Privacy Policy

1.Who we are

PublishKaro (publishkaro.com) is a content planning and publishing service operated by Akash Sharma, a sole proprietor based at 22E2, Jagatpura, Jaipur, Rajasthan 302033, India (“PublishKaro”, “we”, “us”). For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described in this policy.

This policy explains what personal data we collect when you use our website, the PublishKaro app and our Meta Ads and Google Ads management services, why we collect it, who we share it with and the choices you have. It is published in line with the DPDP Act, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).

2.Data we collect

Account information

Your name, email address and password when you sign up. Passwords are stored only as a one-way hash; we never see or store the password itself.

Google Sheets and Google Drive data

When you connect Google, we receive your basic Google profile (name and email) and, with your permission, access to the Google Sheets you select and to the Google Drive files those Sheets link to. We read the rows of your content plan (dates, post types, captions, titles, asset links and statuses), download the linked media so it can be published, and write back to your Sheet: the Upload Status, Remark, Post ID and, if you map it, Uploaded Links columns.

Social account tokens

When you connect Instagram, Facebook, LinkedIn or YouTube, the platform gives us access tokens (and, where offered, refresh tokens) together with account or Page identifiers, names and profile pictures. We use them to publish the posts you approve, confirm they went live, show which account is connected and, for Instagram, read basic audience activity to suggest good posting times.

Content you create

Captions, titles, descriptions, media files, the text that appears inside your images and videos, the caption prompts you save, schedules and the publishing results for each post.

Usage and device data

Server logs (IP address, browser type, pages requested, timestamps and errors), sign-in and password-reset events used for security, and the cookies described in our Cookie Policy.

Messages and service enquiries

What you send us by email, and the business details you share when you ask about our ads management services (name, business name, contact details, goals and budget).

We do not ask for or store financial account numbers, card numbers or biometric data.

3.How we use your data

We use personal data only for these purposes:

• to create and secure your account, sign you in and help you reset your password;
• to sync your content plan from Google Sheets and fetch the media linked in it;
• to generate draft captions and run a strict spelling check on captions and on-screen text, using AI;
• to publish and schedule the posts you approve on the platforms you choose, confirm they went live and write the result back to your Sheet;
• to send service emails such as password reset codes and security notices;
• to provide our ads management services when you engage us;
• to keep the service reliable and secure, investigate misuse and fix problems; and
• to comply with the law and respond to lawful requests.

We do not sell personal data, we do not show advertising inside PublishKaro, and we do not use your content to train general-purpose AI models.

4.Consent and legal basis

We process your personal data on the basis of your consent, which you give when you create an account and when you connect each Google or social account, and for the legitimate uses permitted by Section 7 of the DPDP Act, such as complying with the law. Each connection asks for specific permissions on the provider’s own consent screen, and you can withdraw consent at any time by disconnecting the account, deleting a workspace or asking us to delete your data. Withdrawal does not affect processing that already took place.

5.AI processing

Caption generation and the spelling check run on Google Vertex AI (Gemini). To do this we send the relevant row details, your saved caption prompt and the media or on-screen text being checked. Media may be held briefly in a Google Cloud Storage bucket for this analysis; those copies are deleted automatically within two days. Under Google Cloud’s terms for Vertex AI, Google does not use this data to train its models.

AI output can be wrong. You review every caption and spelling suggestion before you publish; see our Terms of Service and Disclaimer.

6.Who we share data with

We share personal data only with service providers that process it on our instructions, and with the platforms you ask us to publish to:

• Amazon Web Services (AWS): hosting, database and file storage, in the Asia Pacific (Mumbai) region in India.
• Google Cloud (Vertex AI, Gemini): caption generation and spelling checks, as described above.
• Brevo: delivery of service emails such as password reset codes (your email address and the email content).
• Meta (Instagram and Facebook), LinkedIn and Google (YouTube, Sheets and Drive) APIs: to read your plan and media and to publish the posts you approve. Content you publish becomes subject to that platform’s own terms and privacy policy.

We may also disclose data when required by law, a court order or a government authority, to protect the rights and safety of our users or the public, or as part of a transfer of the business, in which case this policy will continue to apply to your data.

7.Google user data and Limited Use

In particular:

• we use Google user data (your Google profile, the Sheets you select, the Drive files they link to and your YouTube channel access) only to provide and improve the user-facing features described in this policy;
• we do not transfer Google user data to others except as needed to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you;
• we do not use or transfer Google user data for advertising, including retargeting or personalised ads, and we do not sell it;
• no person reads your Google user data unless you give us permission for a specific item (for example while we help you with a support request), it is needed for security purposes or to comply with law, or it is aggregated and anonymised for internal operations; and
• we do not use Google Workspace API data to develop, improve or train generalised AI or machine-learning models.

YouTube publishing uses the YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. You can revoke PublishKaro’s access at any time from your Google Account permissions page.

8.Meta Platform data

Data we receive from Instagram and Facebook through Meta’s APIs (access tokens, Page and account identifiers, names, profile pictures, post identifiers and links, publishing status and basic Instagram audience activity) is used only to publish and verify the posts you approve, show which accounts are connected and suggest posting times. We handle it in line with the Meta Platform Terms, do not sell it or use it for advertising, and delete it when you disconnect the account, delete the workspace or ask us to delete your data. See our Data Deletion Instructions. You can also remove PublishKaro from your Facebook settings under Apps and websites.

9.How long we keep data

• Account data: for as long as your account is active, and deleted within 30 days of a verified deletion request.
• Social and Google tokens: until you disconnect the account, delete the workspace or ask us to delete your data.
• Content, calendars, schedules and publishing history: until you remove the post or delete the workspace or account.
• Media copies used for AI analysis: deleted automatically within two days.
• Prepared media used for publishing: deleted when you delete the workspace, or earlier under our storage clean-up.
• Security and server logs: kept for up to 180 days, unless we need them longer to investigate an incident or comply with the law.
• Backups: encrypted backups roll over on a fixed cycle, so deleted data leaves them within 35 days.

10.How we protect data

We follow reasonable security practices as required by the SPDI Rules. All traffic uses HTTPS. Access tokens for Google and social accounts are encrypted at rest with AES-256-GCM, passwords are stored only as salted one-way hashes, sessions use secure, HTTP-only cookies, and access to production systems is limited to what is needed to run the service.

No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act requires, with what happened, its likely impact and the steps we are taking.

11.Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you and how we process it;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it is no longer needed for the purpose you gave it for, unless the law requires us to keep it;
• withdraw your consent at any time;
• have a grievance addressed by our Grievance Officer; and
• nominate another person to exercise these rights if you die or become incapable.

Email publishkaro@gmail.com from the address on your account to use any of these rights. We may ask you to confirm your identity and will respond within 30 days.

12.Cookies

We use only essential cookies and one local storage entry for your theme choice. There are no advertising or tracking cookies. Details are in our Cookie Policy.

13.Children

PublishKaro is meant for people aged 18 and over. We do not knowingly process the personal data of children. If you believe a child has given us personal data, email publishkaro@gmail.com and we will delete it.

14.International transfers

Our servers and database are in India (AWS, Mumbai). Some providers, such as Google, Brevo, Meta and LinkedIn, may process data in other countries to provide their services. Such transfers follow Section 16 of the DPDP Act and are never made to a country the Government of India has restricted.

15.Changes to this policy

We may update this policy as the service or the law changes. We will change the “Last updated” date above and, for significant changes, tell you by email or in the app before they take effect.

16.Grievance Officer

In line with the IT Act, 2000, the rules made under it and the DPDP Act, our Grievance Officer is:

We acknowledge every complaint within 24 hours and aim to resolve it within 15 days of receipt. If you are not satisfied with our response, you may approach the Data Protection Board of India.

17.Contact us

For any question about this policy or your data, email publishkaro@gmail.com or write to Akash Sharma, 22E2, Jagatpura, Jaipur, Rajasthan 302033, India.