Privacy Policy

1. Introduction

Diligent AI Solutions Private Limited ("Diligent," "we," "us," or "our") operates the Diligent platform at app.diligent.sh. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our service.

2. Information We Collect

Account information

When you create an account, we collect your name, email address, and password (stored as a salted hash). We also collect your organization name and country for account setup.

Ad platform data

When you connect advertising accounts (such as Meta Ads), we access and store campaign, ad set, ad, and performance data from those platforms via their official APIs. This includes campaign names, budgets, targeting parameters, creative assets, and performance metrics (impressions, clicks, spend, conversions). We store OAuth access tokens in encrypted form to maintain your connection.

Usage data

We automatically collect technical information including IP address, browser type, pages visited, and interaction patterns to improve our service. We use Sentry for error tracking and Langfuse for AI interaction tracing.

3. How We Use Your Information

• Provide, maintain, and improve the Diligent platform
• Sync and analyze your advertising data to generate insights and recommendations
• Power AI-driven features including campaign analysis, budget optimization recommendations, and conversational analytics
• Process payments, issue invoices, and manage your subscription and credit balance
• Send service-related communications (account verification, security alerts, sync status updates, and payment or renewal notices)
• Monitor and prevent fraudulent or unauthorized access

4. AI Processing

Diligent uses third-party AI models (Anthropic Claude) to analyze your advertising data and generate recommendations. Your ad performance data (metrics, campaign names, targeting parameters) is sent to AI providers for processing. We do not send your personal account credentials or authentication tokens to AI providers. AI providers process data according to their own privacy policies and do not use your data to train their models.

5. Payment Information

Payments are processed by Razorpay, a payment aggregator regulated by the Reserve Bank of India. Card numbers, UPI IDs, net banking credentials and one-time passwords are entered on Razorpay's own secure page. We never receive or store them.

What we do store against your organization is the record we need to bill you correctly and prove what you paid: the order and transaction references, the amount and currency, the payment status and its timestamps, the payment method type (for example "UPI"), and, for a subscription, the identifier and ceiling of the auto-pay mandate you approved. We share your organization name, email address and the order amount with Razorpay so it can process the transaction and, where necessary, a refund.

Razorpay handles this information under its own privacy policy and the RBI's directions for payment aggregators.

6. Data Storage and Security

Your data is stored on infrastructure hosted by Supabase (PostgreSQL database) and Google Cloud Platform (Cloud Run, europe-west3 region). We encrypt data in transit using TLS and encrypt sensitive credentials (OAuth tokens, API keys) at rest. Session tokens are securely generated and expire after 30 days. We implement rate limiting, input validation, and parameterized queries to protect against common security threats.

7. Data Sharing

We do not sell your personal information. We share data only with:

• Infrastructure providers: Google Cloud Platform (hosting), Supabase (database), Vercel (frontend hosting), Upstash (caching), as necessary to operate the service
• Payment processing: Razorpay, to collect payments, operate auto-pay mandates, and issue refunds
• AI providers: Anthropic, to power AI-driven analysis features, using only aggregated ad performance data
• Error monitoring: Sentry, for error tracking and service reliability
• Legal requirements: When required by law, regulation, or valid legal process

We do not sell your data, and we do not use it to train foundation models. The current list of subprocessors is available on request from support@diligent.sh. We give 30 days' notice before a new subprocessor starts processing your data, so you have time to object.

8. Data Retention

We keep your account data while your account is active and for up to 12 months after you close it. Data from connected platforms is kept for as long as your account is active: if you disconnect an ad platform we stop syncing new data but retain what was already synced, so your historical analytics and trend analysis stay intact. You may request deletion of your account and all associated data at any time by contacting us, and we act on it rather than waiting out the 12 months.

Invoices, payment records and related tax documents are an exception: we are required to retain them for the period set by Indian tax and company law, and they survive an account-deletion request for that reason. They are kept only for that purpose and are not used to profile you.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Withdraw consent for data processing
• Object to automated decision-making

To exercise any of these rights, contact us at support@diligent.sh. We respond within 30 days, and we do not charge for reasonable requests.

10. UK and EU Users (GDPR)

Where the UK GDPR or EU GDPR applies, our role depends on whose personal data is involved. For the personal data you bring into the product from connected platforms, you are the controller and we are the processor, acting on your instructions. For your own account data (name, work email, and how you use the product), we are the controller.

Lawful bases

We rely on performance of a contract (to deliver the service), legitimate interests (security, improving the product, and telling you about changes), consent (marketing email to non-customers, where required), and legal obligation (tax and accounting).

Where your data is held

For EU customers, primary storage, backups and analytics stay on EU infrastructure. A narrow slice of context sent to AI providers may leave the region, and where it does we use zero-retention endpoints. Any transfer that needs a safeguard relies on Standard Contractual Clauses with supplementary measures, and the UK Addendum where the UK GDPR applies.

Data processing addendum

A pre-signed DPA incorporating the EU Standard Contractual Clauses and the UK Addendum is provided at onboarding, and on request from support@diligent.sh.

Breach notification

If we become aware of a personal data breach we notify you within 72 hours, with the information you need to meet your own obligations.

Automated decision-making

We do not make decisions with legal or similarly significant effects by automated means alone. Actions that change your spend stay under your control: recommendations are yours to accept or dismiss, and automated execution runs only within guardrails you set.

Complaints

You can raise a concern with us at any time. You also have the right to complain to your supervisory authority: the Information Commissioner's Office (ICO) in the UK, or the Data Protection Commission (DPC) in Ireland for EU users.

11. Cookies

We use a single essential cookie (session_token) to maintain your authenticated session. We do not use advertising cookies or third-party tracking cookies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

14. Grievance Redressal

If you are not satisfied with how we have handled your data or a related complaint, you can escalate to our Grievance Redressal Officer, Hitesh, at support@diligent.sh. We acknowledge complaints within 48 hours and resolve them within 30 days. Full details are on the Contact us page.