Privacy Policy
Last updated: 30 September 2026
Controller / Data Fiduciary: Sunbots Innovations LLP ("we", "us"), a limited liability partnership registered in India, 13 Hariharashray Bunglows 1, Thaltej, Ahmedabad, Gujarat 380059, GSTIN 24ADYFS1921K1ZL.
Service: Sunbots Marketing, available at https://marketing.sunbots.in (the "Service").
This Privacy Policy explains how we collect, use, share, retain and protect personal data, and the rights you have. It is designed to align with India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 ("DPDP"), the EU and UK GDPR where applicable, and US state privacy laws (including the CCPA/CPRA).
1. Who this policy covers and our two roles
This policy applies to our customers and their authorised users, and to visitors to our website.
Our two roles matter. For data about our customers and their users we act as a controller / Data Fiduciary. For personal data our customers upload or connect so we can run marketing on their behalf — their leads, email/SMS subscribers, social-media audience, and website visitors — our customer is the controller and we act as a processor / Data Processor under their instructions and our Data Processing Addendum. If you are such an individual, please direct privacy requests to the business that uses our Service; we will assist them.
2. Personal data we collect
- Account & profile data: name, email, password (stored only as a salted hash), profile photo, organisation/workspace details, role, country.
- Billing data: plan, subscription status, transaction identifiers and payment metadata. We do not store full payment-card numbers — payments are processed by Razorpay.
- Brand & content data: brand assets, voice/style settings, product catalogue, competitors, personas, goals, and content you generate.
- Connected-account data: access tokens, and refresh tokens where the platform issues them, for platforms you connect (Google, Google Business Profile, Google Search Console, Google Ads, YouTube, Meta/Instagram, LinkedIn, GitHub, and X and TikTok only for accounts connected before we stopped offering them). Access tokens we receive from Meta, for Facebook Pages, Instagram accounts and Meta ad accounts, are encrypted at rest. Section 6 sets out what else we receive from Meta.
- Customer Content processed on your behalf (we are processor): leads, email subscribers, phone numbers for SMS, social comments/DMs, reviews, and website-visitor analytics including heatmap/behavioural events for sites you connect.
- Usage, device & log data: IP address, device/browser (user-agent), pages and features used, API call logs, diagnostics.
- Consent & preference records: consents you give or withdraw, with timestamp, IP address and user-agent.
- Communications: support messages, feedback, contact preferences.
- Enquiries and demo requests: if you contact us by WhatsApp, phone or email, including from a form on our website that opens WhatsApp with your message pre-filled, we receive what you send: your phone number or email address, your name as shown on WhatsApp, and your message (for example the website or business name you typed into the form). A pre-filled form sends nothing to us until you press send in WhatsApp. We use this only to answer you and to arrange a demo. WhatsApp is provided by Meta, and its handling of your messages is governed by WhatsApp's own privacy policy.
3. How and why we use personal data
We use personal data to: create and secure accounts and authenticate you; provide and maintain the Service; generate the content, calendars, reports and analytics you request; publish content to accounts you connect, after you approve it or, if you turn on automatic publishing, on the schedule you set without approving each post; process payments, invoicing and tax; provide support; send service and (with consent where required) marketing communications; monitor, debug and improve the Service and manage costs; detect and prevent fraud, abuse and security incidents; and comply with law.
We do not sell your personal data, and we do not allow our AI providers to train their models on your private content beyond generating your requested output (see Section 6).
4. Legal bases (where GDPR applies)
We rely on performance of a contract, consent (e.g., non-essential cookies, optional marketing, certain integrations — withdrawable at any time), legitimate interests (securing and improving the Service, preventing abuse), and legal obligations (e.g., tax). Under DPDP we process on the basis of your consent or other lawful grounds permitted by the Act.
5. AI-generated content & automated processing
The Service uses AI to draft and optimise marketing content. We design for human-in-the-loop: by default, content is presented for your approval before publishing. If you turn on automatic publishing, posts are published on the schedule you set without a separate approval for each one. You can switch it back at any time. We do not make decisions producing legal or similarly significant effects about individuals solely by automated means, and we disclose where content is AI-generated.
6. Sharing & sub-processors
We share personal data only as needed to run the Service, with service providers (“sub-processors”) acting on our behalf under contract:
| Sub-processor | Purpose | Typical location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting & storage | India (ap-south-1) |
| Razorpay | Payment processing | India |
| Anthropic | AI text/strategy generation and comment analysis | United States |
| Google (Generative AI; OAuth; Search Console; Business Profile; YouTube; Google Ads) | AI generation & connected services | United States / global |
| HeyGen | AI avatar video generation | United States |
| Amazon Web Services (Amazon SES) | Transactional & marketing email | India (ap-south-1) |
| Twilio | SMS delivery | United States / global |
| GitHub | Website auto-update (pull requests) | United States |
| DataForSEO | SEO/keyword data | United States |
We require sub-processors to protect personal data and process it only on our instructions. A current list is at https://marketing.sunbots.in/subprocessors. We may also disclose data to comply with law, enforce our terms, or protect rights, and in a merger or acquisition (with notice).
Google user data — scopes we request, YouTube API Services, and our Limited Use commitment
When you connect a Google service we request only the scopes the feature you enabled needs, and only after your explicit OAuth consent. These are every Google scope the Service can ask for and what each one is used for:
- Sign-in (`openid`, `email`, `profile`) — create your account, authenticate you, and show your name, email and profile photo in the app.
- Google Business Profile (`business.manage`) — read the business locations you manage and publish the posts, updates and review replies you approve.
- Google Search Console — read (`webmasters.readonly`) — read your site's search-performance, coverage and indexing data for your SEO reports.
- Google Search Console — write (`webmasters`) — not requested by default. Asked for only if automatic sitemap submission is switched on, and then used only to submit the sitemap we generate for the property you connect. We do not add, remove or transfer ownership of properties.
- Google Ads (`adwords`) — optional; requested only if you start the Google Ads upgrade. Read campaign, keyword, budget and performance data for reporting, and create, update, pause and set budgets on the campaigns you approve, inside your own Google Ads account. Connecting Search Console on its own never asks for this scope.
- YouTube — upload (`youtube.upload`) — upload the videos you approve to the YouTube channel you connect.
- YouTube — read (`youtube.readonly`) — identify your channel and read the view, like and comment counts of your videos for the analytics we show you.
You can review or revoke our access at any time from your Google Account permissions page (https://myaccount.google.com/permissions, or https://security.google.com/settings/security/permissions). Revoking access stops any further use; to have data we already hold erased, see /data-deletion. Google's own handling of your data is described in the Google Privacy Policy (https://policies.google.com/privacy).
YouTube API Services. Our YouTube features use YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and to Google's collection and use of data as described in the Google Privacy Policy (https://policies.google.com/privacy). We store only what the features above need — your channel identifier, the videos we published for you and their public engagement counts — and you can have it erased at any time as described on /data-deletion.
Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use Google user data solely to provide and improve these user-facing features. We do not sell it, do not use it for advertising or to target advertising at you, do not transfer it except to provide the Service or as required for security or law (or with your consent), and do not use it to develop, improve or train generalised AI/ML models. Where you connect Google Ads, we operate inside your own advertising account on your instruction — that is the feature you asked for, not our use of your Google data to advertise to you. No human reads your Google data except with your consent, for security or abuse investigations, to comply with law, or where the data is aggregated or anonymised.
Meta (Facebook & Instagram) data
When you connect a Facebook Page or its linked Instagram Business account, you approve access on Meta's consent screen and choose which Pages to connect. Through that connection we access only the Pages and Instagram accounts you connect, and only with the permissions you grant. Paid ads, the last item below, is a separate step that you choose to take:
- Your Pages: the list of Facebook Pages you manage, so you can choose which to connect. For each Page you connect: its name, category, description, website, profile picture and follower count; a Page access token, plus the Facebook user access token we use to renew it; and your app-scoped Facebook user ID, so that we can act on a deletion request you send us through Facebook. Both tokens are encrypted at rest.
- Page posts and engagement: your Page's posts (text, images, links and dates) with their reaction, comment and share counts.
- Comments on posts we publish for you: for posts published to your Page through the Service, each comment's text, the commenter's name and profile picture, and when it was posted.
- Page insights: performance figures for your Page and its posts, such as views, reach, engagement and followers.
- Your linked Instagram Business account: its username, name, profile picture, follower count and post count; its posts (caption, media, link, date, and like and comment counts); and insights such as reach, views, likes, comments, shares and saves.
- Paid ads (optional; asked for only if you set up Paid ads): with the ads permissions you grant (`ads_management`, `ads_read` and `business_management`), we read the list of ad accounts you can use (ID, name, currency and status) so that you can choose one. In the ad account you choose, we create the campaigns and ads you approve, including ads that promote a post from your Page, and they are created paused. We read their performance (impressions, clicks, spend, and the actions and conversion values Meta reports) to show you how they are doing. The access token for this is encrypted at rest.
How we use it. We use this data only to provide the features you asked for: to publish the posts you approve, or that you have set your workspace to publish automatically, to your Page and Instagram account; to show you, inside your workspace, how your posts perform and the comments people leave on them; to build your brand profile and brand report, and the examples new content is modelled on, from your Page's and Instagram account's posts and performance; and, if you use Paid ads, to create the ads you approve in your own ad account and report how they perform.
AI processing. Comment text, and your posts and performance figures, are processed by our AI provider Anthropic (see the sub-processor list). It labels each comment as positive, neutral, negative or a question, drafts suggested replies, summarises recurring themes, and writes your brand report. Images from your Page's and Instagram account's posts are analysed by Google's Gemini models (also on the sub-processor list) to describe your brand's visual style for new posts, and Gemini also indexes the text of your best-performing posts so that new content can draw on them. We do not allow either provider to train its models on this data.
No sale, no ad targeting. We do not sell data we receive from Meta and do not use it to target ads at you or anyone else. Where you use Paid ads, we operate inside your own ad account on your instruction, with the audience you approve. That is the feature you asked for, not our use of Meta data to target advertising. We share this data only with the sub-processors listed above that host and run these features.
Retention. We keep this data while the Page or Instagram account is connected. Disconnecting it (Connectors, then Disconnect, in the app) deletes that connection: its access tokens, the profile details we stored for it and the list of posts we imported for it. We then stop collecting anything new from it. A linked Instagram account is reached with its Facebook Page's access token, and its connection keeps its own copy of that token, so disconnect the Instagram account as well as the Page. Some data belongs to your workspace as a whole and stays after you disconnect, until the workspace is deleted or you ask us to delete it: copies of your best-performing posts kept as examples for new content, your brand profile, brand report and visual style description, and the comments, insights and performance figures already collected, including those for your ads.
Revoking access and deletion. You can remove Sunbots Marketing at any time in Facebook under Settings & privacy → Settings → Business Integrations (or Apps and websites, if it is listed there), and in Instagram under Apps and websites in your settings. That ends our access at Meta. Removing the app on its own does not send us a deletion request, so it does not erase data we already hold. If you also click Send Request for Sunbots Marketing among your removed apps under Facebook's Apps and websites, Facebook sends us a deletion request and we delete the Page and Instagram connections we can match to your Facebook user ID. Our Data Deletion page explains what that request reaches and how to have everything else erased: https://marketing.sunbots.in/data-deletion.
7. International data transfers
We are based in India and use sub-processors in other countries (including the United States). Where we transfer personal data subject to GDPR outside the EEA/UK, we use appropriate safeguards such as the Standard Contractual Clauses (and the UK International Data Transfer Addendum) with a transfer risk assessment. Under DPDP, transfers are permitted except to territories restricted by the Government of India. Where available, we offer regional data-residency options.
8. Cookies & similar technologies
We use strictly necessary cookies and, with your consent, analytics and marketing cookies. Manage choices via our cookie banner and the /cookies page; if your browser sends the Global Privacy Control (GPC) signal, we treat it as a refusal of analytics and marketing cookies.
Some pages of our marketing website load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). To deliver the font files, Google receives your IP address and browser details; Google Fonts sets no cookies. Google's handling of that data is described in the Google Privacy Policy (https://policies.google.com/privacy).
9. Data retention
We keep personal data only as long as necessary or as required by law, then delete or anonymise it. Indicative periods: account data for the life of the account plus 90 days; billing/tax records for 7 years; security and audit logs for at least 1 year (DPDP minimum) up to 24 months; website-visitor analytics up to 13 months; enquiries and demo requests that do not lead to an account up to 12 months after our last exchange; consent records for the life of the account plus 3 years. Customer Content we process for a customer is retained per that customer's instructions.
10. Your rights
Subject to applicable law, you may request to access, correct/complete, erase, restrict or object to processing, obtain portability, and withdraw consent at any time. Under DPDP you may also nominate another individual to exercise your rights in case of death or incapacity. Under US state laws you may opt out of the “sale”/“sharing” of personal information and targeted advertising (we do not sell data), and you will not be discriminated against for exercising your rights.
To exercise rights, use in-product controls (export/delete) or contact privacy@sunbots.in or our Grievance Officer, Ravi Jadav, at ravi.jadav@sunbots.in (Section 12). We respond within the timelines required by law (generally within 30 days under GDPR; within statutory timelines under CCPA; and per DPDP). We may need to verify your identity.
What the in-product export contains. Your profile, workspace memberships, notification and consent records, the audit-trail entries recorded about you (including the IP address and user agent we stored), billing details, subscription, payments and invoices, workspace invitations sent to your email, invite-code redemptions and the sign-in providers linked to your account. It does not contain other people’s data (for example other members, or the addresses of people you invited), credentials and secrets (password hash, access tokens, payment-gateway signatures, invitation tokens), or workspace content such as posts, blogs, brand profile and onboarding answers, which belong to the workspace; ask us at the contact above if you need a copy of content you authored.
11. Children
The Service is intended for business use by individuals 18 or older and is not directed to children. We do not knowingly process a child's personal data without verifiable parental/guardian consent, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children (DPDP).
12. Grievance Officer & data-protection contacts
- Grievance Officer (India / DPDP): Ravi Jadav, Sunbots Innovations LLP, ravi.jadav@sunbots.in, 13 Hariharashray Bunglows 1, Thaltej, Ahmedabad, Gujarat 380059. We address grievances within the timelines prescribed under the DPDP Rules (within 90 days).
- Data Protection Officer (where appointed): dpo@sunbots.in.
- EU representative (Art. 27 GDPR): not appointed. We do not currently offer the Service to people in the EU; if that changes we will appoint one and name them here.
- UK representative (Art. 27 UK GDPR): not appointed. We do not currently offer the Service to people in the UK; if that changes we will appoint one and name them here.
- You may also complain to the Data Protection Board of India, or, for GDPR, your local supervisory authority.
13. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and least privilege, network protections, logging and monitoring, and regular testing. No method is perfectly secure. We will notify the relevant authority and affected individuals of a personal data breach as required by law.
14. Changes to this policy
We may update this policy. We will post the new effective date and, for material changes, provide additional notice. Continued use after the effective date constitutes acceptance where permitted by law.
15. How to contact us
Sunbots Innovations LLP, 13 Hariharashray Bunglows 1, Thaltej, Ahmedabad, Gujarat 380059. Privacy: privacy@sunbots.in. Security: security@sunbots.in.
Operated by Sunbots Innovations LLP. Questions about this page: privacy@sunbots.in.
← Back to home