1. Who we are and scope
This Privacy Policy explains how TasquerAI Private Limited ("Tasquer", "we", "us" or "our"), a company incorporated in India (CIN U62090KA2025PTC207181) with its registered office at No. 472/7, Balaji Arcade, A.V.S. Layout, Ejipura, Bangalore South, Bengaluru, Karnataka – 560095, India, collects, uses, shares and protects personal data.
It applies to:
- our website at www.tasquer.ai (the "Website"); and
-
the Tasquer platform and related applications, agents and APIs available on
tasquer.aisub-domains, including all of its modules (together, the "Platform"; with the Website, the "Services").
Our role.
- For Website visitor data, Platform account data and data we receive when you connect an advertising account, Tasquer decides why and how the data is processed. We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
- For business data that our enterprise customers upload or connect to the Platform (for example sales, inventory, invoice or financial records), we process personal data only on the customer's documented instructions. We act as a Data Processor under the DPDP Act for that data. The customer's own privacy notice governs it, and requests about it should go to the customer first.
Where you have a signed agreement with us that contains data protection terms (such as a Data Processing Agreement), those terms apply alongside this policy and prevail if they conflict with it.
2. Information we collect
| Category | What it includes | Source |
|---|---|---|
| Contact and demo requests | Full name, business email, company name, area of interest and the message you write. | You, through the Website contact form |
| Account and sign-in data | Name, email address, organisation, role and permissions, and authentication identifiers. | You or your organisation's administrator |
| Payment information | Billing name, billing address, GST details and transaction records such as amount, date and payment status. If you pay online, payments are processed by a third-party payment gateway; we do not collect or store card or bank-account credentials. | You, and our payment gateway |
| Customer business data | Data your organisation uploads or connects, such as sales, inventory, pricing, invoice and financial records. It may contain names and contact details of your organisation's own customers, vendors or staff. | Your organisation |
| Campaign content | Campaign briefs, goals, budgets, targeting choices, ad copy, images and other creative assets, WhatsApp numbers used for click-to-message ads, and landing-page URLs. | You |
| Connected advertising account data | Data received from Google Ads and Meta when you connect them. See section 4 and section 5. | Google, Meta, with your authorisation |
| Public web content | Content and performance measurements of public landing pages you ask us to scan, including results from Google PageSpeed Insights. | Public websites you specify |
| Technical and usage data | IP address, browser and device type, pages and features used, timestamps, and error and security logs. | Automatically, from your device |
We do not ask for sensitive personal data such as health, biometric, religious or financial-account credentials. Please do not include it in messages or uploads unless your organisation's agreement with us covers it.
3. How we use information
| Purpose | Basis (DPDP Act) |
|---|---|
| Respond to enquiries and demo requests | Consent; data you voluntarily provide for a specified purpose |
| Provide, operate and support the Platform, including forecasting, finance automation and campaign management features | Consent; data voluntarily provided for a specified purpose |
| Create and manage ad campaigns in your connected advertising accounts, and report their performance, when you instruct us | Consent |
| Keep the Services secure, prevent fraud and abuse, and fix errors | Legitimate uses permitted by law |
| Send service and administrative messages (for example security notices or changes to our terms). These are part of the Services and you cannot opt out of them while you have an account. We do not send marketing emails; if we start, we will ask for your consent first and every message will let you opt out. | Consent; legitimate uses |
| Comply with law, respond to lawful requests and enforce our agreements | Compliance with law, judgments or orders |
We do not sell personal data, and we do not use personal data for automated decisions that produce legal or similarly significant effects on you.
4. Google user data
When you connect a Google Ads account to Tasquer, you sign in with Google and approve the permissions we request. This section describes exactly what we access and how we treat it.
4.1 What we access
| Permission (scope) | What it lets us do |
|---|---|
https://www.googleapis.com/auth/adwords |
Read and manage the Google Ads accounts you can access. This covers account IDs, names and types; campaigns, budgets, ad groups, keywords, ads, assets and targeting settings; and performance metrics such as impressions, clicks, cost and conversions. |
openid, email |
Read the email address of the Google account you sign in with. We use it only to label the connection so you can tell which Google account is linked. |
Google also issues OAuth access and refresh tokens. We store the refresh token so that the Platform can carry out your instructions without asking you to sign in each time.
4.2 How we use it
We use Google user data only to provide the user-facing features that you request in the Platform:
- listing the Google Ads accounts you can access, so you can choose which one to use;
- creating campaigns, budgets, ad groups, keywords, ads and image assets that you have planned in Tasquer. Campaigns are created in a paused state;
- activating a campaign only when you approve it, and pausing, resuming or changing its budget when you instruct us to;
- retrieving performance metrics for the campaigns managed through Tasquer, to display reports and dashboards to you; and
- analysing performance metrics (such as impressions, clicks, leads and spend) of the campaigns managed through Tasquer, to generate optimisation recommendations that we show you. We do not change a campaign based on a recommendation unless you approve it.
4.3 How we store and protect it
- OAuth tokens are encrypted at rest using AES-256-GCM and are never sent back to your browser.
- Data is transmitted over encrypted (TLS) connections.
- Data is stored on Amazon Web Services infrastructure in India (Mumbai region), with access limited to systems and personnel that need it.
4.4 How we share it
We do not sell Google user data. We transfer it only (a) as needed to provide or improve the user-facing features described above, (b) to comply with applicable law, or (c) to protect against security threats, fraud or abuse. We transfer it as part of a merger, acquisition or sale of assets of Tasquer only after obtaining your explicit prior consent.
Our service providers process it on our behalf under written confidentiality and security obligations. These are our cloud hosting provider and, for the optimisation recommendations described in section 4.2, our AI service providers. We send AI service providers only the campaign performance metrics needed to generate the recommendation. We do not send them Google account email addresses or OAuth tokens. They may use the data only to return the output to us, and may not keep it or use it to train their models. We do not send Google user data to AI service providers when creating campaigns.
4.5 What we never do with Google user data
- We do not use or transfer it to serve advertisements, including retargeting, personalised or interest-based advertising.
- We do not sell it, or transfer it to data brokers, advertising networks or information resellers.
- We do not use it to determine credit-worthiness or for lending purposes.
- We do not use it to develop, improve or train generalised artificial intelligence or machine learning models.
- Our staff do not read it unless: you give us affirmative consent for specific data (for example when you ask for support); it is necessary for security purposes, such as investigating abuse; it is needed to comply with applicable law; or the data has been aggregated and anonymised for internal operations.
Tasquer's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4.6 Revoking access and deleting data
- In Tasquer: disconnect Google Ads from the ad platform connections page in your workspace settings. We delete the stored tokens immediately.
- In Google: remove Tasquer at myaccount.google.com/permissions. This stops all further access.
- Deleting retained data: to delete campaign records and metrics we hold, email info@tasquer.ai. We acknowledge your request within 24 hours and complete deletion within 15 days, except for data we must keep by law.
Disconnecting does not delete campaigns that already exist in your Google Ads account. You can manage or remove them directly in Google Ads.
5. Meta Platform data
When you connect Meta (Facebook and Instagram advertising) through Facebook Login for Business, you approve the permissions we request:
| Permission | What we use it for |
|---|---|
ads_management |
Create, update, pause and activate campaigns, ad sets, ads and creatives in the ad accounts you select. |
ads_read |
Read performance insights (such as impressions, clicks, leads and spend) for reports and optimisation recommendations. |
business_management |
List the Business Manager ad accounts and Pages you have granted us, so you can choose which to use. |
pages_show_list |
List the Facebook Pages you manage, so you can choose the Page your ads run from. |
pages_read_engagement |
Read basic Page details (such as name, ID and linked Instagram account) and obtain the Page access token needed for Page-linked ads. |
pages_manage_ads |
Create lead forms and ads linked to your Page. |
With these permissions we access:
- the ad accounts, Business Manager assets and Facebook Pages you grant us;
- campaigns, ad sets, ads, creatives, lead forms and their performance insights; and
- a Page access token derived from your authorisation, used to create lead forms and Page-linked ads.
We create lead forms on your Page but do not retrieve or store the personal details people submit through them. We receive only aggregated lead counts as part of campaign performance data.
We use this data only to create, activate, pause, update and report on the campaigns you manage through Tasquer, and to analyse campaign performance metrics to generate optimisation recommendations, as described in section 6. New campaigns are created paused and go live only when you approve them. Meta tokens are encrypted at rest in the same way as Google tokens. We do not sell Meta Platform data or use it for any purpose other than providing the Services to you, and we process it in line with the Meta Platform Terms.
5.1 Data deletion instructions
To delete the data Tasquer holds from your Meta account:
- In Tasquer, disconnect Meta from the ad platform connections page in your workspace settings. Your stored tokens are deleted immediately.
- In Facebook, go to Settings & privacy → Settings → Business integrations, select Tasquer and choose Remove.
- To delete all remaining records, email info@tasquer.ai with the subject "Data Deletion Request" and the email address of your Tasquer account. We confirm receipt within 24 hours, delete the data within 15 days, and email you when it is done.
6. AI processing
Parts of the Platform use AI models provided by third-party AI service providers. They generate forecasts, campaign plans, ad copy, landing-page recommendations and answers to your questions. To produce an output, we send the relevant content you provide (for example a campaign brief, product details or landing-page text) to the model provider. Before sending, direct business identifiers are tokenised so the model provider sees opaque tokens rather than your confidential business data. Tokens are reinstated with the real values in the output you receive.
- We use only AI service providers whose terms require them to process this content on our behalf, solely to return the output to us, and prohibit them from using it to train their models.
- For optimisation recommendations, we also send performance metrics of your campaigns (such as clicks, leads and spend) received from Google Ads or Meta to AI service providers. We do not send them account email addresses or access tokens. Recommendations are suggestions only. Changes to a campaign are made only when you approve them.
- Data received from Google APIs is not used to develop, improve or train generalised AI or machine learning models.
- AI outputs are suggestions. You review and approve them before any campaign goes live.
7. How we share information
We share personal data only as follows:
- Service providers that process data on our behalf under written contracts. These include cloud hosting and storage (Amazon Web Services), AI model providers, email delivery, payment processing, and Google Workspace, where Website enquiries are recorded.
- Advertising platforms you connect (Google, Meta), to carry out the actions you instruct, such as creating a campaign.
- Your organisation. Administrators of your Tasquer workspace can see data within that workspace.
- Legal and safety. We share user data with public authorities only where required by law, regulation, court order or a validly issued lawful request. We review every such request for legality, disclose only the minimum information necessary, and notify affected users wherever we are legally permitted to do so. Separately, we may share limited data where strictly necessary to protect the rights, property or safety of TasquerAI, our users or others — for example, to investigate fraud or prevent harm — subject to the same minimisation principles.
- Business transfers. We may transfer data as part of a merger, acquisition, financing or sale of assets. The recipient remains bound by this policy, and we notify you before your data becomes subject to a different policy. We transfer data received from Google APIs only after obtaining your explicit prior consent, as described in section 4.4.
- With your consent, for any other purpose we describe to you when we ask.
We do not "sell" personal information or "share" it for cross-context behavioural advertising, as those terms are defined under US state privacy laws.
8. International transfers
We store data primarily in India. Some service providers, such as AI model providers, may process data in other countries, including the United States. We transfer data abroad only as permitted under the DPDP Act and any restrictions notified by the Government of India.
9. Data retention
We keep personal data only as long as needed for the purposes in this policy, then delete or anonymise it.
| Data | Retention |
|---|---|
| Google and Meta OAuth tokens | Until you disconnect the platform or your account ends; then deleted immediately |
| Account data, campaign records and connected-account data | For the life of your account, plus 30 days for export, then deleted |
| Customer business data | As set out in your organisation's agreement with us, or until your organisation asks us to delete it |
| Website enquiries | 24 months from your last contact with us |
When data is deleted from our systems, it is removed from our backups within a further 90 days. We may keep data for longer where the law requires it, for example tax and accounting records.
10. Security
We use reasonable security practices and procedures, consistent with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to protect personal data, including:
- encryption in transit (TLS);
- encryption of credentials at rest;
- role-based access controls and tenant isolation;
- secrets management; and
- logging and monitoring.
Our staff access customer data only where needed to provide support you request, fix problems, keep the Services secure or meet legal obligations. Access is limited to those whose role requires it.
No system is completely secure. If a personal data breach affects you, we will notify you, and the Data Protection Board of India and other authorities, as required by applicable law.
To report a security vulnerability, email info@tasquer.ai.
11. Your rights
Depending on where you live, you have the following rights over your personal data.
India (DPDP Act)
- Get a summary of the personal data we process and the processing activities, and the identities of others we have shared it with.
- Have inaccurate or incomplete data corrected, completed and updated.
- Have data erased when it is no longer needed.
- Withdraw consent at any time. This is as easy as giving it, and it does not affect processing done before. To withdraw, disconnect the relevant integration in your workspace settings, or email info@tasquer.ai or our Grievance Officer (section 15).
- Nominate another person to exercise your rights in the event of your death or incapacity.
- Have grievances resolved by our Grievance Officer. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India through its online platform after using our grievance process.
United States (state privacy laws, including California)
Where US state privacy laws apply to us, you may have the following rights:
- Know what personal information we collect, use and disclose, and get a copy of it.
- Have personal information corrected or deleted.
- Opt out of the sale or sharing of personal information and of targeted advertising. We do neither.
- Not be discriminated against for exercising these rights.
How to exercise your rights
Email info@tasquer.ai or contact our Grievance Officer (section 15). We may need to verify your identity before we act. An authorised agent may make a request for you with your written permission. We acknowledge your request within 24 hours and respond to it within 15 days of receipt. If your data is customer business data, we will refer your request to, or handle it as instructed by, the organisation that controls it.
12. Children
The Services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Cookies
The Website does not use advertising or analytics cookies. The Platform uses strictly necessary cookies and similar browser storage to keep you signed in, remember your session settings and protect against misuse. If we introduce non-essential cookies, we will update this policy and ask for your consent where required.
We do not currently respond to browser "Do Not Track" signals, as there is no common standard for them. Because we do not track you across other websites, this does not change how we treat your data.
14. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date. If changes are material, we will notify you by email or in the Platform at least 30 days before they take effect. Where the law requires it, we will ask for your consent again.
15. Contact and Grievance Officer
For questions, requests or complaints about this policy or your personal data, contact:
Grievance Officer
Kalyani Anumalla
TasquerAI Private Limited
No. 472/7, Balaji Arcade, A.V.S. Layout, Ejipura, Bangalore South, Bengaluru, Karnataka – 560095, India
Email: Kalyani.Anumalla@tasquer.ai
General privacy enquiries: info@tasquer.ai
We acknowledge grievances within 24 hours and resolve them within 15 days of receipt.