Privacy Policy

TODO — <Name> Private Limited, TODO — Address line 1, TODO — Address line 2, TODO — City, TODO — State, TODO — PIN, India, is the data fiduciary for personal data processed through the platform. Contact details for privacy questions are on the Contact & Grievance Redressal page.

• Account data — name, email address, phone number, password (stored only as a cryptographic hash, never in readable form), and the roles held on the account.
• Identity verification data — PAN and related details for advertisers adding funds, and any documents required for regulated advertising categories.
• Screen and venue data (Associates) — venue type, area, city, approximate location, and photographs submitted for verification.
• Financial data — wallet balances, ledger entries, payout records, and payment references from our payment gateway. We do not receive or store your full card number or UPI credentials.
• Content you upload — advertising creatives and signage content.
• Technical data — IP address, device and browser information, and logs of actions taken on your account.

We do not use cameras, sensors, facial recognition or audience measurement hardware. We do not attempt to identify or count the people who walk past a screen.

• To create and operate your account.
• To deliver advertising, record verified plays, and charge or credit the correct amounts.
• To verify identity where required before money moves, and to meet tax obligations.
• To review advertising creatives before they play, and to act on complaints about content.
• To keep the platform secure, investigate fraud or abuse, and comply with law.
• To send service messages. Marketing email, if any, is separate and you can opt out.

• Payment gateway — to take payments and confirm them.
• Cloud hosting and storage providers — to run the platform and store media.
• Content moderation services — automated screening of creatives before human review.
• Email and messaging providers — to send service notifications.
• Authorities — where we are legally required to disclose.

Advertisers do not receive the identity or exact address of an Associate, and Associates do not receive the identity of advertisers. Screens are shown to advertisers under a general venue description rather than a name and street address.

We do not sell personal data.

Data is hosted in India. Some service providers may process limited data outside India; where that happens we rely on contractual protections with those providers.

Periods are set out in full on the Data Retention Policy page. In summary: proof-of-play images are kept for 30 days, financial and identity records are kept for as long as the law requires, and account data is deleted or anonymised when you close your account except where a record must be preserved.

You can ask us to:

• Give you a copy of the personal data we hold about you
• Correct data that is wrong or out of date
• Delete your data, subject to records we are required to keep
• Withdraw consent where processing relies on it

Write to support@do-ad.com. If you are unhappy with our response, escalate to the Grievance Officer named on the Contact & Grievance Redressal page.

Passwords are hashed. Access to the platform is authenticated, and screens authenticate with their own device tokens that cannot be used to reach account data. Every state-changing action is recorded in an audit log. Staff access to administrative tools requires two-factor authentication.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required by law.

The platform is not intended for anyone under 18 and we do not knowingly collect their data.

We will update this page when our practices change, and change the “last updated” date at the top. Material changes will be notified through the platform or by email.