Privacy Policy

This Privacy Policy (the “Policy”) explains how SightShark (“SightShark”, the “Product”), provided by Prowiz Analytics (“Prowiz Analytics”, “we”, “us” or “our”), collects, uses and discloses personal data when you access or use the Product, including our website, application, dashboards, API and any other interface through which the Product is delivered (together, the “Product Interface”).

This Policy applies solely to the SightShark product and does not cover any other service provided by Prowiz Analytics.

Under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), Prowiz Analytics is the Data Fiduciary responsible for determining the purpose and means of processing personal data collected through SightShark.

General, data protection and grievance enquiries all reach us at the address above. Grievances are handled as described under Grievance redressal below.

The “Product User Register” comprises all customers, prospective users and stakeholders (each a “Data Principal” under the DPDP Act) who interact with SightShark. The information in this register is used solely to deliver and improve the services offered through the Product.

A. Types of personal data collected

When you use SightShark we may collect, directly or automatically, the following categories of personal data:

• Basic identification data: full name, unique user identifier and preferred language.
• Contact information: email address, phone number and postal address.
• Account and transaction data: registration details, login credentials, product usage history and billing or payment information.
• Usage and device data: IP address, device identifiers, browser type, operating system and cookie data, together with details of your interactions with the Product such as feature usage, session duration and navigation patterns.
• Feedback and communication data: information you provide through surveys, support requests or direct communication with our team.

B. Purposes of processing

We use your personal data to:

• Provide and improve the Product: deliver SightShark's services, tailor your experience and improve functionality.
• Manage accounts and support you: administer your account, process transactions and answer support enquiries.
• Analytics and research: analyse usage patterns and performance to guide product improvements.
• Compliance and security: meet contractual and legal obligations and protect the Product against fraud and unauthorised access.
• Marketing and communications: tell you about product updates, new features and offers, where you have consented.

C. Legal basis for processing

We process personal data on the following bases, consistent with the DPDP Act:

• Consent: where you have given free, specific, informed, unconditional and unambiguous consent for a specified purpose, such as optional features, analytics or marketing.
• Certain legitimate uses: in the limited circumstances permitted by Section 7 of the DPDP Act, for example where you have voluntarily provided data for a specified purpose, to comply with a legal obligation or judicial order, or to respond to a medical emergency.
• Contractual necessity: to perform our obligations under your agreement with us.

Most of the data SightShark touches is not collected by us at all. It is your own business data, drawn from the platforms you connect and landed in a warehouse you own, and it may contain personal data relating to your customers, your clients or their end users.

For that data you are the Data Fiduciary and we act as a Data Processor on your instructions. Specifically:

• We process it only to deliver the service you have asked for: ingestion, storage, modelling, reporting, alerting and the AI features you enable.
• It is written to your own data warehouse, in the region you choose. We do not sell it, we do not use it to train models, and we do not use it to build any product other than yours.
• You are responsible for having a lawful basis to send us the data you connect, and for the notices and consents your own users are owed.
• Where you enable AI features, prompts and results are handled under your own model provider key and that provider's terms.
• On termination it stays where it already is, in your warehouse. See Data retention below for what we delete on our side.

This section explains how SightShark accesses, uses, shares, stores, protects, retains and deletes information it receives from Google APIs (“Google user data”) when you connect a Google account or a Google service to SightShark. It applies in addition to the rest of this Policy, and where the two differ for Google user data, this section governs.

A. The Google user data we access

SightShark accesses Google user data only after you, or an administrator of your organisation, grant access through Google's consent screen or by adding SightShark's service account to a Google product. We request only the access needed for the Google services you choose to connect:

• Google account information: the name and email address of the Google account used to authorise a connection, so we can show who connected it and contact them if it stops working.
• Google Ads: read-only reporting data for the ad accounts you connect, such as campaigns, ad groups, ads, keywords, spend, impressions, clicks and conversions.
• Google Analytics: read-only reporting data for the properties you connect, such as sessions, users, events, conversions and traffic sources.
• Google Search Console: read-only search performance data for the properties you connect, such as search queries, pages, impressions, clicks and average position.
• Google Sheets: read-only access to the contents of the spreadsheets you select as a data source.
• Google BigQuery and Google Cloud: access to the datasets in your own Google Cloud project that you designate for SightShark, so that we can write your data there, keep it up to date and read it back for your reports, and, if you connect it, read-only access to your Cloud Billing export.
• Data Studio: access to create and connect the reports and data sources you ask SightShark to set up for you.

B. How we use Google user data

We use Google user data only to provide the SightShark features you use:

• To collect data from the Google services you connect, write it to your own data warehouse, model it into reporting tables, and show it in your dashboards, your alerts and, if you enable it, the AI chatbot.
• To show you the status of each connection and tell you when one needs attention.

We do not use Google user data to serve advertising, including personalised, retargeted or interest-based advertising. We do not use it to determine creditworthiness or for lending. We do not use it to develop, improve or train generalised artificial intelligence or machine learning models. Our staff do not read it unless you ask us to, for example to resolve a support request, unless it is necessary for security purposes such as investigating abuse, or unless it is required to comply with applicable law.

C. How we share Google user data

We do not sell Google user data, and we do not transfer it to data brokers or information resellers. We share it only:

• With you and your organisation: the people you give access to in SightShark, and anyone you choose to share a report with.
• With your own data warehouse: we write it to the Google Cloud project or other data warehouse you designate, which you own and control.
• With your AI model provider, if you enable the chatbot: the data needed to answer a question you ask is sent to the model provider whose key you supplied, under that provider's terms.
• With service providers: sub-processors that host and operate SightShark on our behalf, bound by contract to protect the data and to use it only to provide the service.
• Legal and business transfers: where required by applicable law or valid legal process, or as part of a merger, acquisition or sale of assets, in which case the protections in this section continue to apply and we will notify you.

D. How we store and protect Google user data

• The data we collect for you is written to your own data warehouse, in the cloud project and region you choose.
• Access credentials, such as OAuth tokens and service-account keys, are encrypted and are used only to connect to the services you authorised.
• Data is encrypted in transit and at rest.
• Access to our systems is granted on a least-privilege basis, two-factor authentication is required on every SightShark account, and access and changes are logged.

E. How long we keep Google user data, and how to delete it

• We keep access to a Google service only for as long as you keep it connected in SightShark.
• You can revoke SightShark's access at any time: remove the connection in SightShark, remove SightShark under Third-party apps and services in your Google Account (myaccount.google.com/permissions), or remove SightShark's service account from the Google Ads account, Analytics property or Search Console property you added it to. We stop accessing that data as soon as access is revoked.
• When you disconnect a Google service or close your SightShark account, we delete the related access tokens, and any Google user data held on SightShark's own systems such as temporary processing data, within 30 days, unless the law requires us to keep it longer.
• Data already written to your own data warehouse belongs to you and stays in your cloud project, where you can delete it at any time. You can also ask us to delete Google user data by writing to support@sightshark.com.

F. Compliance with Google's policies

SightShark's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We obtain personal data from:

• Direct interactions: when you register for, use or interact with SightShark.
• Automated collection: through cookies, log files and similar technologies as you use the Product Interface.
• Third-party integrations: from partner systems or publicly available sources, where permitted by law.

We do not sell personal data. We may share it with the following categories of recipient, each bound by contractual or legal obligations to protect it and to process it only for the purposes we authorise:

• Service providers and processors: vendors who host our infrastructure, process payments, provide support tooling or perform analytics on our behalf, acting only on our instructions.
• Group companies and affiliates: for internal administration, consolidated reporting and product support.
• Legal and regulatory authorities: courts, law enforcement and government or regulatory bodies, where disclosure is required by applicable law or valid legal process, or to protect the rights, safety or property of Prowiz Analytics, our users or the public.
• Business transfers: a successor entity in a merger, acquisition, restructuring or sale of assets, subject to the protections described in this Policy.

A. Security measures

We apply technical, organisational and physical safeguards to protect personal data, including:

• Encryption in transit and at rest.
• Access controls and authentication, granted on a least-privilege basis.
• Regular security assessment and monitoring.

No system can guarantee absolute security. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal as required by the DPDP Act and the rules made under it, and we will tell you what happened, what data was involved and what we are doing about it.

B. Data retention

We retain personal data only for as long as necessary for the purposes described above or as required by law. Data in the Product User Register is typically kept for up to ten (10) years after termination of your account, unless a longer period is required by law or by an ongoing legal proceeding.

Data held in your own warehouse is not ours to delete. It remains in your cloud project under your control, and your own retention settings govern it.

Personal data may be stored, processed or transferred to servers outside India, including those operated by our service providers. Such transfers are made in accordance with the DPDP Act, which permits transfer outside India except to countries or territories restricted by the Central Government of India. Where transfers occur, we require recipients to protect the data through appropriate contractual safeguards.

SightShark uses cookies and similar technologies to remember your preferences, to analyse usage and improve performance, and to support optional marketing activity where you have consented.

You can control cookies from your browser settings: most browsers let you block or delete them for a site, and blocking them will not stop you reading this website, though it may affect how the Product Interface remembers your choices.

How this works on this website depends on where you are. If you are in the European Economic Area, the United Kingdom or Switzerland, we set no non-essential cookies until you answer the notice shown on your first visit. Everywhere else, cookies that measure how the site is used are set when you arrive, and the notice tells you so and offers to turn them off. Either way you can change your choice at any time through the Cookie preferences link in the footer of every page, and when you turn these cookies off we also delete the ones already stored on your device. We do not currently run advertising tags on this website, so no advertising cookie is set for anyone. Cookies that are strictly necessary are not part of that choice: they include the cookie our hosting provider sets to protect the site against automated abuse, and the record of the preference you set, which exists only so that we can honour it.

SightShark is not directed to, and is not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children without the verifiable consent of a parent or lawful guardian, as required by the DPDP Act. If we learn that we have collected such data without the required consent, we will delete it promptly. If you believe a child has provided us with personal data, write to support@sightshark.com.

Under the DPDP Act you have the following rights in relation to your personal data:

• Access: obtain a summary of the personal data we process about you, the processing carried out, and the identities of any processors or other Data Fiduciaries with whom it has been shared.
• Correction and erasure: have inaccurate or misleading data corrected, incomplete data completed, your data updated, or data erased where it is no longer needed for the purpose it was collected for, subject to our legal retention obligations.
• Grievance redressal: raise a grievance about our handling of your data or our response to a request, as described below.
• Nomination: nominate another individual to exercise your rights in the event of your death or incapacity.
• Withdrawal of consent: withdraw consent at any time, with the same ease with which it was given. Withdrawal does not affect processing carried out before it.

To exercise any of these rights, write to support@sightshark.com. We may need to verify your identity before we act on a request.

If you have a grievance about how your personal data is processed, or about our response to a rights request, contact our Grievance Officer:

We will acknowledge and resolve your grievance within the timelines prescribed by the DPDP Act and the rules made under it. If you are not satisfied with our response, you may escalate the complaint to the Data Protection Board of India.

We may update this Policy from time to time. When we make a material change we will update the date at the top of this page and notify you through the Product Interface or by email. Continued use of SightShark after a change takes effect constitutes acceptance of the updated Policy.

For any question about this Policy or about how we handle data: