Privacy Policy

Last updated 11 November 2026. This policy forms part of our Terms of Service.

1. Who we are and how to contact us

adsbot.in, its courses, the AdsBot Labs practice sandboxes, the AdsBot Waypoint tool and our agency services (together, the "Service") are provided under the trading name AdsBot. For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), AdsBot is the Data Fiduciary: we decide why and how your personal data is processed.

AdsBot is headquartered in Hyderabad, India. Email: adsbot.inc@gmail.com.

In this policy, "we", "us" and "our" mean AdsBot; "you" means anyone whose personal data we process: visitors, account holders, learners, customers, candidates and the contacts of our agency clients.

2. What this policy covers

This policy explains how we handle personal data when you:

• visit adsbot.in, read the blog or use the free tools and the Error Library;
• create an account, enrol in courses and earn certificates or credentials;
• use the AdsBot Labs: the AEP, CJA, Reporting & Journeys and Marketo Engage practice sandboxes and their studios (Web SDK Lab, Tag Studio, the phone simulator, Workspace and Journey Studio), whether you open them from your AdsBot account or with a personal login given to you by a trainer;
• buy a plan, or ask for a refund;
• use the website assistant or the AI Mentor;
• use AdsBot Waypoint to capture field-verification photos;
• take a hiring assessment, or are enrolled through a team licence by your employer;
• ask for a solution brief, a go-to-market plan or agency services, or otherwise contact us; or
• are a client (or a contact at a client) for whom we manage advertising.

It does not cover websites or services run by others that we link to (for example PayU's payment pages or Google's sign-in pages); their own privacy policies apply there.

3. Words we use

• Personal data: any data about an individual who can be identified from it, directly or together with other information.
• Processing: anything done with personal data, such as collecting, storing, using, sharing or erasing it.
• Data Principal: the person the personal data is about (you).
• Data Processor: a company that processes personal data for us under our instructions, such as our hosting provider.
• Consent: your free, specific, informed, unconditional and unambiguous agreement, given by a clear action, which you can withdraw at any time.

4. The personal data we collect

4.1 Data you give us

• Account: your name, email address and password. The password is stored only as a secure one-way hash, so nobody (including us) can read it. If you turn on two-factor authentication, we store its settings and single-use backup codes (also hashed).
• Learning: the courses you enrol in, lessons you complete, quiz and capstone submissions, and the certificates and credentials you earn.
• Practice labs: what you build in your lab workspace (for example schemas, datasets, tag rules, analysis projects and journeys), the test events you send from the practice websites and apps, and your mission progress. If a trainer gives you a personal lab login, the trainer tells us your email address, your name and which sandboxes you need.
• Payments and billing: the plan you choose, the amount, date and status of each payment, PayU's payment reference, the payment method type PayU reports (such as UPI or card), and the checkout confirmation and consent you gave. Your mobile number is passed to PayU for the payment confirmation. If you choose monthly auto-renew, we also keep your mobile number and PayU's reference for your mandate with your subscription, because PayU needs them for every renewal charge; the mobile number is deleted when auto-renew stops.
• Free trial and reviews: if you take the free trial, the lab you chose, when the start link was sent, when the trial started and ended and whether you opened the lab, plus a random device identifier and a one-way hash of your IP address, used only to allow one trial per person. If you write a review, its text, rating and the name and role you chose to show; once published these are public on adsbot.in (never your email address).
• Emails from us: when you create an account we send you one welcome email about the labs, courses and plans, with an offer on your first purchase or, while the free trial runs, an invitation to try a lab. We may then send a few short follow-up emails about your trial, your review offer, an offer that is about to end or a checkout you did not finish, at most one a day. Its links are tracked: opening one tells us which email you came from, so the offer can be applied at checkout and we can see which emails lead to a purchase. The link at the bottom of the email stops offers.
• Messages and requests: what you send through the contact form, by email, in solution-brief and go-to-market plan requests, in team and hiring enquiries, and to the website assistant or AI Mentor, including your name, email address, company and anything else you choose to include.
• Waypoint captures: the photos you take for field verification, with their location (GPS coordinates) and time, the project they belong to and any notes you add.
• Agency services: business contact details of the people we work with at client companies, and, where a client authorises it, access to their advertising accounts (see section 11).

4.2 Data we collect automatically

• Site analytics: the pages you visit, the time of the visit, where you came from (the referring site or campaign), your browser type and an anonymous identifier that changes every day. Your IP address and full browser details are stored only if you accept the cookie banner.
• Sign-in and security records: when you sign in, the IP address the sign-in came from, and, for the practice labs, a random device identifier (see section 6) and the last sign-in time. Repeated failed sign-in attempts are counted briefly, in memory, to block password guessing.
• Lab activity: when you open a lab, sign in or out, and when each mission checkpoint was first passed, so we can check missions and see where learners get stuck.
• Technical logs: error messages and service logs needed to keep the Service working and to investigate problems and misuse.

4.3 Data we receive from others

• PayU tells us whether a payment succeeded, its reference and the payment method type.
• PayPal (payments from outside India) tells us whether a payment succeeded, its reference, and the amount and currency.
• Your employer or trainer may give us your name and email address to set up a team licence, a hiring assessment or a personal lab login for you.
• Google, for agency clients who authorise it, provides campaign and account data from their Google Ads accounts.

4.4 Data we do not want

We never ask for, and we do not receive, your card numbers, CVV, UPI PIN or bank passwords. Please do not send us sensitive information such as health, financial account, biometric, religious or caste details, or government identity numbers, in messages, uploads, lab work or AI conversations. The practice labs are for practice: use made-up names and email addresses in the practice stores and apps, never real customer data.

5. Why we use your data, and on what basis

We process personal data only for lawful purposes. Under the DPDP Act that means either with your consent, or for a legitimate use the Act allows, such as data you have voluntarily given us for a specific purpose, or complying with the law.

Purpose	Data used	Basis
Create and run your account, courses, labs, missions and credentials	Account, learning, lab data	Consent, given when you sign up; data you provide for this purpose
Take payments, give access to paid plans, keep payment records and handle refunds and disputes	Payment and billing data, account	Consent at checkout; legal obligations (tax and accounting)
Send your welcome email, apply its offer and measure which emails lead to a purchase	Account, links you open in our emails, payments	Legitimate interest in telling new members about the service; you can stop offers at any time
Answer your messages, requests and complaints	Messages, contact details	Data you provide for this purpose
Keep the Service and your account secure; stop fraud, abuse, spam and password guessing; enforce one device and one session per lab login	Sign-in and security records, device identifier, technical logs	Legitimate use to protect the Service and its users; legal obligations
Understand, in aggregate, how the site is used, and improve it	Site analytics (IP address and full browser details only with consent)	Consent through the cookie banner, where required
Provide AI answers in the assistant and the AI Mentor	What you type; for the Mentor, your lab configuration	Consent, by using the feature
Deliver Waypoint verification, hiring assessments, team licences and agency services	Waypoint captures, assessment results, client data	Contract with the client or employer; consent where needed
Comply with the law, court orders and requests from authorities	Any relevant data	Legal obligations

We do not use your personal data for automated decisions that have legal or similarly significant effects on you. Mission checks and assessment grading are automatic, but they only check the work in a lab against published criteria.

6. Cookies and similar technologies

We use a small number of our own cookies, and Google's advertising tag (Google Ads) on our pages, so that we can see which of our ads bring visitors, sign-ups, free trials and purchases. The tag sends Google information about your visit, such as the pages you view and your browser and device, under Google's privacy policy (policies.google.com/privacy), and sets Google's advertising cookies. If you click Decline on the cookie banner, the tag runs in Google's consent mode without advertising cookies, and we remove the Google cookie it set; you can change your choice at any time with Cookie settings at the bottom of every page. We use no social-media pixels.

Name	Where	What it does	How long
connect.sid	adsbot.in	Keeps you signed in	Up to 7 days
consent	adsbot.in	Remembers your cookie-banner choice	365 days
ab_src	adsbot.in	Records which link or campaign first brought you here	30 days
_gcl_au	adsbot.in (set by Google Ads)	Links your visit to the Google ad you clicked, so we can see which ads work. Not set, and removed, if you decline cookies	90 days
ab_dev	adsbot.in	Set when you start a free trial: a random identifier so that each device gets one free trial	400 days
sid	Practice labs	Keeps you signed in to a lab	Ends after 12 hours without activity
did	Practice labs	A random device identifier used to allow each lab login on one device only; we store only a one-way hash of it	Up to 400 days, or until you clear cookies

The lab studios also store a few preferences in your browser (for example the light or dark theme and whether you have seen a guided tour). These never leave your device. You can delete cookies and site data in your browser at any time; if you do, you will be signed out, and a lab login may need its device reset by your trainer.

7. AI features

• The website assistant and the AI Mentor in the labs run on AI models that we operate ourselves on computers we control, reached over encrypted connections. What you type is not sent to third-party AI companies and is not used to train anyone else's models.
• The AI Mentor reads your lab configuration (for example your schemas and datasets) so that it can answer about your actual work.
• We keep assistant conversations so that we can answer follow-ups, improve answers and prevent abuse. You can ask us to delete them.
• AI answers can be wrong. Do not rely on them for legal, financial or other professional decisions, and do not type sensitive personal information into them.

8. Who we share personal data with

We do not sell your personal data, rent it or share it for advertising. We share it only where needed to run the Service, and only as much as is needed:

• PayU Payments Private Limited, to process payments, refunds and chargebacks. PayU acts under its own terms and privacy policy and the Reserve Bank of India's rules for payment aggregators.
• PayPal, to process payments from outside India, their refunds and disputes. We pass PayPal the plan, the amount and a reference; you give PayPal your payment details directly on its pages, under its own terms and privacy policy.
• Our Data Processors, who act only on our instructions: Render, which hosts the website and its database; Cloudflare, which carries encrypted traffic to the practice labs and our AI service; and Google, whose Gmail service we use to send and receive email (for example replies and acknowledgements to messages you send us).
• Google (advertising): Google's advertising tag receives information about your visit, and when you sign up, start a free trial or pay, a note that it happened (for a payment, the amount and our reference). It never receives your name, email address or payment details from us. We use this to measure our ads.
• Your employer or trainer, if they enrolled you: for team licences and hiring assessments we share your progress or results with them, and a trainer who gave you a lab login can see your sign-in and device status and your lab work.
• Clients of our agency services, who receive the reports and Waypoint captures they commissioned.
• Banks, card networks, PayU and PayPal, when responding to a payment dispute.
• Courts, police and regulators, when the law requires it, or to protect the rights, property or safety of our users, the public or us.
• A successor business, if AdsBot or its assets are ever transferred, under this policy's protections; we will tell you before that happens.

Anyone can see a credential page, because credentials are made to be verified (see section 10).

9. Payments

When you buy a plan you are taken to PayU's secure checkout. PayU collects and processes your payment details under its PCI-DSS certified systems; we receive only the result, a reference and the method type. If you choose monthly auto-renew, PayU registers a mandate with your bank, card issuer or UPI app; we keep only PayU's reference to it, never your card or account details, use it only to charge the monthly price you agreed to after the advance notice, and revoke it when auto-renew stops. We keep payment records to give you access, handle refunds under our Refund & Cancellation Policy, answer disputes and meet tax and accounting law. We are not registered for GST, so no GST is charged.

10. Certificates and credentials

When you earn a certificate or a mission credential, we create a verification page and an Open Badges record so that employers and others can check it. These pages are public by design: they show your name, the credential, the date and the skills it covers, but not your email address. If you want a credential withdrawn from public view, email us.

11. Agency clients and Google Ads data

If we manage advertising for your business, we access your Google Ads accounts only with your authorisation and only to plan, run, analyse and report on your campaigns. Campaign data from Google is used only for your account, is never shared with other clients, and is handled in line with Google's API terms and policies. You can remove our access at any time in your Google Ads account.

12. AdsBot Waypoint

Waypoint captures are geotagged, timestamped photos taken to prove that a campaign ran where and when it should. We store them with their location and time for the client who commissioned the verification. Please photograph the placement, not people: avoid capturing faces or vehicle number plates wherever you can. A client can ask us to delete its captures.

13. Hiring assessments, team licences and institute batches

An employer can invite a candidate to a hands-on assessment in the practice labs, or enrol its staff through a team licence. For an assessment we receive the candidate's name and email address from the employer and create a login for the labs the employer chose. We record the work done in the candidate's private workspace, which automatic checks passed and when, and the candidate's sign-in times and device type (for example "Chrome on Windows"). We share these results with the employer who invited the candidate, for that hiring decision only, and never use them for marketing. The candidate is told this before they start, and the AI Mentor is switched off during an assessment.

A training institute can buy seats for its students for a batch. We receive each student's name and email address from the institute, email them an invitation, and open the batch's sandboxes for their account for the batch's dates. During the batch we share each student's progress in those sandboxes (which missions they completed, how many checks pass, how many credentials they earned, and when they were last active) with the institute's trainer, on a private page for that batch. The invitation tells students this. We share nothing else, and the page stops showing a student who is removed from the batch.

14. Where your data is stored and international transfers

The practice labs and our AI service run on computers we operate in India. The website and its database are hosted by Render, and Cloudflare, Google and (for payments from outside India) PayPal may process data in data centres in other countries. The DPDP Act allows personal data to be transferred outside India except to countries the Government of India restricts by notification; we will follow any such restriction. Wherever data is processed, our processors must protect it to the standard this policy describes.

15. How long we keep personal data

• Account and learning data: while your account is open. When you close your account, we delete or anonymise it within 90 days, except where we must keep something to resolve a dispute or meet a legal obligation.
• Payment records: for as long as tax and accounting laws require (generally up to eight years).
• Lab work: while your lab access is active. Workspaces of ended or removed lab logins are deleted when we clean up the labs, and at the latest when you ask us.
• Free trial records: while your account is open, so that each person gets one trial. Reviews: published while the review page exists; ask us and we will take yours down.
• Hiring assessment results: up to 12 months after the assessment ends, so the employer can refer back to them, then deleted; sooner if the employer asks, or if you ask and the employer no longer needs them.
• Messages and requests: as long as needed to deal with them and any follow-up, then deleted or kept only in anonymised form.
• Security and technical logs: for a limited period, as needed to keep the Service secure and investigate incidents, and longer only where the law requires.
• Backups: we keep rolling backups for recovery: one a day for two weeks and one a month for six months. Deleted data leaves them as older backups are replaced, so within six months at the latest. Before hiring assessment results are deleted, a copy is kept in the backups for 35 days in case of a mistake, then deleted.

When we no longer need personal data for its purpose, and the law does not require us to keep it, we erase it. Under the DPDP Rules, if you have not used your account for a long period and the law sets a retention limit for our type of service, we will tell you at least 48 hours before erasing your data so that you can sign in and keep it.

16. How we protect your data

We apply reasonable security practices, as required by the Information Technology Act, 2000 and the rules made under it, including:

• encryption in transit (HTTPS) for the website, the labs and our AI service;
• passwords, sign-in sessions and lab device identifiers stored only as one-way hashes;
• two-factor authentication for administrator accounts;
• a private workspace for every learner, so no learner can see or change another's work;
• personal lab logins limited to one device and one active session, with shared logins usable only on our own computers;
• practice-lab administration interfaces that cannot be reached from the internet, and sign-in with two-factor authentication for the website's administration pages;
• limits on sign-in attempts, spam filters on forms, and refusal of scripts and HTML in anything typed into the labs;
• access to personal data limited to the people who need it to run the Service; and
• regular backups, checked by automatic test restores.

No system is completely secure. If a personal data breach happens, we will act to contain it, inform the Data Protection Board of India and the people affected as the DPDP Act and Rules require, and tell you what happened, what it means for you and what you can do.

17. Your rights

Under the DPDP Act and the DPDP Rules, you have the right to:

• Access: get a summary of the personal data we hold about you and how we use it, and the identities of those we have shared it with;
• Correction and erasure: have inaccurate or incomplete data corrected, completed or updated, and have data erased when it is no longer needed or you withdraw consent (unless the law requires us to keep it);
• Withdraw consent: as easily as you gave it; this does not affect processing already done, and some features may stop working;
• Nominate: name another person to exercise your rights if you die or become unable to; and
• Grievance redressal: complain to our Grievance Officer (section 20), and, if you are not satisfied, to the Data Protection Board of India.

To use any of these rights, email adsbot.inc@gmail.com from the address on your account (or tell us which account the request is about). We may ask you to confirm your identity. We do not charge for requests, and we respond within 30 days at the latest. You also have duties under the Act: give us accurate information, and do not file false or frivolous complaints.

18. If you live outside India

We are based in India and this policy follows Indian law. If data protection laws of your country apply to our processing of your data, you have the rights those laws give you:

• European Economic Area, United Kingdom and Switzerland: access, rectification, erasure, restriction, data portability and objection, and the right to complain to your local supervisory authority. Our legal bases are your consent, the performance of our contract with you, our legitimate interests in running and securing the Service, and legal obligations.
• California and other US states with privacy laws: the right to know, delete and correct personal information, and not to be discriminated against for using these rights. We do not sell personal information, or share it for cross-context behavioural advertising.

Contact us at the email address above to use these rights.

19. Children

The Service is intended for adults. Plans may only be bought by people aged 18 or over, and we do not knowingly process the personal data of anyone under 18 without verifiable consent from a parent or lawful guardian, as the DPDP Act requires. We do not track children or show them targeted advertising. If you believe a child has given us personal data, email us and we will delete it.

20. Grievance Officer

Under the Consumer Protection (E-Commerce) Rules, 2020, the Information Technology Act, 2000 and the DPDP Act, you can raise any complaint about your data, a purchase or the Service with our Grievance Officer:

Grievance Officer, AdsBot (headquarters: Hyderabad, India)
Email: adsbot.inc@gmail.com

We acknowledge complaints within 48 hours and resolve them within one month of receiving them. Please include your registered email address and, for payments, the reference shown in Plan & payments.

21. Links to other websites

The Service links to other websites, such as PayU, Google and Adobe's documentation. We are not responsible for how they handle personal data; please read their policies.

22. Changes to this policy

We may update this policy when the Service or the law changes. We will post the new version here with its date and, for significant changes, tell account holders by email or on the site before they take effect. Where a change needs your consent, we will ask for it.

23. Governing law

This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the rules made under it, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020. Subject to your rights before the Data Protection Board of India and consumer commissions, the courts at Hyderabad, Telangana have jurisdiction.

24. Contact

Questions about this policy or your data: adsbot.inc@gmail.com. See also our Terms of Service, Refund & Cancellation Policy, Delivery Policy and Contact page.