DatA+ ("we", "us") is an SEO and analytics application operated by an individual sole proprietor registered in India (Udyam registered). This policy explains what personal data we handle, why, how long we keep it, and what you can make us do about it.
Contact for anything in this policy, including data requests and complaints: privacy@datapls.in.
This distinction runs through the whole policy, so it comes first.
We do not request any permission to write to your Google accounts. We do not collect special-category data (health, biometrics, beliefs, and so on), we do not buy personal data from anyone, and we do not sell or rent personal data to anyone. Your data and your clients' data are never used to train our own or any third party's AI models.
| What | Why | Lawful basis (GDPR) |
|---|---|---|
| Account data | Create and secure your account, contact you about the service | Performance of a contract |
| Connected Google data | Sync, store and analyse it to produce insights, audits and reports | Performance of a contract, and your consent at the Google permission screen |
| Credentials | Apply a change you have explicitly approved | Performance of a contract |
| Audit logs | Security, abuse investigation, showing who changed what | Legitimate interests (running a secure service) |
| Payment records | Take payment, meet Indian tax and accounting obligations | Performance of a contract, and legal obligation |
| Marketing-site analytics | Understand how the site is used | Consent, which you can withdraw at any time |
Under India's Digital Personal Data Protection Act 2023 we process personal data for these same purposes on the basis of consent or, where the Act permits, for the legitimate uses it defines.
Our AI features send compact, pre-aggregated numbers (for example: a page path, its clicks and its average position) to Google Gemini or Anthropic Claude to draft a recommendation. Every recommendation is checked against your real data before you see it. These providers do not train their models on data sent through their APIs. You can supply your own API key instead, or leave the AI features switched off.
These are enforced by a job that runs every night, not merely stated here.
| Data | Kept for |
|---|---|
| Search Console, Analytics and ad performance data | A rolling 16 months. Anything older is deleted automatically. |
| Audit logs | 12 months, then deleted automatically. |
| Everything in a closed or suspended workspace | 30 days after it closes, then permanently deleted. The 30 days exist so an accidental closure or a failed payment can be undone. |
| An account you delete yourself | Deleted immediately, with no grace period. |
| Payment and invoice records | As long as Indian tax law requires, currently up to 8 years. These contain no analytics data. |
Only the subprocessors below, each under a contract with equivalent data-protection obligations. We will give notice before adding a new one.
| Provider | Purpose | Where |
|---|---|---|
| Google (APIs and Sign-In) | Search Console, Analytics and Ads data; authentication | Global |
| Neon | Database hosting | EU / US |
| Vercel | Application hosting | Global edge |
| Google (Gemini) | AI recommendations | US |
| Anthropic (Claude) | AI recommendations | US |
| Resend | Sending report emails | US |
| Razorpay | Payment processing | India |
| Google Analytics | Usage measurement on our marketing site, only with your consent | US |
We also disclose data if the law requires it, and we will tell you unless we are legally prevented from doing so.
Whoever and wherever you are, you can ask us to give you a copy of your data, correct it, delete it, or export it. Export and deletion are self-serve in the app under Settings, "Your data". For anything else, email privacy@datapls.in. We answer within 30 days.
You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting processing already carried out. You may complain to your national supervisory authority.
You have the right to access a summary of your personal data and our processing of it, to correction and erasure, to nominate another person to exercise your rights if you die or become incapacitated, and to a grievance redressal process. Please raise a grievance with our Grievance Officer below before approaching the Data Protection Board.
You have CCPA/CPRA rights including access, deletion, correction, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined.
As required by the DPDP Act 2023 and India's IT Rules, complaints about how we handle personal data go to our Grievance Officer at privacy@datapls.in. We acknowledge within 24 hours and resolve within 30 days.
If a personal data breach affects you, we will notify you without undue delay, and where the GDPR applies, the relevant supervisory authority within 72 hours of becoming aware of it. Where the DPDP Act applies, we will notify the Data Protection Board of India and each affected person as the Act requires. Where you are the controller and we are your processor, we notify you without undue delay so that you can meet your own deadlines, as set out in the DPA.
Google access is read-only. Credentials are encrypted at rest with AES-256-GCM under a key held separately from our session-signing key. All traffic is served over HTTPS with HSTS. Access to production data is limited to the operator. Every write to a connected CMS is recorded with its previous value so it can be reversed.
We are based in India and our providers operate in the EU and the US, so your data may be processed outside your country. Where the GDPR applies we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one exists.
The app uses a single essential cookie to keep you signed in. We use no advertising or cross-site tracking cookies anywhere.
This marketing site uses Google Analytics 4 to measure how it is used. It is off until you accept it: nothing is requested from Google and no analytics cookie is set unless you choose "Accept" on the banner. Declining is a real choice and is remembered. You can change your mind at any time through the Cookie settings link in the footer of every page. Your choice is stored in your browser's local storage, which is what lets us not ask again.
DatA+ is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, email us and we will delete it.
We will post any update here and change the date at the top. If a change materially affects your rights we will email you before it takes effect.