your Information
We use collected information for the following purposes:
Platform Operation & Service Delivery
- Creating and managing your account and authentication
- Processing transactions, orders, and consultation bookings
- Facilitating communication between platform participants
- Providing customer support and dispute resolution
- Delivering notifications about platform activity relevant to you
Verification & Compliance
- Verifying your identity through KYC procedures
- Reviewing and approving vendor, consultant, and investor applications
- Complying with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations
- Responding to lawful requests from regulatory authorities
Platform Improvement & Analytics
- Analyzing usage patterns to improve features and user experience
- Generating aggregated, anonymized analytics for platform health monitoring
- Detecting and preventing fraud, abuse, and unauthorized access
- Conducting A/B testing and performance optimization
Communications & Marketing
- Sending transactional emails (verification, receipts, password resets)
- Delivering platform notifications about activity on your listings, bookings, and pitches
- Sending newsletters and product updates (with opt-out capability)
- Displaying relevant marketplace recommendations based on your interests
5. Data Security
We implement industry-standard security measures to protect your personal information:
- Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2+ (HTTPS)
- Encryption at rest: Sensitive data including passwords, KYC documents, and financial records are encrypted at rest
- Password hashing: Passwords are hashed using bcrypt with a cost factor of 12 — we never store plaintext passwords
- Access control: Private files (KYC documents, pitches, résumés) are served via HMAC-signed URLs that expire after 10 minutes
- Role-based access: Platform administrators have role-based access controls with granular permission assignments
- Session management: Active sessions are tracked with device fingerprinting; suspicious sessions can be revoked
- Audit logging: All significant account and administrative actions are logged with timestamps, IP addresses, and actor information
- Input validation: All user inputs are validated server-side using schema validation to prevent injection attacks
While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We encourage you to use strong, unique passwords and enable two-factor authentication when available.
6. Data Retention
We retain your information for as long as necessary to provide the Platform and fulfill the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 30 days after deletion |
| KYC documents | Duration of account + 5 years (regulatory requirement) |
| Transaction records | 7 years from transaction date (tax & audit compliance) |
| Activity logs | 90 days (auto-purged by cron job) |
| Session data | 7 days or until logout |
| Support messages | Duration of account |
| Analytics cache | Refreshed daily; previous day's cache is overwritten |
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you
Right to Rectification
Correct inaccurate or incomplete personal data
Right to Erasure
Request deletion of your account and personal data
Right to Portability
Receive your data in a structured, machine-readable format
Right to Restrict Processing
Limit how we use your personal data
Right to Object
Object to processing based on legitimate interests
Right to Withdraw Consent
Withdraw consent for data processing at any time
Right to Lodge a Complaint
File a complaint with your local data protection authority
To exercise any of these rights, contact us at privacy@buildgara.com. We will respond to your request within 30 days.
You can also manage much of your data directly through the Platform:
- Update your profile and company information in Settings
- Manage KYC documents in the KYC Wizard
- Download your data by contacting support
- Delete your account through Settings → Account → Delete Account
8. Children's Privacy
The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@buildgara.com.
9. International Data Transfers
BuildGara is operated from Nepal. If you access the Platform from outside Nepal, your information may be transferred to, stored, and processed in Nepal or other countries where our service providers operate.
By using the Platform, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence. We ensure that appropriate safeguards are in place, including contractual clauses with our service providers that require them to protect your data.
10. Third-Party Links
The Platform may contain links to third-party websites, services, or payment gateways (eSewa, Khalti, Stripe). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service before providing them with your personal information.
We are not responsible for the privacy practices or content of third-party websites or services.
11. KYC & Identity Documents
BuildGara collects and processes identity verification documents to comply with regulatory requirements and maintain platform trust. This section provides additional detail on how KYC data is handled:
- Storage: KYC documents are stored in access-controlled directories (uploads/vendor, uploads/consultant, uploads/documents/kyc) that are never publicly served. Access requires HMAC-signed URLs with 10-minute expiry.
- Access: Only the document owner and authorized BuildGara administrators can access KYC files. The file access system performs ownership verification against the database for every request.
- Verification: KYC documents are reviewed by authorized BuildGara administrators. Verification status (unverified, pending, verified, rejected) is tracked per document type.
- Retention: KYC documents are retained for the duration of your account and for 5 years after account deletion, as required by financial regulations.
- Sharing: KYC documents are never shared with other platform users. They are accessible only to BuildGara staff involved in the verification process.
12. Financial Information
Financial data on the Platform is handled with the highest level of security:
- Payment processing: All payments are processed through certified PCI-DSS compliant gateways (eSewa, Khalti, Stripe). BuildGara never stores your credit card numbers, bank passwords, or payment gateway credentials.
- Transaction ledger: We maintain an internal ledger of transactions for order tracking, commission calculation, and payout processing. This ledger records amounts, statuses, and reference IDs — not raw payment credentials.
- Payout information: Bank account details provided for vendor/consultant payouts are stored encrypted and used solely for payout processing.
- Commission data: Platform commission rates and earnings data are used for financial reporting and are never shared with unauthorized parties.
13. Communications
We may contact you through the following channels:
- In-app notifications: Real-time notifications about platform activity (new messages, booking updates, payment confirmations, KYC status changes)
- Email: Transactional emails (verification, password reset, receipts) and, with your consent, marketing communications
- Push notifications: Browser-based push notifications for time-sensitive activity (only with your explicit opt-in)
- SMS: Account verification codes and security alerts (only when phone verification is enabled)
You can manage your notification preferences in Settings → Notifications. Transactional communications (receipts, security alerts) cannot be opted out of as they are essential to the Platform's operation.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page
- Notify you via email and in-app notification for significant changes
- Where required by law, obtain your consent before applying changes
We encourage you to review this page periodically. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
BuildGara Tech Pvt. Ltd.
Data Protection Officer
Email: privacy@buildgara.com
General: support@buildgara.com
Website: buildgara.com
We aim to respond to all privacy-related inquiries within 30 business days.