Privacy Policy

1. Who controls your data

DoadLabs Technologies Private Limited, Ponnarassery House, XIV/747, Samooham Road, West Nada, Guruvayur, Thrissur, Kerala, 680101, India, is the data fiduciary for personal data processed through the platform. Contact details for privacy questions are on the Contact & Grievance Redressal page.

2. What we collect

Account data — name, email address, phone number, password (stored only as a cryptographic hash, never in readable form), and the roles held on the account.
Identity verification data — PAN and related details for advertisers adding funds, and any documents required for regulated advertising categories.
Screen and venue data (Associates) — venue type, area, city, approximate location, and photographs submitted for verification.
Screen location at play time (screens running the DoAd Android app) — where the screen was when it played an ad, so a play can be proven by place. On a screen you own, only if you allow location when the app asks; the screen plays whether or not you do, and you can change it later in the device’s settings. It is stored with play records and is not shown to advertisers as an address.
Financial data — wallet balances, ledger entries, payout records, and payment references from our payment gateway. We do not receive or store your full card number or UPI credentials.
Content you upload — advertising creatives and signage content.
Technical data — IP address, device and browser information, and logs of actions taken on your account.

We do not use cameras, sensors, facial recognition or audience measurement hardware. We do not attempt to identify or count the people who walk past a screen.

3. Why we use it

To create and operate your account.
To deliver advertising, record verified plays, and charge or credit the correct amounts.
To verify identity where required before money moves, and to meet tax obligations.
To review advertising creatives before they play, and to act on complaints about content.
To keep the platform secure, investigate fraud or abuse, and comply with law.
To send service messages. Marketing email, if any, is separate and you can opt out.

4. Who we share it with

Payment gateway — to take payments and confirm them.
Cloud hosting and storage providers — to run the platform and store media.
Content moderation services — automated screening of creatives before human review.
Email and messaging providers — to send service notifications.
Maps and place-search provider (Google) — when you view a map, search for a place or pin a screen’s location, the search text, the map area and your IP address go to Google to show the map and suggestions. If you choose “use my current location”, your browser’s location is used on that map.
Authorities — where we are legally required to disclose.

Advertisers do not receive the identity or exact address of an Associate, and Associates do not receive the identity of advertisers. Screens are shown to advertisers under a general venue description rather than a name and street address.

We do not sell personal data.

5. Where it is stored

Data is hosted in India. Some service providers may process limited data outside India; where that happens we rely on contractual protections with those providers.

6. How long we keep it

Periods are set out in full on the Data Retention Policy page. In summary: proof-of-play images are kept for 30 days, financial and identity records are kept for as long as the law requires, and account data is deleted or anonymised when you close your account except where a record must be preserved.

7. Your rights

You can ask us to:

Give you a copy of the personal data we hold about you
Correct data that is wrong or out of date
Delete your data, subject to records we are required to keep
Withdraw consent where processing relies on it

Write to support@do-ad.com. If you are unhappy with our response, escalate to the Grievance Officer named on the Contact & Grievance Redressal page.

8. Security

Passwords are hashed. Access to the platform is authenticated, and screens authenticate with their own device tokens that cannot be used to reach account data. Every state-changing action is recorded in an audit log. Staff access to administrative tools requires two-factor authentication.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required by law.

9. Children

The platform is not intended for anyone under 18 and we do not knowingly collect their data.

10. Changes

We will update this page when our practices change, and change the “last updated” date at the top. Material changes will be notified through the platform or by email.