Privacy Policy
Last updated: 2026-11-08
Last updated: 8 November 2026
This policy explains what personal data DPA.ad collects, why, who we share it with, and the rights you have. DPA.ad is a trading name of Mohammed Salim, a sole proprietorship registered in India, Manjeri, Malappuram, Kerala, India ("DPA", "we", "us"). We decide how this data is used, which makes us the data controller (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023).
DPA is a tool for businesses. Most of what we handle is product data, not personal data. Where we do handle personal data, this policy applies.
1. What we collect
Your account
- Name, email address, and password (stored only as a secure hash), or the profile Google, Apple or Facebook sends us if you sign in with them.
- Your business name, store address and language settings.
Your store, through Salla, Shopify or a feed file
- Products: titles, descriptions, prices, stock, images, variants, categories and reviews.
- Order lines from the last 30 days, read only to count how many of each product sold. We use the product and quantity. We do not store your shoppers' names, emails, phone numbers or addresses.
- The store's access tokens, so the import keeps running.
Your ad accounts, when you connect them
- Access tokens for Snapchat, TikTok, Meta and Google.
- Ad results: spend, impressions, clicks, add-to-carts and purchases, by campaign and product. These are totals, not data about individual people.
Billing
- Payments go through Dodo Payments, our merchant of record. Dodo Payments collects your card details; we never see or store your card number. We receive your name, email, country, the plan you bought, and payment and refund status.
Use of the service
- What you generate and publish, credit use, and error logs, so we can bill correctly, fix problems and prevent abuse.
- Basic technical data such as IP address, browser and device type, kept in server logs.
When you contact us
- Whatever you send to support@dpa.ad or info@dpa.ad.
2. Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Run your account and the service: import, feeds, creatives, reports | Account, store, ad account data | Contract with you |
| Bill you and keep tax records | Billing data | Contract; legal obligation |
| Keep the service secure, stop abuse, fix errors | Usage and log data | Legitimate interest; legal obligation |
| Tell you about your account: renewals, failed payments, limits, changes to terms | Contract | |
| Product news and offers | Your consent; you can opt out at any time |
We do not sell personal data. We do not use your store data or your creatives to train AI models, and we choose AI providers whose business terms say they will not train on it either. [CHECK: paid API tier on every key]
3. Who we share it with
We share data only with the service providers we need to run DPA, and only what each needs:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, background jobs | EU (Stockholm, Sweden) |
| Google Cloud | Rendering images and videos | EU (Finland) |
| Vercel | Hosting the app and website | Global edge network |
| Dodo Payments | Payments, tax, refunds | See Dodo Payments' privacy policy |
| Google (Gemini), OpenAI, Anthropic | Generating and checking images and ad copy | United States |
| fal.ai | Generating videos | United States |
| Salla, Shopify | Reading your catalogue, at your request | Their own regions |
| Snapchat, TikTok, Meta, Google, Pinterest | Receiving your feeds and returning ad results, at your request | Their own regions |
If you add your own AI provider key, the provider you chose processes that work under your own agreement with them.
We also disclose data when the law requires it, to protect our rights or users' safety, or to a buyer if the business is sold (we would tell you first).
4. International transfers
We are based in India, our main data store is in the EU, and some providers are in the United States. When data moves between countries, we rely on our providers' contractual safeguards, such as the EU Standard Contractual Clauses. If you are in Saudi Arabia, the UAE or another country with transfer rules, we transfer data only as those rules allow.
5. How long we keep it
- Account, store and creative data: while your account is open. When you delete your account, we delete it within 30 days. Backups roll off within a further 30 days.
- Ad results: while your account is open, then deleted with it.
- Billing and tax records: as long as tax law requires (up to 8 years in India).
- Server logs: up to 90 days.
6. Your rights
Wherever you are, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it, unless we must keep it by law;
- stop using it for marketing;
- withdraw consent you gave, without affecting what we did before;
- send it to you, or to another service, in a common format.
Depending on where you live, you may have further rights under India's DPDP Act, Saudi Arabia's Personal Data Protection Law, the UAE's data protection law, or the GDPR. You can also complain to your local data protection authority.
Write to support@dpa.ad. We reply within 30 days. We may ask you to confirm who you are first.
7. Grievance officer
Under Indian law, our grievance officer is:
Mohammed Salim info@dpa.ad Manjeri, Malappuram, Kerala, India
We acknowledge a complaint within 7 days and aim to resolve it within 30 days.
8. Security
Data is encrypted in transit and at rest. Store and ad-account tokens are kept server-side and never sent to your browser. Access to production systems is restricted to the people who run the service. No system is perfectly secure. If a breach puts your data at risk, we tell you and the authorities as the law requires.
9. Your shoppers' data
If your shoppers' data reaches us through your store, you are the controller of that data and we process it for you. We use only order line quantities, as described in section 1, and do not keep shopper identities.
10. Children
DPA is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.
11. Cookies
See our Cookie Policy.
12. Changes
If we change this policy in a way that matters, we tell you by email or in the app before it applies. The date at the top shows the latest version.
13. Contact
Mohammed Salim (DPA.ad), Manjeri, Malappuram, Kerala, India support@dpa.ad · info@dpa.ad