Privacy Policy

ADSCRUSH MARKETING PRIVATE LIMITED (CIN: U74999DL2020PTC372599) (“AdsCrush”, “we”, “us”) is the Data Fiduciarywith respect to the personal data processed through the AdsCrush conversion tracking and performance marketing platform (the “Services”).

This Privacy Policy describes what personal data we collect, why we collect it, how we use and share it, your rights as a Data Principalunder the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), and how to exercise those rights. By using the Services, you consent to the processing described in this policy, to the extent consent is the legal basis relied upon.

• Personal Data means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act.
• Data Principal means the individual to whom the personal data relates.
• Data Fiduciary means any person who alone or in conjunction with others determines the purpose and means of processing of personal data.
• Data Processor means any person who processes personal data on behalf of a Data Fiduciary.

Account data. When you create an account, we collect your name, email address, password (stored as a salted, hashed value), role, and any profile information you provide.

Usage data. We collect information about how you interact with the Services, including pages visited, features used, and actions taken.

Tracking and conversion data. Where you use the Services to track clicks, conversions, and leads, we process data relating to those events on your behalf as a Data Processor — see our Data Processing Agreement. This may include identifiers generated by our tracking system, referrer URLs, and, for lead intake, phone numbers or email addresses you collect from your end users.

Technical data. We automatically collect IP addresses, user agent strings, device and browser information, and network information (such as ISP and geographic region) for attribution, fraud prevention, and security purposes. IP addresses and user agents are hashed or encrypted before storage wherever technically feasible.

Cookies and similar technologies. We use cookies and local storage for authentication, session management, and preferences. You can configure your browser to refuse cookies, but some parts of the Services may not function properly without them.

We use personal data for the following purposes:

• Providing, operating, and maintaining the Services;
• Authenticating users and managing accounts, roles, and permissions;
• Processing clicks, conversions, and leads and generating reports and analytics for you;
• Preventing fraud, abuse, and security incidents, and protecting the integrity of the Services;
• Communicating with you about the Services, including support and service notices;
• Complying with legal obligations, including the Information Technology Act, 2000 and CERT-In incident reporting requirements; and
• Improving the Services, including troubleshooting and product development.

We process personal data on the following bases, in accordance with the DPDP Act:

• Consent — where you have provided your consent, which you may withdraw at any time;
• Contract — where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract;
• Legal obligations — where processing is required for compliance with Indian law, including the DPDP Act and the Information Technology Act, 2000;
• Legitimate uses — including fraud prevention, security, and network and information security, as specified under the DPDP Act.

We do not sell your personal data. We share personal data only in the following circumstances:

• Data Processors. With service providers who process personal data on our behalf and under our instructions, such as hosting and infrastructure providers, CDN providers, email delivery services, and analytics providers. These processors are bound by written contracts requiring them to protect personal data.
• Legal compliance. Where required by law, regulation, or legal process, or where necessary to protect our rights, safety, or property, including reporting security incidents to CERT-In as required.
• Business transfers. In connection with a merger, acquisition, reorganisation, or sale of assets, provided the recipient is bound by obligations consistent with this policy.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, to comply with legal obligations (including CERT-In log retention requirements), and to resolve disputes. When you close your account, we will delete or anonymise your personal data within a reasonable period, except where law requires retention.

We implement reasonable security safeguards to protect personal data, including encryption in transit (TLS), encrypted session cookies, hashed passwords, role-based access controls, server-side input validation, and monitoring of our systems. While no system is completely secure, we take reasonable steps to prevent personal data breaches.

Under the DPDP Act, you have the following rights with respect to your personal data:

• Right to access — to obtain a summary of your personal data being processed and the purposes of processing;
• Right to correction and erasure — to correct or complete inaccurate or misleading personal data and, where appropriate, to erase it;
• Right to grievance redressal — to raise grievances through our Grievance Officer; and
• Right to withdraw consent — to withdraw consent previously given for the processing of your personal data.

To exercise any of these rights, contact our Grievance Officer at grievance@adscrush.com. We will respond within the timelines prescribed by law. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

In the event of a personal data breach, we will intimate the Data Protection Board of India and affected Data Principals in the form and manner prescribed under the DPDP Act and Rules. We will also report security incidents to CERT-In within the timelines required by applicable directions, and notify affected customers promptly where their data is involved.

The Services are not directed to children. We do not knowingly process personal data of children without the consent of a parent or lawful guardian, and we will delete such data upon being notified.

Where we transfer personal data outside India, we do so in accordance with the DPDP Act, including through contractual safeguards and by engaging processors who are bound by equivalent obligations.

As required under the DPDP Act and Rules and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer. Grievances, requests, or complaints may be addressed to:

Grievance Officer
ADSCRUSH MARKETING PRIVATE LIMITED
New Delhi, India
Email: grievance@adscrush.com

We acknowledge grievances and respond within the timelines prescribed by law (generally within 15 days, or as otherwise specified).

We may update this Privacy Policy from time to time. Material changes will be notified by email or by posting a notice in the Services, and the “Last updated” date above will be revised. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.

Questions about this Privacy Policy may be directed to privacy@adscrush.com or to our Grievance Officer at grievance@adscrush.com.