DPDP Act Compliance

Last updated: April 2026 · Digital Personal Data Protection Act, 2023

1. Who We Are (Data Fiduciary)

AdsSarthi is operated by Webfluence Marketing Solutions, a company registered in India. We act as a Data Fiduciary as defined under Section 2(i) of the Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Data Protection Officer

• Name: Rohtash Tiwari
• Email: dpo@adssarthi.com
• Contact: hello@webfluence.in
• Response SLA: 72 hours for acknowledgement, 30 days for resolution (as required by DPDP Section 13)

3. Your Rights as a Data Principal

Under Sections 11–14 of the DPDP Act, you have the following rights:

a) Right to Information (Section 11)

You can request a summary of all personal data we hold about you, including the purposes for which it is processed and the identities of third parties with whom it has been shared.

b) Right to Correction and Erasure (Section 12)

You can request that we correct inaccurate data, complete incomplete data, or erase data no longer necessary for our stated purposes.

c) Right to Grievance Redressal (Section 13)

You can file a grievance with our Data Protection Officer. If unresolved within 30 days, you may escalate to the Data Protection Board of India (once operational per Section 18 of the Act).

d) Right to Nominate (Section 14)

In the event of your death or incapacity, you can nominate another person to exercise your rights. Contact our DPO to register a nominee.

4. How to Export Your Data

1. Sign in to your AdsSarthi dashboard
2. Go to /dashboard/privacy
3. Click "Download all my data"
4. We generate a ZIP within 72 hours containing: account info, connected ad accounts (tokens redacted), campaigns, recommendations, creatives, WhatsApp messages, landing pages, invoices
5. Download link expires 7 days after generation — download within that window

Alternative: email dpo@adssarthi.com with "Data Export Request" in the subject line.

5. How to Delete Your Account

1. Sign in to your AdsSarthi dashboard
2. Go to /dashboard/privacy
3. Click "Delete my account" → provide a reason (optional) → confirm
4. 7-day grace period — you can cancel during this window by signing back in
5. After 7 days: cascading delete of all personal data. GSTR records retained for 72 months per Indian tax law (aggregated only; no personal identifiers)

Alternative: email dpo@adssarthi.com with "Account Deletion Request" in the subject line and your registered email address.

6. Data Deletion from Third-Party Platforms

When you disconnect an ad account from AdsSarthi, we:

• Revoke our OAuth access tokens immediately
• Delete the stored tokens from our database
• Mark related campaign/insight data for deletion within 24 hours

To delete data held by the ad platforms themselves (Meta, Google, Amazon, etc.), you must contact each platform directly — AdsSarthi cannot delete data stored outside our systems.

7. Data Breach Notification

In the event of a personal data breach likely to result in significant harm, we will:

• Notify the Data Protection Board within 72 hours (Section 8(6))
• Notify affected Data Principals without undue delay via email and in-app notification
• Provide full details: nature of breach, data affected, measures taken, contact for DPO

8. Children's Data

AdsSarthi is a B2B service for businesses and advertising professionals. We do not knowingly collect data from persons below 18. If you believe a minor has provided data to us, please contact the DPO for immediate deletion (Section 9 of DPDP Act).

9. Cross-Border Data Transfers

Some processors (Anthropic, Sentry, PostHog) operate US-based infrastructure. These transfers are permitted under Section 16 of the DPDP Act since the United States is not on the Central Government's restricted countries list. Transfers are covered by Standard Contractual Clauses and enterprise Data Processing Agreements.

10. Grievance Escalation

If you are not satisfied with our response to a rights request:

1. Escalate in writing to: grievance@adssarthi.com
2. If still unresolved within 30 days, file a complaint with the Data Protection Board of India (process published at meity.gov.in/digital-personal-data-protection-act-2023)
3. You may also approach the appropriate civil court or the Information Technology Appellate Tribunal under the IT Act, 2000

11. Updates to This Statement

We will notify you of material updates to this DPDP compliance statement via email and in-app notification at least 15 days before the change takes effect.