Privacy Policy

This policy explains what personal data we collect when you use the Advinky website and application, why we collect it, who we share it with, and what you can ask us to do about it. It sits alongside our Terms of Service.

We are the controller of the data described here. Where you upload material about your own customers or employees into a workspace, you are the controller of that material and we process it for you as described in section 03.

You give us

• Account data — name, email address, password hash, and the workspaces you belong to.
• Brand inputs — the website address you submit for analysis, brand name, industry, audience selections, prompts, scripts and briefs.
• Uploaded assets — logos, product screenshots, images, video, audio and documents you add to a brand asset library. These can contain personal data, including images and voices of identifiable people, if you upload them.
• Support and feedback — what you send us when you report a problem, including the specific generation you were unhappy with if you attach it.

We generate

• Output — the videos, images and copy the Service produces for you, and the edit history of the projects you build from them.
• Brand DNA — the structured profile we derive from the website you submitted, including extracted colours, imagery, competitor names and tone-of-voice notes.
• Usage records — credits consumed, features used, generations run and their status.

We collect automatically

• Technical data — IP address, device and browser type, operating system, approximate location derived from IP, timestamps, referring pages and error logs.
• Cookies and similar — see section 11.

We receive from others

• Payment data — our payment provider confirms the outcome of a transaction and gives us the last four digits and card type. We never see or store your full card number.
• Public web content — the content of the website address you asked us to analyse, fetched at the time you asked.

• To run the Service — authenticate you, build your Brand DNA, generate and store creative, meter credits, and keep your projects available.
• To bill you — process payments, apply plan limits, issue invoices and keep the tax records we are required to keep.
• To support you — answer questions, investigate a bad output, and restore something you lost.
• To keep the Service safe and working — detect abuse, fraud and automated over-use, enforce our Acceptable Use rules, and diagnose faults.
• To improve the product — understand which features are used and where generations fail, using aggregated and de-identified usage data wherever it will do the job.
• To communicate — service notices, security alerts, billing messages and, if you opt in, product news. You can unsubscribe from marketing at any time; service and billing notices are part of holding an account.
• To meet legal obligations — respond to lawful requests, and keep records we are required to keep.

Two narrow exceptions, both of which you trigger deliberately: content you send us as feedback may be reviewed by a human at Advinky to diagnose and fix a specific problem; and content flagged by our safety systems may be reviewed to investigate a suspected breach of the Acceptable Use rules. Neither becomes training data.

We do use aggregated, de-identified statistics — for example, how often a particular format fails to render — to improve the product. These cannot be traced back to you or your brand.

Where the GDPR or a similar regime applies, we rely on: performance of a contract to provide the Service and bill you; legitimate interests to keep the Service secure, prevent abuse and improve the product; consent for optional marketing and non-essential cookies, which you can withdraw at any time; and legal obligation for tax, accounting and lawful requests.

Where India's Digital Personal Data Protection Act applies, we process personal data for the lawful purposes described above on the basis of your consent, or for a legitimate use permitted by that Act, and we give you this notice so that consent is informed.

We do not sell personal data. We share it only in these situations:

• Your workspace — content created in a workspace is visible to that workspace's members and owner. Adding someone to a workspace gives them access to what is in it.
• Service providers (sub-processors) acting on our instructions, by category: cloud hosting and object storage; AI model providers who run generations; the payment processor; transactional email; error monitoring and product analytics; customer support tooling. A current named list is available on request.
• Professional advisers — auditors, lawyers and insurers, under confidentiality.
• Authorities — where we are legally required, or to establish or defend legal claims. We assess each request, and push back on requests that are overbroad or improperly made.
• A successor — if we are involved in a merger, acquisition or asset sale, under equivalent protections. We will tell you before your data becomes subject to a different policy.

We are based in India, and some of our providers — particularly AI model providers and cloud hosting — operate outside it. That means your data may be processed in a country with different data-protection law from your own.

Where we transfer data out of a region that restricts it, we rely on an appropriate safeguard: an adequacy decision where one exists, or Standard Contractual Clauses with supplementary technical and organisational measures. You can ask us which mechanism applies to a given provider at hello@advinky.com.

• Account and workspace data — while your account is open, then deleted or anonymised after a short export window.
• Brand assets and Output — until you delete them, or until your account closes. Archived assets remain recoverable by you until you delete them permanently.
• Prompts and generation records — kept while they are useful to you in the product, then reduced to usage statistics.
• Billing records — for as long as tax and company law requires, which is longer than your account lives.
• Security and abuse logs — a limited period appropriate to investigating incidents.

Deleting something removes it from the product immediately; it can persist in encrypted backups for a short rolling period before those expire. If you need something erased on a specific timetable, write to us.

We use encryption in transit, encryption at rest for stored assets, access control on a need-to-know basis inside our team, audit logging, and regular dependency and infrastructure patching. Passwords are stored only as salted hashes.

No system is perfectly secure. If a breach affects your personal data and is likely to cause you harm, we will notify you and the relevant authority within the timeframes the law requires. Please report anything you spot to hello@advinky.com — we would much rather hear it from you.

Depending on where you live, you can ask us to:

• Access the personal data we hold about you, and get a copy.
• Correct anything inaccurate or incomplete.
• Delete your data, where we are not required to keep it.
• Port it — receive it in a structured, machine-readable format, or have it sent onward.
• Restrict or object to processing based on our legitimate interests, including profiling.
• Withdraw consent you previously gave, without affecting what was lawful before you withdrew it.
• Nominate someone to exercise these rights for you if you are unable to, where the law provides for it.

Write to hello@advinky.com. We will verify who you are, respond within 30 days, and tell you if we need longer and why. There is no charge for a reasonable request. If you are unhappy with our response, escalate to our Grievance Officer — see section 14 — and you may also complain to your data-protection authority.

We use a small number of cookies and similar technologies:

• Essential — sign-in sessions, security tokens and your interface preferences. The Service does not work without these, so they are set without consent.
• Analytics — with your permission, Google Analytics measures page visits and feature use. We exclude emails, prompts, uploaded content, and private identifiers from the events we send.

We do not use advertising or cross-site tracking cookies, and we do not run third-party ad pixels on the application. Where consent is required for non-essential cookies we ask for it first, and you can change your mind. Your browser can also block or clear cookies, though blocking essential ones will break sign-in.

The Service is for business use by adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, write to us and we will delete it. Do not upload images, video or voice recordings of children as brand assets.

We will update this policy as the product changes. If a change materially affects how we handle your personal data, we will notify you in the product or by email before it takes effect, and the “last updated” date at the top of this page will change. Material changes that require your consent will be asked for, not assumed.

For anything about this policy or your personal data, write to hello@advinky.com.

Grievance Officer. If you are not satisfied with how we have handled a privacy request, you can escalate to our Grievance Officer by email to hello@advinky.com with “Grievance” in the subject line. We will acknowledge within 7 days and respond substantively within 30.

You retain the right to complain to the data-protection authority in your jurisdiction.

Contact details

Product

Advinky

Support, privacy & legal enquiries

hello@advinky.com