Short version: nothing that identifies you is collected unless you press Accept on the cookie bar. If you pressed Decline, or have not answered, this page describes things that are not happening to you.
You can change that answer at any time with Turn off cookies at the foot of any page. One click, the same as turning it on.
Before you choose
The site counts page views and where visitors arrived from, with no cookie and nothing that identifies a person. It is a tally, not a profile, which is why it needs no consent.
If you accept
Four things start, all through PostHog, on servers in the European Union.
A cookie that recognises you on a return visit. That is what makes “arrived from a reel on Monday, bought on Thursday” answerable. It is the reason this needs consent at all.
Which pages you saw and what you clicked. Page addresses, the text on buttons and links, and the page you were on when you left.
Where on the page you tapped. The position of a tap, so we can see that people keep pressing something that is not a button and make it one. It is a coordinate on a page, not a coordinate on a map.
A recording of how the pages were used. Mouse movement, scrolling and clicks, played back as video. It is how we find out that a button does not work on one particular phone, which is otherwise close to impossible to discover.
Typing is never recorded. Every input on this site is masked before the recording is saved — your name, email and phone number appear as blocks in the video. This is enforced in the code, not by policy, and it is set explicitly rather than left to a default.
The cookies, plainly
| What | Why | How long |
|---|---|---|
| Your cookie choice | So you are not asked again on every page | 1 year |
| PostHog visitor cookie | Recognises a return visit, so one person is not counted as five | 1 year |
| PostHog session cookie | Ties one visit together, and to its recording | 30 minutes idle |
Google _gcl cookies | Records that you arrived from a Google ad, so the ad can be credited if you buy | 90 days |
Google Analytics _ga and _ga_… | Counts visits and tells us which pages were read, so one person is not counted as five | 2 years |
Meta _fbp and _fbc | Records that you arrived from a Facebook or Instagram ad, so the ad can be credited if you buy | 90 days |
If ads are running, the Meta pixel is also loaded — behind this same consent, never before it. It tells Meta that a visit happened and, if you buy, that a purchase happened, so the ads can be aimed better. Your email and phone number are sent to Meta as one-way hashes, never in the clear, and only if you actually buy. It is switched off entirely whenever no ad account is connected.
The Google Ads tag is loaded on the same terms — behind this consent, never before it, and never on the admin pages. It sets Google’s own _gcl cookies, which record that you arrived from a Google ad so that the ad can be credited if you buy. Decline, and it is not loaded at all: no cookies, and no cookieless signal either.
Google Tag Manager is the container the Google tools above are managed through. It stores nothing about you by itself; it loads the tags described on this page, which is why it waits for the same yes and is never loaded on the admin pages. Anything it is ever asked to load has to be added to this page first.
There are no other advertising cookies and no other third-party trackers on this site.
How long any of it is kept
Recordings: 30 days. They exist to find broken things, and a broken thing that has gone unnoticed for a month is not going to be found by a video.
Visit and click data: 12 months. Long enough to compare a launch with the one before it.
Purchase records: as long as tax law requires, currently eight years. We cannot delete an invoice on request; that is the one limit on the erasure right below, and it applies to the invoice, not to your analytics data.
What we never collect here
Card numbers, UPI details and passwords. Payment happens at the course platform's own checkout, not on this site, so those details never touch it. Nothing on these pages asks for them, and any page that did would be a page we did not build.
If you buy
The name, email and mobile number you give at checkout are used to issue your access and to send your confirmation and invoice. They are held by us and by the course platform.
They are not sold, and not shared for anyone else's advertising. If we are running ads, a hashed form of your email and number is sent to Meta so that a sale can be matched to the ad that produced it — that is measurement of our own advertising, not a list handed to anyone else. We do not upload buyer lists to advertising platforms.
Where it physically sits
Analytics and recordings are on PostHog's servers in the European Union. The site itself is served by Vercel, which keeps standard request logs. Your course account is held by the LMS provider. If ads are running, Meta receives the hashed values described above, and Google receives the fact that a visit followed one of its ads. All of them mean some of this data leaves India, which the law permits and which you should know either way.
Your rights, and how to use them
Under the Digital Personal Data Protection Act you can ask for any of the following, and this is what each one gets you.
A copy of what we hold. Everything against your email, in a form you can read.
A correction. A wrong name or number, fixed.
Erasure. Your analytics and recording data deleted. If you have bought the course, deleting your record ends your access — we will say so before doing it, not after. Invoices stay, because tax law says so.
To withdraw consent. The footer control, any time, no reason needed.
To nominate someone. To exercise these rights on your behalf if you cannot.
Write to support@startupwithshashank.com from the address you used, and say which one you want. That is the whole process — there is no form. We answer within 30 days, usually the same week.
Children
This course is sold to adults and the site is not directed at children. We do not knowingly collect anything about a child. If you believe we have, write to us and it will be deleted.
Keeping it safe
The site is served over HTTPS everywhere. The keys that can read the analytics are held on the server and never sent to a browser. The admin panel is behind a password and its session cookie is signed, so it cannot be forged.
If a breach ever affects your data, we will tell you and the Data Protection Board, rather than hoping you do not notice.
Turning it off
Use Turn off cookies at the foot of any page. It stops the tracking and clears the cookies this site set. Withdrawing is exactly as easy as giving — that is a requirement, not a courtesy.
Who to complain to
Ashrith, Grievance Officer
support@startupwithshashank.com
Social Hippi, 12 G West, Klassik Benchmark Apts, Bannerghatta Road, Bangalore 560076
We acknowledge within 48 hours and aim to resolve within 30 days. If you are not satisfied, you can take it to the Data Protection Board of India.
Changes
If what we collect changes, this page changes with it, on the same day. The date at the top is how you tell.
In force from 5 September 2026. The rest of the arrangement is in the terms and the refund policy.