Privacy Policy
In force from 29 October 2026. Last updated: 29 October 2026.
**Effective date: 29 October 2026. This version covers our website, the waitlist and our emails; it will be updated before paid accounts open.
1. Who we are
Veda Smart E-Commerce Solutions Private Limited (registered office as in the footer) runs Ad Flow Pilot and decides how your personal data is used for our website, accounts, billing, security and marketing. For personal data inside content you upload to make ads, we process it only to make your ads on your instructions; you must have the right to share it with us. We follow India's Information Technology Act, 2000 and its privacy rules today, and we are preparing for the Digital Personal Data Protection Act, 2023, whose main duties start on 13 May 2027. You can already use the rights in section 9.
2. What this policy covers
Personal data we collect through adflowpilot.com, the Ad Flow Pilot app, the waitlist form and our emails.
3. What we collect
| What | Examples | Why |
|---|---|---|
| Waitlist details | email address, language, which button you used | to tell you when we launch |
| Account details | name, email, business name, time zone, login and security details | to run your account |
| Billing details | business name, address, GST number, what you bought | to take payment and issue GST invoices |
| Payment details | our payment processor handles your card, bank or UPI details; we receive the payment status, method, reference and limited details such as the last digits or UPI ID | to confirm payments and handle refunds |
| Your content | product links, photos, logos, business place photos, uploaded videos and their audio, scripts, brand colours and fonts | to make your ads |
| Material we make | transcripts of uploaded audio, generated stills, voices, music and videos | to make and deliver your ads |
| Records of approvals and consent | the choices you approve, your cookie choice, terms you accepted and when | to keep a record of what was agreed |
| Usage and support | ads made, credits used, feedback, messages to support | to deliver the service and fix problems |
| Technical data | IP address, browser type, device, security logs | to keep the service secure and working |
| Analytics and advertising data (only with your consent) | pages visited, clicks, scrolls, how you arrived, device and approximate location; on some pages, recordings of how the page was used, with typed text masked; advertising identifiers | to understand how our website is used and to measure our ads |
Photos of people. Uploads are checked by our image-analysis and logo-check providers. Photos showing a person's face are never sent to the video model; we use them only in the editing steps you ask for. Only upload photos of people who have agreed.
4. How we use it
To make and deliver your ads; to run your account, credits and invoices; to answer support requests; to keep the service secure and prevent fraud; to meet legal and tax duties; to measure our website and advertising (only with your consent); and, if you joined the waitlist, to tell you when we launch and how to start. We do not sell your personal data.
AI providers do not train on your content. We send your content to third-party AI providers only to make your ads, using settings that do not allow them to train their models on it. Some providers keep requests for a short time for security and abuse checks, then delete them.
5. Our legal basis
We use your personal data with your consent (given when you join the waitlist, accept cookies or create an account), to perform our agreement with you, and to meet legal duties. You can withdraw consent at any time (section 9); this does not affect what was done before.
6. Who we share it with
- Our service providers, who act on our instructions under contracts: cloud hosting, databases and private file storage; AI providers that analyse your product and make the video, voice, music and images; a processing provider that tracks screens in a video; an image-checking service that detects logos; our email provider.
- Our payment processor, which also uses payment data under its own terms and the law.
- Website analytics and advertising tools — only if you accept those cookies: Google Analytics and Microsoft Clarity (analytics and session recording), and Meta (Facebook / Instagram) Pixel and Conversions API (advertising). These companies also use data under their own privacy terms: Google, Microsoft, Meta.
- Authorities, when the law requires it, using a documented and proportionate process. Some of our providers process data outside India — mainly in the United States and Singapore — and some in India. We send each one only what its step needs.
7. How we protect it
- Everything you upload goes to private storage, never a public folder.
- Images sent to AI models travel inside the request itself.
- Play and download links are private and expire after about an hour — please don't share them. Some providers hold the files they generate at unlisted, short-lived links until we copy them to our private storage.
- Access keys are kept in secured secret storage, never in our code. We keep logs of who approved what.
- If an incident affects personal data, we contain it, report it to CERT-In and other authorities as the law requires, and tell the people affected.
8. How long we keep it
| What | How long |
|---|---|
| Finished ads and renders | 3 months from when they are made |
| Voice-separation and screen-tracking files (made during processing) | deleted after 7 days |
| Your product library (products, photos, brand details) | while your account is active |
| After you close your account | product library, brand kit and finished ads deleted within 30 days, except records the law requires us to keep |
| Encrypted backups | deleted files roll out of our encrypted backups on a rolling cycle |
| Waitlist email | until 12 months after our launch, or 24 months after you joined, or until you unsubscribe — whichever comes first; after you unsubscribe we keep only a do-not-email record |
| Billing and GST records | for the period Indian law requires — generally at least 72 months from the due date of the relevant GST annual return — and longer where proceedings or other laws require it |
| Security logs | at least 180 days; 1 year once the DPDP Rules require it |
| Analytics data | website analytics: 14 months; session recordings: 30 days (recordings saved for review, heatmaps and summary reports: up to 9 months) |
9. Your rights
You can ask what personal data we hold about you and how we use it; ask us to correct, complete or update it; ask us to erase it (unless we must keep it by law); withdraw your consent; name another person to use these rights for you if you die or cannot act; and raise a grievance with us and then, once the Data Protection Board of India is in operation for such complaints, with the Board. Write to our Grievance Officer at support@adflowpilot.com; we may need to check it's you. Unsubscribe from emails with the link in each one.
10. Grievance Officer
Kamal Khatri · support@adflowpilot.com · postal address as in the footer. We acknowledge within 24 hours with a reference number and resolve within 7 days, or faster where the law requires.
11. Children
Ad Flow Pilot is for adults (18 and over); we do not knowingly collect personal data from children. If you upload a photo of a child (for example for a children's product), you must have a parent's or guardian's consent and confirm it with the tick box at upload; such photos are never sent to the video model. If you believe a child has given us personal data, write to us and we will delete it.
12. Cookies
See our notice on Cookies and similar technologies.
13. Changes
We post any change here with a new date and email account holders about important changes. If a change needs your fresh consent, we will ask for it before applying it.