Privacy Policy

Our role

For the advertising data you connect, we act as a Data Processor on your instructions; you are the Data Fiduciary. We never sell your data or build cross-customer profiles.

What we process

• Account & auth data — your email and a securely hashed password to sign you in.
• Connected advertising data — aggregated reach, frequency, impressions and spend pulled from the ad platforms you link, used solely to produce your reconciliations and plans.
• Access tokens — credentials for connected platforms, encrypted at rest (AES-256-GCM) with keys held outside the database.

What we do not do

• We do not sell or share your data with advertisers or data brokers.
• We do not combine one customer's data with another's.
• We do not place your personal data in URLs or third-party analytics we don't control.

Sub-processors

We use a limited set of infrastructure and connectivity sub-processors to run the Service (hosting, and an ads-API connectivity layer that brokers platform connections on your behalf). Each is bound to process data only to provide the Service.

Retention

We keep connected data only as long as needed to provide your reconciliations, or until you disconnect an account or delete your workspace.

Your rights (DPDP)

Consistent with India's Digital Personal Data Protection Act, you may request access to, correction of, or erasure of your personal data, and withdraw consent for connected accounts by disconnecting them. Contact us to exercise these rights.

Security

Encryption in transit (TLS) and at rest, least-privilege access, rate limiting, and hardened endpoints. No system is perfectly secure, but we hold advertising credentials to a high bar.

Contact

Privacy questions or requests: legal@starvoxlabs.io.