Privacy policy

Who we are

This policy explains what Bigtam collects, why, and how to get rid of it. It covers this website (gobigtam.com), our Andromeda alignment check, our agency services, and Bigtam Console (console.gobigtam.com). It is written for what exists today; where something is a limitation rather than a promise, it says so.

Bigtam is operated by Bigtam Technologies Pvt Ltd, Pune, Maharashtra, India ("Bigtam", "we"). We decide how your personal data is used, which makes us the data fiduciary (data controller). Contact: privacy@gobigtam.com.

What we collect

When you apply for an Andromeda alignment check

Your name, work email and brand website. We use them to prepare your check and to contact you about it. To prepare the check we review the ads your brand publishes publicly, including in the Meta Ad Library; that is information about your brand's advertising, not about you.

When you work with our agency

Contact details of the people we work with, what you tell us by email, WhatsApp, phone or video call, and the business and billing details needed for proposals, invoices and tax. If you give our team access to your Meta ad account to run campaigns, that access is governed by your agreement with us and by Meta's own terms.

Your Bigtam Console account

When you sign in we store your email address and the sign-in identifier from your provider. We do not store a password: authentication is handled by Google or by a one-time email code.

Content you give the Console

Videos, images and product pages you upload or point us at, and everything the Console produces from them: creative analyses, funnels, briefs and ad names. This is stored against your workspace and is visible only to members of your account.

Meta advertising data

If you connect a Meta ad account in the Console, we read, with the ads_read permission and nothing else:

• the list of ad accounts your Meta login can access, so you can choose one;
• the ads in the account you chose, and their names;
• ad-level performance for those ads: spend, impressions, purchases, revenue, clicks and video views, by day.

What we do not read or receive: any personal information about people who saw or clicked your ads, your custom audiences or customer lists, your payment details, your Meta messages, or anything from a Page beyond the ads themselves. Meta does not give us individual-level data and we do not ask for it.

The Console never writes. It cannot create, edit, pause, duplicate or delete a campaign, ad set or ad. It holds no permission that would allow it.

What we deliberately do not collect

We do not run third-party advertising or analytics trackers on this website. Our hosting provider keeps standard server logs (such as IP address and pages requested) to run the site securely, and our pages load fonts from Google Fonts, which receives your IP address when you visit. The Console uses essential cookies to keep you signed in. If we ever add analytics or advertising tools, we will update this policy first and ask for consent where the law requires it.

How the Meta connection is secured

Connecting an ad account gives the Console an access token. How that token is stored is the most security-sensitive decision in the product, so it is worth being specific:

• The token is exchanged and stored entirely on our servers. It is never sent to your browser and never appears in a web page, a URL or a link.
• It is held in a separate database table that the application's public key cannot read. Only privileged server-side code can reach it.
• Data is encrypted in transit, and encrypted at rest by our hosting provider at the storage layer. We do not claim application-level encryption of the token itself, because that is not what we have built.
• The token expires on Meta's schedule, and you can revoke it at any time; see Data deletion.

How we use it

• To prepare your Andromeda alignment check and talk to you about it.
• To deliver agency work you have agreed with us.
• To provide the Console: sign-in, decodes, funnels, briefs and reports for your account.
• To send service messages, such as sign-in codes, report notifications and invoices.
• To keep our systems secure and meet legal, tax and accounting obligations.

We use data from a connected Meta ad account only to provide the Console's features to your account. We do not sell any of your data.

Legal basis

Under India's Digital Personal Data Protection Act, 2023, we process personal data with your consent, which you give when you apply for a check, sign in to the Console or connect an ad account, and for the legitimate uses the Act allows, such as complying with law. You can withdraw consent at any time; this does not affect processing already done.

If you are in the European Union, the United Kingdom or another region with similar laws, we rely on performing a contract with you, our legitimate interest in replying to business enquiries and running our services securely, your consent where we ask for it, and our legal obligations.

Who else processes your data

Content you upload may be processed by these providers to produce the outputs you asked for. We do not permit these providers to use it to train their own models on our behalf. We may also disclose data where the law requires it.

Where your data is held

Our infrastructure is hosted with the providers above, which operate internationally. Data may therefore be processed outside India and outside your own country. If you need to know the specific region for a deployment, ask us and we will tell you.

How long we keep it

• Check applications and enquiries: up to 24 months after our last contact, unless you become a client, or until you ask us to remove them.
• Console account and workspace content: while your account is open.
• Meta tokens: until you disconnect, until you revoke access at Meta, or until they expire, whichever happens first.
• Imported performance figures: while the connection exists. They are aggregate numbers about your own ads, containing nothing about individual people.
• Billing records: for as long as tax and company law require.

After an account is deleted, backups roll off within 30 days. We may keep a minimal record of the fact of an account and its billing history where law requires it.

Your choices and rights

Disconnect Meta

In the Console, open Connections and press Disconnect. This asks Meta to revoke our access and deletes the stored token. You can also revoke it yourself in Facebook under Settings & privacy → Settings → Business integrations.

Delete, see or correct your data

See Data deletion for what gets removed and how to ask. You can also request a copy of what we hold about you, ask us to correct it, withdraw consent, object to a particular use, or (in India) nominate someone to exercise these rights for you. Write to privacy@gobigtam.com; we reply within 30 days.

If you are not satisfied with our answer, you can escalate to our Grievance Officer below, and then to the Data Protection Board of India or your local data protection authority.

Security

We protect data with encryption in transit, row-level access controls that keep each account's data separate, and limited staff access. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

Children

Bigtam is a business service and is not intended for anyone under 18. We do not knowingly collect data from children.

Changes

If we change this policy in a way that materially affects how your data is handled, we will email Console account holders rather than only updating the date at the top.

Contact and Grievance Officer