Privacy Policy
Last updated 17 October 2026
The short version. We read your marketing numbers (ad spend, leads, followers, website visits) only to show them to you. Access is read-only, so we can never change your ads or post anything. Your data is encrypted, stored in India, never sold, and you can download or delete it at any time.
1. Who we are
Company's Board (at companysboard.com) is a marketing reporting service run by ADWERDO, Gota, Ahmedabad, Gujarat, India ("we", "us"). Under India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here. This policy also explains how we meet the Meta Platform Terms and the Google API Services User Data Policy.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Your name, email address, password (stored only as a one-way hash), business names, currency | You, when you sign up |
| Connection details | Access tokens from Meta and Google (encrypted), the name of the Facebook or Google login used, IDs and names of the ad accounts, Pages, Instagram profiles and websites you choose to track | Meta and Google, when you connect |
| Marketing numbers | Daily totals: ad spend, impressions, clicks, leads, conversions, reach, views, followers, website visits, pages viewed; campaign names and totals; your own published posts' captions, thumbnails, links and interaction counts | Meta and Google APIs, read-only |
| Demo bookings | Your name, email, mobile number, business name, the time you picked and anything you tell us, so we can give you the demo | You |
| Chat messages | What you write in the website chat, and your name and email if you ask for our team, so we can reply | You |
| Payment records | Plan, payment status, amount and Cashfree reference. Never your card, UPI or bank details | Cashfree |
| Security records | Sign-ins, failed attempts, security changes, with IP address, browser and time | Your use of the service |
We do not collect or store: private messages, comments' authors, details of the people who see or click your ads, your customers' personal data, your contacts, or any data from accounts you don't choose to track. Website figures come from Google Analytics as totals; we never receive individual visitors' identities.
3. How we use it, and on what basis
When you create an account and tick the box agreeing to this policy, and again when you connect each platform, you give your consent for the following purposes only:
- Showing your dashboards, summaries, charts and downloads.
- Sending the weekly summary email (you can switch it off in Settings) and essential account emails: password resets, security alerts, payment and data-deletion notices.
- Billing your subscription.
- Keeping the service secure: detecting password guessing, alerting you to new sign-ins, investigating misuse.
We do not use your data for advertising, profiling, selling, or training artificial intelligence or machine-learning models. You can withdraw consent at any time by disconnecting a platform or deleting your account. Withdrawal doesn't affect what was done before it.
4. Data from Meta (Facebook, Instagram, Meta Ads)
When you connect with Facebook, you choose which ad accounts, Pages and Instagram accounts to share. We request read-only permissions (ads_read, pages_show_list, pages_read_engagement, read_insights, instagram_basic, instagram_manage_insights, business_management) and use the data solely to show your own reports. We follow the Meta Platform Terms and Developer Policies: we don't sell, license or share Meta data, and we delete it when you disconnect, delete your account, or ask us to.
Removing access: disconnect in Connected accounts (we also ask Meta to revoke our access), or remove Company's Board in Facebook under Settings & privacy › Settings › Business integrations. Data deletion requests can be made as described in section 10.
5. Data from Google (Google Ads, Google Analytics)
Company's Board's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We request read-only access to Google Ads reporting and Google Analytics (adwords, analytics.readonly) plus your email address to label the connection.
- Google data is used only to provide the reporting features you see in the app.
- We don't transfer it to others except as needed to run the service (our hosting provider), to comply with law, or as part of a merger with your notice.
- We don't use it for advertising, and no person reads it unless you ask us to for support, it's needed for security, or the law requires it.
- We don't use it to develop, improve or train generalised AI or ML models.
Removing access: disconnect in Connected accounts (we also revoke the token with Google), or visit your Google Account permissions.
6. Who we share it with
We never sell personal data. We share it only with service providers who process it on our instructions, under contracts that require them to keep it secure:
| Provider | What for | What they receive |
|---|---|---|
| Hostinger | Servers and database | All data stored by the service (encrypted where described in section 9) |
| Cashfree Payments | Subscription payments | Your name, email, mobile number, plan and the payment details you enter on Cashfree's own form |
| Brevo (Sendinblue) | Sending our emails: sign-in codes, reminders, summaries, reports and, if you agreed, tips and offers | Your name, email address and the content of those emails. Brevo records whether emails are delivered, opened or clicked |
| Meta and Google | Supplying your marketing numbers | Requests made with your tokens; they already hold this data |
We may disclose data if required by Indian law, a court order or a lawful request from a government authority, and we'll tell you unless we're legally prevented from doing so.
7. Where it's stored
Our servers are in India. Meta, Google, Cashfree and Brevo process data on their own infrastructure under their own policies. We don't transfer your data to any country the Government of India restricts.
8. How long we keep it
- Account and connection details: while your account is open.
- Daily marketing numbers and posts: up to 25 months, so you can compare with last year. Older figures are deleted automatically.
- Businesses without an active plan: after 90 days without access, we delete their connected accounts and numbers. We email you 7 days before.
- Deleting your account: removes your account, businesses, tokens and numbers immediately, and we ask Meta and Google to revoke our access. Backups containing it are overwritten within 30 days.
- Security records: 13 months, as Indian rules require logs to be kept for at least a year to detect and investigate breaches. They are kept even after an account is deleted, then erased.
- Demo bookings: 12 months after the demo.
- Chats: conversations with only the assistant for 90 days; conversations with our team for 12 months.
- Payment records: as long as tax law requires (generally 8 years for GST records), with no card or bank details.
9. How we protect it
In summary: HTTPS everywhere; Meta and Google tokens encrypted with AES-256-GCM; passwords hashed with Argon2id; optional two-step verification (mandatory for our administrators); protection against password guessing; automatic sign-out; new-device sign-in alerts; strict browser security policies; least-privilege, read-only access; logs that never contain secrets. Read the full list on How we protect your data.
10. Your rights
You can:
- Access a summary of your data and a copy of it: Settings › Download my data, and CSV downloads of your numbers.
- Correct or update your name, business details or connections at any time in the app.
- Erase data: disconnect a platform, delete a business, or delete your whole account in Settings. Or email privacy@companysboard.com with the subject "Data deletion request" from your account email; we confirm and complete it within 7 days.
- Withdraw consent by disconnecting or deleting, as above.
- Nominate someone to exercise these rights if you die or become incapacitated, by emailing us.
- Raise a grievance with our Grievance Officer (section 15). We reply within 30 days at most (the law allows up to 90). If you're not satisfied, you can complain to the Data Protection Board of India.
If you live outside India (for example in Australia or the EU), you have similar rights under your local law, and you can use the same channels.
11. Cookies
We use a single essential cookie to keep you signed in. It's secure, can't be read by scripts, and expires when you sign out or after a period of inactivity. We use no advertising, analytics or tracking cookies, and our fonts are hosted on our own server, so loading our pages doesn't tell third parties you visited.
12. Children
Company's Board is for businesses and is not meant for anyone under 18. We don't knowingly collect children's data. If you believe a child has created an account, contact us and we'll delete it.
13. If something goes wrong
If a personal data breach affects you, we will tell you promptly, in plain language: what happened, what it may mean for you, what we're doing about it, what you can do, and who to contact. We also report it to the Data Protection Board of India as the law requires (initial notice immediately and a full report within 72 hours).
14. Changes to this policy
If we change how we use your data, we'll update this page and email you before the change takes effect. Where the law requires, we'll ask for your consent again.
15. Contact and Grievance Officer
Grievance Officer: Jay Gohel, ADWERDO, Gota, Ahmedabad, Gujarat, India
Email: privacy@companysboard.com
General support: support@companysboard.com
To report a security issue, email security@companysboard.com.