Privacy Policy

Section 01

Who We Are

AITLAS is an AI visibility and Answer Engine Optimisation (AEO) platform operated by Shiprocket Limited ("Shiprocket", "we", "our", or "us"), a company incorporated under the Companies Act, 1956 (as amended), previously known as Shiprocket Private Limited and originally known as Bigfoot Retail Solutions Private Limited.

Registered Office:
Plot No. B, Khasra No. 360, M.G. Road, Sultanpur,
Gadaipur, Mehrauli, South Delhi – 110030, India

Corporate Office:
416, Udyog Vihar Phase III, Sector 20,
Gurugram, Haryana – 122008, India

For the purposes of the Digital Personal Data Protection Act, 2023, Shiprocket is the Data Fiduciary in respect of the personal data described in this Policy; where AITLAS processes personal data on behalf of a merchant or business customer, Shiprocket acts as a Data Processor under the applicable data processing agreement.

We are committed to protecting the personal information of all individuals who access our website, platform, or services ("you" or "User").

Section 02

Information We Collect

We collect information that you consciously provide to us for the purpose of using our services, as well as technical data generated as a natural result of your use of the platform.

Information You Share Directly

• Contact Details: Name, email address, phone number, company/brand name
• Account Information: Login credentials, profile details, and preferences you configure
• Payment Information: Billing details processed securely through third-party payment gateways (we do not store card data)
• Communications: Messages, queries, and feedback you submit through contact forms or email

Information Collected Automatically

• Technical Data: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, session duration, referring URLs, and click-path data
• Log Data: Server logs, error reports, and activity timestamps

Information from Third Parties

• Data from integrated platforms or APIs you choose to connect to AITLAS
• Publicly available information relevant to AI visibility analysis (brand mentions, AI engine responses)
• Analytics and advertising partners, subject to their own privacy policies

Section 03

How We Collect It

• Directly from you when you register, submit forms, or communicate with us
• Automatically through cookies, pixels, and similar tracking technologies as you use our platform
• From third-party services you authorise to share data with us (e.g., Shopify, analytics tools)

Section 04

Google API Data — Access, Use, Storage & Sharing

AITLAS integrates with Google APIs — including the Google Search Console API and Google Analytics API — to surface your brand's organic search and web analytics data inside the platform dashboard. This section explains exactly how we handle data obtained through those APIs, in compliance with Google API Services User Data Policy, including the Limited Use requirements.

What Google Data We Access

• Google Search Console: Query-level performance data (keywords, impressions, clicks, average position), page-level URL performance, and crawl/index coverage reports for domains you have verified and connected to AITLAS
• Google Analytics (GA4): Traffic metrics (sessions, users, bounce rate), acquisition channel data, and page-level engagement data for properties you authorise
• We request only the minimum OAuth scopes necessary: webmasters.readonly for Search Console and analytics.readonly for Analytics

Why We Access It

• To display your organic visibility and website performance data within your AITLAS dashboard
• To correlate AI engine visibility metrics with search and traffic trends, generating brand intelligence reports
• To alert you to significant changes in your search or traffic performance

How We Store It

• Fetched Google data is stored in encrypted, access-controlled databases hosted on secure cloud infrastructure
• Data is retained for the duration of your account and up to 90 days after you disconnect the integration or close your account, after which it is permanently deleted
• We do not persist raw Google user data beyond what is required to power your dashboard and historical trend views

How We Share It

• We do not sell, share, or transfer your Google data to any third party for advertising, profiling, or any purpose other than operating the AITLAS service for you
• Data is not used to train machine learning models or for any purpose unrelated to providing the features you explicitly authorise
• Sub-processors (cloud hosting and infrastructure providers) may process this data solely to provide infrastructure services, under strict data processing agreements and confidentiality obligations

Revoking Access

• You may disconnect Google integrations at any time from your AITLAS account settings (Settings → Integrations → Disconnect)
• You may also revoke access directly from your Google Account permissions page
• Revoking access stops all future data fetching immediately. Existing cached data will be deleted within 90 days

Our use of Google API data adheres to the Google API Services User Data Policy, including the Limited Use restrictions. We access Google user data only to provide or improve user-facing features of AITLAS, and for no other purpose.

Section 05

How We Use Your Information

We process your personal information for the following purposes, relying on legitimate interest, contractual necessity, legal obligation, or your consent:

• Providing, operating, and improving the AITLAS platform and services
• Creating and managing your account
• Processing transactions and sending related communications
• Responding to queries, support requests, and feedback
• Sending product updates, newsletters, and marketing communications (where you have opted in)
• Conducting AI visibility analysis and generating brand intelligence reports
• Personalising your experience on the platform
• Detecting and preventing fraud, abuse, and security incidents
• Complying with applicable laws and regulatory requirements
• Analysing platform performance and conducting research to improve our services

We collect only such personal information as is necessary to fulfil the purposes described above and process such information in a manner consistent with those purposes. Any processing beyond these purposes shall be undertaken only with your consent or as permitted under applicable law.

We shall not utilise your personal information for the purpose of training any third-party artificial intelligence or machine learning models, and shall not undertake any automated decision-making which produces a legal effect or similarly significant effect concerning you.

Section 06

Sharing Your Information

We do not sell or rent your personal information to third parties.

We may share your information only in the following circumstances:

• Service Providers: With trusted vendors who assist in platform operations (hosting, analytics, payment processing, email delivery) under strict confidentiality obligations. We make user information accessible to our employees and data processors only on a need-to-know basis and for the purposes set out in this Policy
• Shiprocket Group: With affiliated entities within the Shiprocket group for internal operational purposes. Where these entities have access to your personal information, we take adequate steps to ensure they adopt at least a reasonable level of security practices and procedures as required under applicable law
• Legal Compliance: When required by law, court order, or government authority under Indian law (including the Information Technology Act, 2000)
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections
• With Your Consent: For any other purpose disclosed to you at the time of collection

Cross-Border Disclosure and Transfer: We may disclose or transfer your personal information to service providers located outside India, including in the United States of America and the European Union, to the extent necessary on a need-to-know basis to render the services. Any such transfer shall be undertaken only to territories permitted under applicable law, and we take adequate steps to ensure that such recipients adopt at least a reasonable level of security practices and procedures as required under applicable law.

Section 07

Cookies & Tracking Technologies

We use cookies and similar technologies (pixels, web beacons, local storage) to:

• Keep you logged in and remember your preferences
• Understand how you use the platform (analytics)
• Measure the effectiveness of marketing campaigns
• Improve platform performance and user experience

You can manage or disable cookies through your browser settings. Note that disabling certain cookies may affect platform functionality. We honour browser-based Do Not Track signals where technically feasible.

Section 08

Data Security

We implement industry-standard technical and organisational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and role-based permissions
• Secure cloud infrastructure with recognised security certifications
• Regular security reviews and vulnerability assessments

While we take every reasonable precaution, no method of transmission over the internet is 100% secure. In the event of any breach of your personal information, we shall notify you and the Data Protection Board of India within the timelines prescribed under applicable law, and shall communicate to you, in plain language, the nature of the breach and the measures you may take to protect your interests.

Section 09

Data Retention

We retain personal information for as long as necessary to:

• Provide our services and maintain your account
• Comply with legal, accounting, or reporting obligations
• Resolve disputes and enforce our agreements

Upon account closure, your personal data will be deleted or anonymised within 90 days, unless a longer retention period is required by law. Contact information from enquiries is retained for up to 12 months before deletion. Technical and security logs shall be retained for a period of up to 24 months.

Any personal information collected or processed in accordance with this Policy shall be retained until the purpose for usage exists and/or until we are obligated to retain the same for compliance with applicable law, or until you withdraw your consent, or until you exercise the right to erasure, whichever occurs earlier. We may retain personal information for longer periods where: (a) it is necessary for compliance with applicable law; (b) there is a pending legal or regulatory proceeding; (c) safety, security, and integrity purposes require it under applicable law; or (d) any judicial or governmental investigation requires it.

Prior to erasure upon expiry of the applicable retention period, we shall, where required under applicable law, give you advance notice so as to enable you to access your account or exercise your rights. We may retain non-personally identifiable data indefinitely or to the extent allowed by applicable law.

Section 10

Your Rights

Under applicable Indian law (including the Digital Personal Data Protection Act, 2023) and as a matter of our policy, you have the right to:

• Access: Request a copy of the personal data we hold about you, and a summary of the entities with whom it has been shared
• Correction: Request correction of inaccurate or incomplete information
• Erasure: Request deletion of your personal data, subject to legal retention requirements
• Withdrawal of Consent: Withdraw consent for any processing based on consent, without affecting prior lawful processing. Note that withdrawal of consent will not be retrospective
• Opt-out of Marketing: Unsubscribe from promotional communications at any time via the link in our emails or by contacting us
• Nomination: Nominate another individual to exercise your rights in the event of your death or incapacity (as provided under the DPDP Act, 2023). In the case of a child or a person with disability, these rights may be exercised by a parent or lawful guardian

To exercise any of these rights, use the privacy controls within your account (Settings → Privacy) or contact us at [email protected]. We will respond within 30 days of receipt.

Please note that if you do not provide your information or consent, or subsequently withdraw your consent, we reserve the right to discontinue, in part or full, the services or associated features for which the said information was sought.

Section 11

Third-Party Links

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

Section 12

Children's Privacy

AITLAS is not intended for use by individuals under the age of 18. In accordance with applicable laws, we do not knowingly provide services to, or process the personal information of, any individual below the age of 18 years ("Child") without prior verifiable consent of the child's parent or lawful guardian.

Verifiable Parental / Guardian Consent: Before processing the personal information of a Child, or of a person with disability who has a lawful guardian, we shall obtain verifiable consent in the manner prescribed under applicable laws. This may include verification through reliable identity information, authorised government-issued digital tokens, or other approved techno-legal mechanisms.

Prohibition on Tracking, Monitoring and Targeted Advertising: We do not engage in tracking, behavioural monitoring, profiling, or targeted advertising directed at Children, in compliance with applicable laws.

Special Safeguards: We shall implement all additional safeguards required for processing Children's personal information and the personal information of persons with disability with lawful guardians, including restrictions on purpose limitation, storage limitation and strengthened security controls as mandated under applicable laws.

If you believe we have inadvertently collected personal information from a minor, please contact us immediately at [email protected] and we will delete it promptly.

Section 13

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Post the updated policy on this page with a revised "Last Updated" date
• Notify registered users via email or an in-platform notification

We shall notify you regarding this Policy and any changes periodically and at least once a year. Where any such change materially affects the processing undertaken on the basis of your consent, we shall give you advance notice and, where required under applicable law, obtain your consent afresh prior to such change taking effect.

Your continued use of AITLAS after the updated policy is posted constitutes your acceptance of the changes.

Section 14

Contact & Grievance Redressal

For any questions, concerns, or complaints regarding this Privacy Policy or our data practices, please reach us through the appropriate channel below:

Please include your full name, registered email address, and a clear description of your concern when contacting the Grievance Officer. If you are not satisfied with our resolution, you may approach the appropriate regulatory authority under the Digital Personal Data Protection Act, 2023.