Privacy Policy
Effective [DATE]. Data Fiduciary: Binarius Systems Private Limited, [REGISTERED ADDRESS], CIN [CIN] ("IndicAds", "we").
This policy explains what personal data IndicAds processes, why, and your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and other Indian law. It covers three groups of people: people who chat with apps that use IndicAds ("end users"), publishers and advertisers who have an account, and visitors to our website.
1. End users of chatbots and apps
Apps that use IndicAds send us the question a user typed, so we can show a relevant sponsored suggestion.
- Questions. Before we look at a question we remove phone numbers, email addresses, PAN, Aadhaar, bank account numbers, IFSC codes and names stated in the question. The question is processed in memory to find its topic and is not stored. We keep only the topic (for example "insurance") with an anonymous record that an ad was shown.
- Anonymous user reference. An app may send a random reference so the same ad is not shown to the same person too often. We store it only as a one-way hash and for at most 24 hours.
- Approximate city. Some advertisers serve only certain cities. To show only relevant offers, we estimate the city from a city named in the conversation, from the city the app tells us, or from the IP address the app passes to us. An IP address is looked up in memory in an offline database and then discarded: it is never stored or logged. We keep the city (not the IP) with the ad view for reporting, and a city named in the conversation for up to 24 hours so later questions in the same chat use it. IP location data: IP Geolocation by DB-IP (CC BY 4.0).
- Clicks. When someone clicks a sponsored suggestion we record the time and a one-way hash of the IP address to detect fraud. The IP address itself is not stored.
- Call-back requests (lead forms). If you ask for a call back, we collect only the details shown in the form (for example name, mobile number, city), only after you tick the consent box, which names the company that will contact you. We record the consent text and time, send your details to that company only, and delete them from IndicAds 30 days after your request. If the form asks to verify your mobile number we send a one-time code by SMS; the code is stored only as a one-way hash for up to 10 minutes.
- We do not build profiles, track you across apps or websites, use cookies on end users, or sell personal data.
2. Publishers and advertisers
For your account we process your name, work email, a hashed password, your organisation's details, billing details (legal name, address, GSTIN, PAN, UPI ID), payment records, support messages and security logs (sign-in times, hashed IP addresses). We use them to run your account, pay or invoice you, meet tax and accounting law, prevent fraud, and contact you about your account. We keep billing and tax records for 8 years as required by law; other account data for as long as your account is open and up to 1 year after it closes.
3. Who we share data with
| Recipient | What | Why |
|---|---|---|
| The advertiser you chose | Call-back details you consented to share | To contact you |
| SMS provider [MSG91] | Mobile number and one-time code | Phone verification |
| Email provider [Resend] | Account emails | Sign-in, notices |
| Payment provider [RazorpayX / bank] | Publisher name, UPI ID, amount | Payouts |
| Hosting provider [NAME, REGION] | All data we hold | Running the service |
| Authorities | As required by law | Legal obligations |
Our service providers process data only on our instructions under written contracts.
4. Your rights
You can ask to access, correct or erase your personal data, withdraw consent (for a call-back request, before the advertiser contacts you), and nominate another person to exercise your rights. Withdrawing consent does not affect processing already done. Write to the Grievance Officer below; we reply within 30 days. If you are not satisfied you may complain to the Data Protection Board of India.
5. Security
Data is encrypted in transit (HTTPS). Passwords, API keys, one-time codes and IP addresses are stored only as one-way hashes. Access to personal data is limited to staff who need it. We will notify affected people and the Data Protection Board of a personal data breach as the law requires.
6. Children
IndicAds is not directed at children. Sponsored suggestions are not shown for categories unsuitable for minors, and lead forms must not be used by anyone under 18. Publishers whose apps are used by children must not send us their questions.
7. Contact and grievances
Grievance Officer: [NAME], [EMAIL e.g. grievance@indicads.in], [ADDRESS]. See Grievance redressal.
Changes: we will post updates here and email account holders about material changes.