Privacy Policy

AdGuru, available at https://adguru.tech, is operated by WIN Legal Advisors, a division of World of Willpower Private Limited, A1/202, Samruddhi CHS, Kumbhare Park, Kothrud, Pune, Maharashtra, India 411038 (Registered Office). For your account, billing and usage data we are the Data Fiduciary. For audience data you upload about your own customers, you are the Data Fiduciary and we act as your Data Processor, following your instructions. Contact: vrushali@winlegaladvisors.com, care@worldofwillpower.com, or WhatsApp +918808748088.

• Account data — name, email, organisation, role and optional phone, to create and secure your account.
• Authentication data — passwords are stored by our authentication provider only as a salted one-way hash (sensitive personal data under Rule 3(i) of the SPDI Rules, 2011). With Google sign-in we receive your name, email and Google account identifier; no password reaches us.
• Purchase and invoice data — plan, amount, GST, payment reference, status and billing details, to process payment and issue tax invoices. Card, UPI and netbanking details are entered directly with our payment provider (Cashfree) and never reach us.
• Audience data you upload — names, emails, phone numbers and location fields, used only to validate, normalise and activate audiences on the advertising platforms you choose. The data-source declaration you give is recorded with organisation, user, timestamp and version; it is a record, not proof of compliance.
• Creatives, ad-account connection metadata, campaign configuration and platform-reported metrics, to run the service you asked for.
• Support, data-rights and grievance tickets, to respond to you.
• Technical and security logs — IP address, browser type and timestamps, to secure the service, prevent fraud and trial abuse, and meet the CERT-In directions of 28 April 2022.
• Optional analytics — only if you accept optional cookies, stopped the moment you withdraw consent.

Apart from passwords we do not ask for sensitive personal data such as financial credentials, health or biometric data, and you should not upload it.

For account creation and optional analytics we rely on free, specific, informed and unambiguous consent given at the point of collection, and we keep a record of each consent. Security logging is carried out to comply with the CERT-In directions, a legal obligation; we do not claim any broader exemption under Section 7 of the DPDP Act. Invoice and tax records are kept because the law requires them. For uploaded audiences, you must confirm you hold a lawful basis to use that data for advertising.

You may withdraw consent at any time through Cookie preferences, by writing to vrushali@winlegaladvisors.com, or by deleting your account. Withdrawal is as easy as giving consent and does not affect processing already carried out.

The DPDP Act, 2023 and DPDP Rules, 2025 come into force in phases: Board provisions on 13 November 2025, consent-manager provisions on 13 November 2026, and the principal notice, consent, fiduciary-duty and Data Principal rights provisions on 13 May 2027. Until a provision is operative, the corresponding statement is our readiness commitment rather than a claim that the duty is already in force.

We do not sell personal data and do not build cross-customer profiles.

• Processor — cloud hosting, database, storage and authentication provider.
• Processor — AI model provider, which receives campaign and quality metadata, not raw personal audience records. Data is not used to train third-party models.
• Processor — email delivery provider.
• Processor — analytics provider, only if you accept optional cookies.
• Independent recipient — Cashfree Payments, which processes payments under its own regulatory obligations.
• Independent recipients — the advertising platforms you connect (Google, YouTube through Google Ads, Meta, LinkedIn), which receive audience and campaign data through their official APIs using your own authorised accounts, under their own terms.
• Independent recipient — Google, if you sign in with Google.
• Courts, regulators or lawfully authorised government agencies where the law requires.

Transfers outside India are made only to countries not restricted under Section 16 of the DPDP Act and under written contracts requiring equivalent protection, as Rule 7 of the SPDI Rules, 2011 requires.

AI reviews creatives, audience quality and campaigns and drafts recommendations. Its output is an automated suggestion, not a guarantee of platform approval, reach or results. AI never spends money or launches a campaign — you approve every activation. We do not use AI to make decisions producing a legal effect for you. This follows the MeitY India AI Governance Guidelines (5 November 2025), which are guidance rather than binding rules.

• Account and profile data — while your account is active; erased when you delete it.
• Audience files and records, creatives and campaigns — while your organisation keeps them; deleted on request or account closure.
• Security and technical logs — 180 days on systems located in India, as the CERT-In directions require.
• Consent records — life of the account plus 1 year.
• Invoices, payment references and tax records — 8 years, as tax and company law require.

On account deletion, removable live records are erased and processors are instructed to delete their copies; encrypted backups age out within 30 days. Records the law requires us to keep are moved to a restricted archive not accessible through any customer login.

• Access a summary of your personal data and how it is processed (Section 11).
• Correction, completion, updating and erasure (Section 12).
• Grievance redressal through our Grievance Officer (Section 13).
• Nominate another individual to exercise your rights on death or incapacity (Section 14).

Use the Privacy & Data Rights Centre or write to care@worldofwillpower.com, in English, Marathi or Hindi; we reply in the language you write in. As our service commitment we respond within 30 days, usually much sooner. If unsatisfied, raise it with our Grievance Officer; the Data Protection Board of India (established 13 November 2025) route becomes available in line with phased commencement.

The service is not intended for anyone under 18. We do not knowingly process children's data, and you must not upload audience data relating to children or use AdGuru for tracking, behavioural monitoring or targeted advertising directed at children, as prohibited by Section 9 of the DPDP Act.

We use encryption in transit, access controls, row-level database isolation so each organisation reads only its own records, private file storage, least-privilege credentials and an internal security policy reviewed at least yearly — reasonable security practices under Rule 8 of the SPDI Rules, 2011. We do not claim any certification we do not hold.

• Server logs retained 180 days in India, clocks synchronised to NIC or NPL time.
• A named CERT-In point of contact; reportable incidents reported within 6 hours.
• Personal data breaches notified to affected users without delay in plain language, and to the Data Protection Board with a detailed report within 72 hours, once that provision is in force.
• Processors are contractually required to tell us of any incident immediately.

Vrushali Thorat, Attorney and Solicitor, Grievance Officer, A1/202, Samruddhi CHS, Kumbhare Park, Kothrud, Pune, Maharashtra, India 411038 (Registered Office). Email: vrushali@winlegaladvisors.com. We acknowledge every complaint within 24 hours and resolve it within 7 days, with shorter periods on the Grievance Officer page.

We post any change on this page and, where significant, notify you by email before it takes effect.