Legal
Privacy policy.
Last updated 23 October 2026
Privacy policy of Studio Aight, a service of Ashva Intelligence Pvt Ltd, 683, Basai Road, Near Mother Dairy, Basai, Gurugram, Haryana 122001, India. Covers the website, the service, its API and its chat-app connector. Notice under India's Digital Personal Data Protection Act, 2023 and its Rules.
"Customer": the business or person using Studio Aight.
Data collected
Account
Email address, company name, billing country. Purpose: the account, sign-in, invoices.
Email sign-up
A 6-digit code sent to the email address. Purpose: confirming the address.
Briefs and orders
Briefs, changes, answers, plans, approved prices, delivered files, feedback. Purpose: making and delivering orders; the record of each order.
Brand files
Logos, product photos, videos, voice recordings; brand name, colours and style. Purpose: the customer's own orders only.
Photo links
Only the links the customer gives are downloaded.
People in files
Faces, voices and words of people in uploaded files. By uploading, the customer confirms the right to use every file and the permission of anyone shown in it. Purpose: the customer's own orders only. See AI content and consent.
Payments
Payment amounts, invoices, refunds. Card and UPI details: handled by Razorpay; never seen or stored by Studio Aight.
Logs (automatic)
Technical records of requests and errors. Purpose: security; keeping the service working.
Connected accounts
Only when the customer connects one. See Connected accounts.
Results
Numbers the customer chooses to share about how an ad ran (for example spend, views, clicks), with the customer's yes. Numbers only; never names, comments or messages.
Cookies
- No cookies on the website. Session storage only: a brief typed on the home page, carried to the make page, gone when the tab closes.
- The same cookie keeps a signed-up customer signed in. No advertising or tracking cookies. No analytics that follow visitors to other sites.
Connected accounts
Connecting Instagram, Facebook, Threads, YouTube or another Google account: in development; available after Meta's and Google's reviews. When available, connecting is optional.
- Sign-in tokens: encrypted; used only by the server; never shown in replies or logs.
- Disconnecting deletes the sign-in token and what was read through it at once. Google and Facebook access: also revoked with them. A new sign-in replaces the old one.
- Removing Studio Aight in Instagram, Facebook or Threads settings ends the connection the same way.
- Data received through a connected account: shown only to the customer, in Studio Aight or in the chat app the customer uses with Studio Aight.
Instagram, Facebook and Threads (Meta)
Instagram posts linked to an order
That post's numbers: views, reach, likes, comments, shares, saves, watch time. Kept with the order while the account stays connected.
Instagram comments and mentions
On the customer's own posts: the words and the post only. The commenter's id and username are dropped on arrival. Kept 90 days, then deleted.
Facebook Login
Used only for Instagram hashtag search and competitor lookup (Business Discovery): public numbers of other accounts and public posts. Never who. Read live, shown only to the customer who asked. Not stored.
Threads
Keyword search of public posts. Words only. Read live, shown only to the customer who asked. Not stored.
Posting to Instagram
Only when the customer asks: that delivered file and the customer's own caption, to the customer's own account. Posted exactly as made. Studio Aight keeps which post it became.
YouTube and other Google accounts
Studio Aight uses YouTube API Services. Google's privacy policy: http://www.google.com/policies/privacy.
YouTube comments
On a video the customer chooses: the words, likes and dates. Commenters' names dropped. Read live, shown only to the customer who asked. Not stored.
YouTube numbers
For a video linked to an order: views, average view duration, percentage viewed, likes, shares. Kept with the order while the account stays connected.
Uploading to YouTube
Only when the customer asks: that delivered video, with the customer's own title and description, to the customer's own channel. Private unless the customer chooses otherwise. Marked as made with AI (altered or synthetic content). Studio Aight keeps which video it became.
Google Ads
Campaign clicks, impressions, CTR, average CPC and cost for the last 7 or 30 days. Reports only. Never creates, changes or spends anything. Read live, shown only to the customer who asked. Not stored.
Google Business Profile
Review ratings and words, with dates. Reviewers' names dropped. Read live, shown only to the customer who asked. Not stored.
Studio Aight's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Use: only for features the customer sees and asks for.
- Transfer: only as needed to provide or improve those features (including to the hosting provider), for security, to comply with law, or as part of a merger, acquisition or sale of assets, after notice to the customer.
- Never sold. Never used for advertising, retargeting or interest-based advertising. Never used to judge credit-worthiness or for lending.
- No person reads it, except: with the customer's yes for specific data; for security, such as investigating abuse; to comply with law; or in aggregated, anonymized form for internal operations.
- Revoke access: disconnect, or remove Studio Aight at https://security.google.com/settings/security/permissions.
- Disconnecting in Studio Aight: YouTube data deleted at once; the Google grant revoked at once.
- Access removed on Google's page: Studio Aight checks every Google grant weekly. Once Google reports it gone, the connection ends and its YouTube data is deleted at once, within about 7 days.
- Every Google grant reconfirmed at least every 30 days while YouTube numbers are kept.
Actions taken for the customer
- Posting to Instagram or YouTube: only when the customer asks; only that delivered file, to the customer's own account.
- Paused Meta ads: set up by the customer's own AI chat through Meta's ads connector, never by Studio Aight. Posters only, Advantage+ creative enhancements off, paused until the customer switches it on.
- Studio Aight never spends money in an ad account.
Data from other sources
- Meta and Google: the data above, through the permissions the customer grants.
- Stock libraries (Pixabay, Unsplash): pictures chosen as references, kept with their credit, as the libraries require.
- Razorpay: payment status.
- Cloudflare: the result of the bot check.
Purposes
- Making, pricing and delivering orders.
- Showing the customer how posts and ads did.
- Posting, only when the customer asks.
- Learning which kinds of ads work, from many orders' numbers together. Data from Google never enters this learning.
- Security and abuse prevention.
- Invoices, tax and other legal duties.
Never sold. Never used to build a profile of a person. Never used for advertising.
Processors
- Microsoft Azure: hosting and storage, in the Central India region.
- Google and Anthropic: process briefs and files to write plans and make pictures, clips and voices. May process data outside India.
- Razorpay: payments.
A chat app the customer uses with Studio Aight (for example Claude or ChatGPT) receives Studio Aight's replies under its own provider's privacy policy.
Retention
- Uploaded videos: deleted 90 days after the order's last change (or after upload, for a video in no order).
- Account details, briefs, plans, finished ads and order records: one year after the account's last activity, then deleted.
- Account closed: everything except invoices and payment records deleted within 30 days.
- Invoices and payment records: as long as GST law requires, currently six years from the end of the financial year.
- Instagram comments and mentions: 90 days.
- Numbers of linked posts and videos, and which post or video an order became: while the account stays connected. Deleted at once on disconnect. Instagram numbers: also deleted on a Meta deletion request.
- Results shared by the customer: until the customer deletes them.
- Stock-library search results: up to 24 hours, as the libraries allow. No personal data.
- Connected-account sign-in: until disconnected, until a new sign-in replaces it, or until Studio Aight is removed in that service's settings.
- A consent confirmation a customer gave on a page: with the account's records.
- Technical logs: 30 days.
Rights
- Access: a summary of the personal data held and its processing.
- Correction, completion and update.
- Erasure.
- Withdrawal of consent, as easily as it was given.
- Nomination of a person to act on the customer's behalf.
- Grievance redressal: the grievance officer below. Then the Data Protection Board of India.
Requests: hello@getaight.ai, from the account's email address. Replies within 1 working day. Requests completed within 7 working days.
Deletion
- Steps for every kind of data, including data from Facebook, Instagram and Google: Data deletion.
- By email: hello@getaight.ai.
Security
- Data in transit: encrypted. Connected-account sign-ins: stored encrypted.
- Each customer sees only its own orders and files.
- Report a security issue: hello@getaight.ai.
Children
For businesses and people aged 18 or over. Not for children.
Changes
Changes to this policy are emailed to signed-up customers at least 7 days before they take effect. The date above changes with them.
Contact and grievance officer
Ashva Intelligence Pvt Ltd, 683, Basai Road, Near Mother Dairy, Basai, Gurugram, Haryana 122001, India. Questions and complaints: hello@getaight.ai.
Grievance officer: Vaibhav Chawla, hello@getaight.ai. See Contact.