Privacy notice
To be completed: Lawyer to review the whole notice against the Digital Personal Data Protection Act, 2023 and the DPDP Rules, and to confirm or replace the wording of every section. The facts below (what is collected, why, who receives it, how long it is kept) describe how the app is built.
1. Who we are
toog ai business is run by To be completed: legal name of the company (Data Fiduciary), its registered address and CIN. It helps shop owners make product photos, list products on Shopify, post to Facebook, Instagram and Google, and run ads on Meta and Google.
Privacy and grievance contact: support@listing.toog.ai. To be completed: name of the Grievance Officer / contact person, if the company names one
2. Data we collect
| What | Details | Where it comes from |
|---|---|---|
| Account | Mobile number, e-mail address (Google or Apple sign-in), name, sign-in method, your sign-in IDs, the version of this notice and of the Terms you accepted and when | You, when you sign in with phone OTP, Google or Apple (through Firebase Authentication) |
| Business profile | Business name, category, logo, brand colours, address and the map pin you place, contact phone, website, GSTIN, caption languages and brand voice | You, in business setup and the profile |
| Your content | Product photos you take or choose, model photos created for you, product details (title, price, stock, variants, collections), captions, posts, schedules and ad campaigns | You, and the AI features you use |
| Connected channels | Your Facebook Page, Instagram account, Google Business Profile locations, Shopify shop and ad account IDs and names, and the access tokens those services give us (stored encrypted) | Meta, Google and Shopify, when you connect them |
| Posts and ad results | Reach, likes, comments and ad results (spend, impressions, clicks) of what you published through the app | Meta, Google and Shopify |
| Wallet | Your credit balance and history, and recharge records (amount, credits, payment reference). Card, UPI and bank details are entered in the RiEtail payment portal and are never seen or stored by the app | The app and the payment portal |
| Support requests | Topic, subject, message and an optional screenshot | You, in Help |
| Device | Push notification token, phone platform (Android or iOS) and app version | Your phone |
| Usage and crashes | App events (for example "business created", "post published") and crash reports, without your name, phone number or e-mail | Firebase Analytics and Crashlytics in the app |
The app asks for camera and photo-library access only when you take or choose a photo. It does not read your phone's location: the shop's map pin is placed by you.
3. Why we use it
- To sign you in and keep your account secure (including limits on repeated attempts and checks that requests come from the real app).
- To run the features you use: model photos, captions and product text made with AI, your catalogue, Shopify listings, posts, schedules and ads.
- To publish or list content on Facebook, Instagram, Google Business Profile, Shopify, Meta Ads and Google Ads, only when you ask for it.
- To keep your credit wallet, add credits after a recharge and keep the records the law requires.
- To send you notifications about your posts, photos, wallet, channels and ads.
- To answer your support and privacy requests.
- To find and fix errors and to understand, in totals, how the app is used.
To be completed: Lawyer to state the legal ground for each purpose (consent given at sign-up, legitimate uses under the DPDP Act) and how consent can be withdrawn.
4. Who receives your data
We do not sell your data. These service providers receive only what each needs:
| Provider | Data sent | Where |
|---|---|---|
| Firebase Authentication (Google) | Phone number, e-mail, name, sign-in provider | Google, global / USA |
| Firebase Cloud Messaging, Analytics and Crashlytics (Google) | Device push token, app events, crash reports — no names or phone numbers | Google, USA |
| Anthropic (Claude AI) | Product photos, business name and category, product details and caption hints — never your name, phone or e-mail | Anthropic, USA |
| Our image-generation service | Garment photos and the model photos made from them | Our company's AWS accounts, Mumbai, India |
| Meta (Facebook, Instagram), Google Business Profile, Shopify | Only what you publish or list: photos, captions, product data, page / location / shop IDs | Each platform, global |
| Meta Marketing API and Google Ads API | For ads you launch: ad text, product photos (Meta), link, your shop pin and radius or chosen cities, budget and dates, your ad account ID. Ads run in your own ad account and the platform bills you directly | Each platform, global |
| RiEtail payment portal | Business ID, owner name, phone, e-mail, GSTIN and state, to identify your store and issue GST receipts when you recharge | To be completed: where the payment portal is hosted and who runs it (open item A16) |
| Amazon SES (AWS) | Your support request text and business name, to e-mail them to our support team | AWS Mumbai, India |
| Google Maps | Map tiles are loaded by your phone; the pin's coordinates stay with us |
When you publish to Meta, Google or Shopify, their own privacy policies apply to the content there. To be completed: Lawyer to add any disclosure to authorities or in a sale of the business, if the company wants to state it.
5. Where your data is stored
Our own databases and files are in India: MongoDB Atlas and Amazon Web Services in Mumbai (ap-south-1). Some providers listed above process data outside India, as shown in the table.
6. How long we keep it
| Data | Kept for |
|---|---|
| Your account, business profile, products and connected channels | Until you delete your account (removed within 24 hours of the request) |
| Original photos you upload for a photoshoot | 30 or 90 days, as you choose in Studio settings |
| Model photos you did not keep | 30 days after the photoshoot ends |
| Photoshoot records | 12 months (photos you added to a product stay with the product) |
| Posts and their images | 13 months after the post ended (ready-made post images: 7 days) |
| Ad campaigns and their daily results | 13 months after the campaign ended |
| Products you deleted | 30 days, then removed with their photos |
| Daily reach and usage figures | About 13 months (400 days) |
| Support requests and screenshots | 12 months after the request is closed |
| Credit history and recharge records | 8 years, as GST law requires — these records hold no name, phone, e-mail or GSTIN, and their notes are blanked after 12 months |
| Records of actions by our support team | 3 years, with IDs only — no personal details |
| Server logs | 90 days |
| Database backups | Backup copies age out after 7 days |
To be completed: Lead to confirm how long Firebase Analytics and Crashlytics keep app events and crash reports (the Firebase project's data-retention setting).
7. Deleting your account
You can delete your account in the app at any time: More › Delete account. Everything except the records the law requires us to keep is removed within 24 hours. See how account deletion works.
8. Your rights
- Summary of your data: ask for a summary of the personal data we hold about you and the providers it is shared with.
- Correction: change your name and business details yourself in the app's profile, or ask us.
- Erasure: delete your account in the app (see section 7).
- Grievance: raise a complaint about how your data is handled.
To make a request, use More › Help › Contact support with the topic Privacy or my data, or e-mail support@listing.toog.ai. We answer by e-mail within 30 days. To be completed: Lawyer to add the right to nominate, the right to complain to the Data Protection Board of India and any shorter answer time the DPDP Rules set.
9. How we protect your data
- All connections use HTTPS (TLS 1.2 or newer).
- Access tokens from Meta, Google and Shopify are encrypted with AWS KMS.
- Each business can only reach its own data, and changes made by our support team are recorded in an audit log.
- Sign-in uses one-time codes or Google / Apple sign-in; sessions end when you log out or delete your account.
10. Children
To be completed: Lawyer to state the minimum age to use the app (the app is meant for shop owners) and what happens if a child's data is found.
11. Changes to this notice
When this notice or the Terms change, the version number above changes and the app shows the new version once before you continue; you can accept it or log out and ask us to delete your account.
12. Contact
E-mail support@listing.toog.ai. See also the Terms of use.