Privacy Policy

Admayr Labs Private Limited is a company incorporated on 25 May 2026 in India, with its registered address at WeWork IWE Campus, Survey No. 192, Whitefield Main Road, B Narayanapura, Mahadevapura, Bengaluru, Karnataka 560048. For any privacy related questions, you can contact us at privacy@admayr.com.

Account information: Your name, email address, password (hashed), profile photo, language and region preferences, and any details you add to your account.

Brand & content information: Brand name, logo, colors, captions, product images, prompts, and any other creative inputs you upload so we can generate posts on your behalf.

Connected channels: When you connect a social media account or ad platform (such as Instagram, Facebook, Google or Meta Ads), we receive tokens and basic profile details from those platforms that allow us to publish content and read performance data on your behalf, strictly within the permissions you grant.

Usage information: Logs of how you use the Service, pages visited, features used, automations created, posts scheduled, errors encountered, device type, browser, IP address, and approximate location derived from your IP.

Billing information: If you subscribe to a paid plan, our payment processor collects payment details directly. We store only limited information like plan, invoice history, last four digits of the card, and billing country.

Support communications: Messages you send us through support tickets, email, or feedback forms.

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Generate captions, images, videos, and schedule posts on the channels you connect.
• Personalize your experience, such as remembering your brand style and preferences.
• Process payments, manage subscriptions, and enforce plan limits like monthly video quotas.
• Send transactional emails (account confirmations, billing, security alerts) and, with your consent, occasional product updates.
• Detect, investigate and prevent fraud, abuse, and security incidents.
• Improve the Service through analytics, debugging, and product research.
• Comply with legal obligations and enforce our Terms.

Where applicable laws such as the GDPR or India's DPDP Act apply, we process personal data on the following legal bases: (a) performance of a contract with you, (b) your consent (which you can withdraw at any time), (c) our legitimate interests in running and improving the Service, and (d) compliance with legal obligations.

We do not sell your personal data. We share information only with:

• Service providers that help us run Admayr, including cloud hosting, databases, authentication, Lovable's built-in email delivery service, analytics, error monitoring, and payment processing, under contractual obligations of confidentiality and security.
• Social media and ad platforms you choose to connect, only to perform the actions you ask us to perform (such as publishing a post).
• AI model providers we use to generate captions, images, and videos based on the prompts and assets you provide.
• Authorities and legal counsel when required by law, court order, or to protect rights, safety and property.
• Successors in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you.

We use cookies and similar technologies to keep you signed in, remember preferences, measure usage, and improve performance. You can control cookies through your browser settings. Disabling essential cookies may break parts of the Service.

• Strictly necessary: authentication, session integrity, fraud and bot protection. These cannot be switched off.
• Preference: theme, language, selected brand workspace and layout choices.
• Analytics: aggregated usage measurement to understand which features are used and where the product fails.

We honour Global Privacy Control and “Do Not Track” signals for non-essential cookies where your browser sends them.

We retain personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or anonymize your personal data within a reasonable timeframe, except where we are required to keep certain records for legal, accounting, or fraud-prevention reasons.

We use industry-standard administrative, technical and physical safeguards, including encryption in transit, access controls, audit logging and isolated environments, to protect your information. No method of transmission or storage is 100% secure, but we work continuously to keep your data safe and to notify you of material incidents as required by law.

We may process and store information in countries other than your own, including India, the European Union, and the United States, depending on where our service providers operate. Where required, we put in place appropriate safeguards such as standard contractual clauses.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated personal data.
• Object to or restrict certain processing.
• Receive a portable copy of your data.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email privacy@admayr.com.

Under India's Digital Personal Data Protection Act, you may raise any grievance about how we handle your personal data with our grievance officer at grievance@admayr.com. We acknowledge requests within 24 hours and aim to resolve them within 15 days. We may ask you to verify your identity before acting on a request, and we may decline requests that are manifestly unfounded, repetitive, or that would reveal another person's data.

We work with a limited set of processors, each engaged under written confidentiality, security and data-processing terms, and each used only for the purpose described.

Processors with access to Meta Platform Data

The following processors may access Meta Platform Data such as your Meta user ID, email address, profile picture, and the encrypted access tokens for the Facebook Pages and Instagram accounts you connect:

• Supabase Inc. (United States)
  • Category: Hosting and storage; database hosting; authentication services.
  • Access to Meta Platform Data: Yes.
  • Countries of processing: United States (database hosting); India (remote access by Admayr via the internet to operate the service).
  • Data shared: Meta user ID, email, profile picture, page/IG access tokens (encrypted at rest), and any content you choose to publish through Meta channels.
  • Safeguards: Written confidentiality, security and data-processing terms; encryption in transit and at rest; access limited to what is necessary to provide the service.
• Cloudflare, Inc. (United States)
  • Category: Application hosting, edge compute, CDN, DNS and bot protection.
  • Access to Meta Platform Data: Yes (transit-only as requests pass through the edge network).
  • Countries of processing: United States; India (remote access by Admayr via the internet to operate the service); encrypted transit via Cloudflare's global edge network with no persistent storage of Platform Data outside the United States.
  • Data shared: Meta user ID, email, profile picture, page/IG tokens and published content in encrypted transit.
  • Safeguards: Written confidentiality and data-processing terms; data minimization; no storage of Platform Data beyond transient caching for delivery.

Other service providers

These providers process user-provided content or billing data, but do not receive or store Meta Platform Data:

• Google LLC (United States)
  • Category: AI content generation; cloud AI services.
  • Access to Meta Platform Data: No.
  • Data shared: User-provided brand prompts, captions, product descriptions and creative assets only.
  • Safeguards: Written confidentiality and data-processing terms; data not used to train models; used solely to generate requested content.
• Features & Labels, Inc. / fal.ai (United States)
  • Category: AI image and video generation.
  • Access to Meta Platform Data: No.
  • Data shared: User-provided prompts, reference images and creative assets only.
  • Safeguards: Written confidentiality and data-processing terms; no Meta tokens or profile data shared; used solely for media generation.
• Lovable (United States)
  • Category: Application platform and transactional email delivery.
  • Access to Meta Platform Data: No.
  • Data shared: Email address and transactional message content only (e.g., account confirmations, billing, security alerts).
  • Safeguards: Platform terms and the same security, access-control and data-processing controls applied to all Admayr data.
• Cashfree Payments India Pvt. Ltd. (India)
  • Category: Payment processing; billing and subscriptions.
  • Access to Meta Platform Data: No.
  • Data shared: Billing information, plan details, invoice history and payment method last-four digits only.
  • Safeguards: Written confidentiality and data-processing terms; PCI-DSS compliant handling; no access to social or ad platform data.

Connected social media and advertising platforms

When you choose to connect a channel, these platforms receive content and instructions only to perform the actions you explicitly request, such as publishing a post or running an ad campaign. They act as independent controllers for data they collect on their own platforms.

• Meta Platforms, Inc. (United States)
  • Category: Social media and advertising platform.
  • Access to Meta Platform Data: Yes (only what you explicitly authorize).
  • Data shared: Content you instruct Admayr to publish, plus tokens required to perform that action.
  • Safeguards: Platform terms and user-controlled OAuth scopes; data shared only to perform actions you explicitly request.
• Google LLC (United States) — Google Ads
  • Category: Advertising platform.
  • Access to Meta Platform Data: No.
  • Data shared: Ad creative content, campaign settings and budget data you instruct Admayr to publish.
  • Safeguards: Platform terms and user-controlled OAuth scopes; no Meta Platform Data shared.

We do not sell personal data, and we do not disclose it to any party outside the list above except where required by law or with your instruction.

Unless a longer period is required by law, we generally retain:

• Account and brand data, for the life of the account, deleted within 30 days of account deletion.
• Generated content and drafts, drafts are purged automatically after 7 days; published history is kept while the account is active.
• Connected-channel tokens, until you disconnect the channel or delete the account, whichever is earlier, then revoked and deleted.
• Billing and tax records, up to 8 years, as required by Indian tax law.
• Security and access logs, up to 180 days.

Admayr uses automation to schedule posts, select creative variants, categorise your inventory and suggest ad audiences. These decisions are operational rather than legal or similarly significant, and you can review, override or disable any automation from your workspace. We do not use your personal data to train third-party foundation models beyond what is necessary to fulfil a generation request you initiate.

Data we receive from Meta, Google and other connected platforms is used strictly to deliver the features you request, publishing, scheduling, insights and campaign management, in line with those platforms' developer policies. We do not sell platform data, use it for unrelated advertising, or share it with data brokers. Revoking access in the platform's own settings, or disconnecting the channel in Admayr, ends our access and triggers deletion of the associated tokens.

Platform Data we receive from Meta (including Meta user ID, email address, profile picture, API access tokens and app secret) is stored and processed only by the hosting and database processors named in section 10B, Supabase and Cloudflare. It is never shared with AI model providers, analytics vendors, advertising networks, data brokers, or any other third party, and it is never used to train, improve, or fine-tune any machine-learning model.

If we become aware of a personal data breach that is likely to affect you, we will notify the relevant supervisory authority and affected users without undue delay, describing what happened, the data involved, the steps taken, and what you can do to protect yourself.

When a public authority requests personal data, we apply the following policies and processes before any disclosure is made:

• Required review of legality: We review the validity of every request, including whether the requesting authority has jurisdiction and a lawful basis, before producing any information.
• Provisions for challenging unlawful requests:We challenge requests that we consider unlawful, overbroad or improperly served, and seek legal advice where appropriate.
• Data minimization policy: We disclose only the minimum information strictly necessary to respond, and never provide bulk or unrestricted access.
• Documentation of requests: We document every request, our response, the legal reasoning applied and the individuals involved in the decision. We notify the affected user unless legally prohibited.

In the twelve months preceding the date of this policy, Admayr Labs Private Limited has not disclosed any user personal data to public authorities in response to national security requests.

Admayr is not directed to anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it.

The Service may link to third-party websites or platforms (for example, your connected social networks). We are not responsible for the privacy practices of those third parties; we encourage you to read their policies.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where required, notify you in-app or by email. Continued use of the Service after changes take effect means you accept the updated policy.

Admayr Labs Private Limited
WeWork IWE Campus, Survey No. 192, Whitefield Main Road,
B Narayanapura, Mahadevapura, Bengaluru, Karnataka 560048
Email: privacy@admayr.com