Skip to main content

Early access: we are opening to a small group of businesses and agencies first.

AI Marketing Master
Menu

Version 2026-10-29

Privacy Policy

Last updated: 29 October 2026. Version: 2026-10-29.

1. About this policy

This policy explains how Shivah Web Tech Private Limited ("we", "us") handles personal data in AI Marketing Master ("the Service") and on our public website.

  • Offices: Mohali, Punjab, India, and Troy, Michigan, USA.
  • Email: dev@shivahwebtech.com
  • Phone: +91 85808 92163

We wrote it in plain English. If something is unclear, please ask us. Section 14 explains what we do with data we receive from Google, Facebook and Instagram.

2. Our two roles

We handle personal data in two different ways.

  • Our own customers and visitors. For your sign-in account, billing, support, security and our website, we decide how the data is used. Under India's Digital Personal Data Protection Act 2023 (DPDP Act) we act as a "Data Fiduciary". Under the EU or UK GDPR this is called a "controller".
  • Data you put into the Service about other people. Examples: your leads, your clients' contact details, comments on your social media posts, and reviews of your business. Here you (our customer) decide why the data is used. We handle it on your behalf to provide the Service. Under the DPDP Act we act as a "Data Processor". Under GDPR, a "processor". If you are one of our customers' leads or customers, please contact that business first. We will help them answer you.

3. What we collect

Account and sign-in

  • Name, email address and password. The password is stored only as a secure hash.
  • Two-factor sign-in settings and passkeys, if you turn them on.
  • Your role in each workspace, and team invitations (the invited email address).
  • Your WhatsApp number and the time you opted in, only if you choose WhatsApp notifications.
  • Notification and email choices.

Business and workspace details

  • Business name, website, address, phone, email, services, audience, brand colours, logo and language.
  • Your Business Profile and the facts and claims you approve (for example prices, offers and service areas).
  • Clients you manage, if you are an agency.

Content and files

  • Drafts, posts, pages, blogs, ads, landing pages, reports, calendars and their versions.
  • Quality check results, approvals (who decided, when, and from which IP address), publishing and verification records.
  • Files you upload: images, videos, music, documents and logos.
  • Your conversations with our assistant (Milo). If you use voice, your words are turned into text and saved like a typed message.

Connected accounts

  • When you connect an outside account (for example Facebook, Instagram, LinkedIn, YouTube, X, Google, WordPress, Shopify, GitHub or HubSpot), we store the account name and ID and the access token or password. Tokens and passwords are stored encrypted.
  • We read data from those accounts that the feature needs. Examples: post results, Search Console and Analytics figures (read-only), Google Business Profile reviews, ad results, comments on your posts, and Messenger and Instagram conversation summaries.

Leads and other people's data (we act for you)

  • Leads from your website forms, landing pages, Meta lead ads and Google Ads lead forms: name, email, phone, message, source, campaign, and any consent text shown on the form.
  • Comments, reviews and messages from people who interact with your social and business accounts.

Billing

  • Billing name, address, state, GSTIN (if you give one), currency, plan and payment history.
  • Payment references from the payment provider. We never receive or store your full card number. You enter card or bank details on the provider's own page.
  • Refund requests and their reasons.

Security, fraud prevention and usage

  • An audit log of important actions. Each entry records the action, the user, the time, the IP address and the browser type.
  • Session records, including IP address and browser type, while you are signed in.
  • A keyed hash of the IP address used at sign-up. We use it to spot many sign-ups from one network. We do not store that IP address itself.
  • How much of your plan and credits you use, and the cost of AI work.

Before you sign up

  • If you start our setup before signing up, we keep your answers (for example your website address and goals) in a draft linked to a cookie for 7 days. We store a keyed hash of your IP address to limit misuse.
  • To make a first preview, we may read your public website and send your business details to an AI provider.

Our public website

  • Contact form: name, email, phone, company, website, message and IP address.
  • "Report this page" form on landing pages: the reason, details, and your email if you give it. We store a keyed hash of your IP address to stop repeated reports.
  • We count how many people reach each step of sign-up. We store only a keyed hash, so nobody can be identified from these counts.
  • We do not use advertising or analytics trackers on our own website or app. See our Cookie Policy.

Notifications on your devices

  • If you turn on browser notifications, we store your browser's push address and keys. The keys are stored encrypted.

4. Why we use personal data

  • To create and run your account and workspaces.
  • To do the work you ask for: write, check, approve, publish, verify, report and manage leads.
  • To send you service messages: approvals, reminders, problems, receipts, invoices and security alerts. We use email, WhatsApp (only if you opted in) and browser notifications (only if you turned them on).
  • To take payments, issue GST invoices, handle refunds and chargebacks, and keep accounting records.
  • To keep the Service secure, prevent fraud and abuse of free trials and credits, and investigate reports.
  • To support you when you contact us.
  • To meet legal duties, such as tax law and lawful requests from authorities.
  • To improve the Service using usage counts and costs.

We do not sell personal data. We do not use your data to build advertising profiles.

5. AI processing

The Service sends data to outside AI providers to do its work. This is how it works today:

  • Text: writing, checking, planning, research and the assistant may use xAI (Grok), Perplexity, Anthropic (Claude), OpenAI, Google (Gemini) or OpenRouter. Which ones are used depends on our settings. If one provider is unavailable, the request may go to the next one.
  • Images: OpenAI or Google (Gemini).
  • Video: OpenAI.
  • Voice (optional): OpenAI turns your speech into text and Milo's answer into speech. We do not keep the audio recording. The text is saved in your conversation.

What we send is what the task needs. This can include your business details, approved facts, drafts, the text you type, and the text of social media comments we help you answer. It can include personal data if it is part of that content.

  • We do not train our own AI models on your data.
  • Each AI provider handles data under its own terms.
  • Please do not put sensitive personal data into prompts or content.

6. Who we share data with

We share personal data only as needed to run the Service:

  • Hosting: our servers and database are hosted by Hostinger, in the data centre our hosting plan uses. Email us if you need to know where it is.
  • File storage: files are stored on our server. If we turn on Cloudflare R2 or Amazon S3 storage, the files of that business are stored there instead, and the provider works for us. We will update this policy before we do.
  • Email: we send email through our email provider (currently Hostinger email).
  • Payments: Razorpay or Cashfree (Indian rupees) and Stripe (other currencies).
  • Bot protection: Cloudflare Turnstile on sign-up and contact forms, when switched on.
  • WhatsApp: Meta's WhatsApp Business Platform, for notifications you opted in to.
  • Browser notifications: your browser's push service (for example Google, Mozilla, Apple or Microsoft).
  • AI providers: listed in section 5.
  • Website speed checks: Google PageSpeed Insights and Chrome UX Report receive your website address.
  • Platforms you connect: we send content and data to the accounts you connect, when you ask us to (for example to publish a post).
  • HubSpot: if you connect HubSpot, new and changed leads are copied to your own HubSpot account. Nothing is read back or deleted there.
  • Meta Conversions API: if someone with the right permission turns it on and confirms their own privacy notice, website-form leads are sent to Meta as a "Lead" event. Email and phone are normalised and hashed (SHA-256) before sending. It is off by default.
  • Your agency or your team: people in your workspace see data according to their role. If an agency manages your marketing, the agency can see your client data.
  • Authorities and legal claims: when the law requires it, or to protect our rights, users or the public.
  • A buyer of our business: if we merge or sell the business, data may pass to the new owner under the same protections.

The providers named in this section are the companies that process data for us. We change this section when we add or replace one, and the date at the top shows when it last changed. Business customers can email us for the list at any time.

7. Data outside India

Some providers process data outside India, including in the United States and other countries. This includes AI providers, Stripe, Cloudflare, Meta and Google. We choose providers that publish their security and data protection terms, and we send them only the data a task needs. If you need to know which provider received your data, email us.

8. How long we keep data

  • Workspace data: while the workspace exists. After an owner asks for deletion, there is a 30-day grace period, then we delete the workspace's records and files, including its audit log and message logs.
  • Your personal sign-in account: you can delete it in Settings. Your user record is deleted at once. If you are the only owner of a workspace, you must first delete that workspace (30-day grace period) or make someone else an owner, so a business is never left without an owner. Actions you took in a workspace stay in that workspace's audit log, without the link to your account, until that workspace is deleted.
  • Backups: we make a daily database backup and keep 14 days of them. Our hosting provider also keeps its own backups. Deleted data stays in backups until they roll off on their own schedule. How long Hostinger keeps its own backups depends on its plan, and we do not control it.
  • GST invoices: kept after a workspace is deleted, for 8 years after the end of the financial year, as Indian tax law requires. Then deleted.
  • Export files: the download is available for 7 days.
  • Leads: kept until you delete them, or until the workspace is deleted. We can switch on automatic deletion of leads with no activity after a number of days we set. It is not on by default.
  • Setup drafts before sign-up: the cookie lasts 7 days. A draft nobody signed up with is deleted from our server 30 days after it was started.
  • Contact form messages and page reports: a message we have answered, or a page report we have closed, can be deleted automatically after a set period. A message nobody has answered and an open report are never deleted by this. Automatic deletion is not on by default, so until we set a period they are kept.
  • Sign-in sessions: end after 2 hours without activity, or when you sign out.
  • Browser notification addresses: until you turn them off, or after repeated failed sends.

9. How we protect data

  • Passwords are hashed. Tokens, passwords and keys for connected accounts are encrypted.
  • Each workspace's data is kept separate, and permissions are checked on our servers.
  • Our staff must use two-factor sign-in to reach our admin area. Staff roles limit what each person can see and do.
  • Approval links are single-use, expire, and never sign anyone in.
  • Files are stored privately and served only after a permission check.
  • Payment webhooks are checked with the provider's signature.

No system is perfectly secure. If a personal data breach happens, we will tell the people and authorities the law requires. This includes telling CERT-In and the Data Protection Board of India, and the authorities of other countries, within the time their rules set.

10. Your rights and choices

You can:

  • See and correct your account and business details in Settings.
  • Export workspace data (owners).
  • Delete your workspace (owners) or your personal account.
  • Turn off some emails, WhatsApp messages and browser notifications in Settings.
  • Withdraw consent where we rely on consent. This does not affect what was done before.
  • Complain to our Grievance Officer (section 13).

Under the DPDP Act you also have the right to a summary of your personal data and how it is processed, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person to act for you if you die or cannot act.

If GDPR or UK GDPR applies to you, you may also have rights to restrict or object to processing, to data portability, and to complain to your data protection authority.

If California law (CCPA/CPRA) applies, you have rights to know, delete and correct, and to not be treated differently for using them. We do not sell or "share" personal data for cross-context behavioural advertising.

To use a right, email dev@shivahwebtech.com. We may need to check your identity first.

11. Children

The Service is for businesses. It is not directed at children, and we do not knowingly collect children's personal data. Customers must not upload children's data. If you think a child's data is in the Service, contact us and we will delete it.

12. Changes to this policy

We will post the new version here with a new date. If a change is important, we will tell you by email or in the app.

13. Grievance Officer and contact

  • Name: Kamal Dev
  • Designation: CEO and Co-Founder, Shivah Web Tech Private Limited
  • Address: Shivah Web Tech Private Limited, Mohali, Punjab, India
  • Email: dev@shivahwebtech.com
  • Phone: +91 85808 92163

We will acknowledge your complaint within 2 business days and answer within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it accepts complaints.

14. Google, Facebook and Instagram data

Google user data

AI Marketing Master's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We ask Google for access only when you choose to connect a Google service and press Allow on Google's own screen. This is what we ask for and why:

  • Sign in with Google (your Google email address and account ID): to sign you in and match you to your account.
  • Google Business Profile (manage your business listings): to show the locations you choose, check how complete the profile is, show reviews and results, and publish posts and replies that you approve.
  • Google Search Console and Google Analytics (read only): to show your website's search and visitor figures in your reports and to suggest what to improve.
  • YouTube (upload videos, read channel results): to upload videos that you approve to your channel and to show how they perform.
  • Google Ads (campaign results and campaigns you authorise): to show your ad results and to prepare or change campaigns only after you authorise it.

How we use Google user data:

  • We use it only to give you the features above inside AI Marketing Master. We do not use it for any other purpose.
  • We do not sell it. We do not use it for advertising, and we do not use it to build profiles for advertising.
  • We do not transfer it to anyone else, except: to the service providers we need to run the feature you asked for (for example our hosting provider, and an AI provider that writes a reply or a summary for you, which receives only the text of that task); when the law requires it; and to keep the Service secure.
  • We do not use Google user data to develop, improve or train generalised AI or machine learning models.
  • No person at our company reads your Google user data, unless you ask us for support and agree, we need to investigate abuse or a security problem, or the law requires it.

How we protect it: access tokens are stored encrypted, data is kept in our database with the protections in section 9, and only the people you gave a role in your workspace can see it.

How long we keep it, and how to remove it:

  • You can disconnect any Google service at any time in Connections. We then delete the access token at once and stop reading your data.
  • Data we already saved in your workspace (for example a report or a saved review) is kept until you delete it, you delete the workspace, or you ask us to delete it.
  • You can also remove our access in your Google account at https://myaccount.google.com/permissions.
  • To have your data deleted, follow our data deletion page or email dev@shivahwebtech.com.

Facebook and Instagram data

When you connect a Facebook Page or an Instagram professional account, Meta gives us the Page or account name and ID, an access token, and the data needed for the features you use: your posts and their results, and, if you turn those features on, comments and the answers on your lead forms. We use it only to show it to you, to publish what you approve, and to report results. We do not sell it and we do not use it for advertising. You can disconnect in Connections, which deletes the token, or remove the app in your Facebook settings under Apps and Websites. How to ask us to delete your data is on our data deletion page.