Privacy Policy
This Privacy Policy explains how DigitalTag collects, uses, stores, shares, and protects your personal information.
1Introduction
This Privacy Policy explains how [Your Company Legal Name] ("DigitalTag", "we", "us", "our") collects, uses, stores, shares, and protects personal information when you use the DigitalTag DOOH advertising marketplace platform ("Platform").
This policy applies to all users of the Platform, including Advertisers, Publishers (Screen Owners), Agencies, and platform administrators.
2Information We Collect
2.1 Account and Identity Information
When you register, we collect:
- Full name
- Email address (login ID)
- Phone number
- Password (bcrypt hash)
- Profile avatar (optional)
- Account status & sign-in timestamp
- Email verification status/token
2.2 Organization Information
When you register an organization, we collect:
- Legal name & org type
- Year of incorporation
- Industry category
- Website URL
- Registered & operational address
- Primary contact details
- Verification status & notes
- Org settings & pipeline data
2.3 KYC (Know Your Customer) Documents
For organization verification, we collect and store:
- PAN card (image or PDF, base64-encoded)
- Registered address proof (image or PDF)
- GST certificate (optional)
- Incorporation certificate (optional)
- Authorization letter (optional)
- Bank account details: account holder name, bank name, account number, IFSC code, account type
2.4 Screen and Device Data (Publishers)
When a screen is registered and a player device is connected, we collect:
- Basic Info: Screen name, code, type, venue, description
- Location: Full address, GPS coordinates (lat/lng), timezone
- Specs: Resolution, physical size, orientation, indoor/outdoor, premium flag
- Device Info: External ID, MAC address, serial number, Android player ID
- Hardware/Network: OS, firmware, IP address, network type, SSID
- Operational: Activation date, last heartbeat, health status, latency
- Screen images uploaded by Publisher
2.5 Player Telemetry Data
- Heartbeat signals with GPS coordinates
- Telemetry events: error logs, device metrics (CPU, memory, temp)
- Playback events: asset key, campaign ID, duration, timestamp for every ad displayed
- Screen snapshots (proof of display)
- Command acknowledgements
2.6 Campaign Data
Collected when campaigns are created:
- Name, brand, objective, category
- Dates, timezone, duration
- Booked regions, slots, prices
- Status history & QC notes
- Playback rules
- Internal notes & PO numbers
2.7 Media Assets
When creative files are uploaded:
- File name, MIME type, size, URL
- Media type (image/video)
- Duration (for videos)
- Tags & folders
- Auto-generated thumbnails
- Creator & Org IDs
2.8 Billing and Payment Data
- Invoice details: number, subtotal, tax, total, due date, status
- Payment records: method, reference, Stripe intent ID, status, timestamps
- Line items: screen name, region, days, slots, rate
Note: We do not store full card numbers or CVV codes. Handled securely by Stripe.
2.9 Audit Trail
Actor ID, action type, affected entity, API route, IP address, user agent, timestamp.
2.10 Notifications
Type, title, body, read status, timestamps, recipient user/org ID.
2.11 Technical Data
IP address, user agent, session tokens (HTTP-only cookies), JWT tokens, browser info.
3How We Use Your Information
| Purpose | Data Used |
|---|---|
| Account authentication & session management | Email, password hash, JWT tokens, IP address |
| Organization verification (KYC) | Legal name, address, PAN, GST, bank details, KYC docs |
| Delivering advertising campaigns | Campaign data, creatives, screen regions, slot blocks |
| Generating proof-of-play reports | Playback events, telemetry, screen snapshots |
| Billing and invoicing | Campaign data, screen pricing, payment records |
| Screen health monitoring & alerting | Heartbeat data, telemetry, uptime events |
| Sending transactional emails | Email address, campaign status, invoice details |
| Platform security & fraud prevention | IP address, user agent, activity logs |
| Analytics and reporting | Playback events, uptime data, campaign performance |
4Legal Basis for Processing
Processing necessary to provide Platform services you contracted for.
Processing required to comply with laws (KYC/AML, tax).
Processing for fraud prevention, security, and service improvement.
Where explicitly consented (e.g., optional data fields).
5Data Sharing and Disclosure
5.1 Within the Platform
- Publishers can see campaign names, creative thumbnails, and booking dates for campaigns running on their screens.
- Advertisers and Agencies can see screen names, locations, pricing, and availability for screens they book.
- DigitalTag staff have access to all platform data for operational, support, and compliance purposes.
5.2 Third-Party Service Providers
| Provider | Purpose | Data Shared |
|---|---|---|
| AWS S3 | Media file storage | Uploaded creative files, screen images, KYC docs |
| AWS CloudFront | Media delivery CDN | File paths and URLs |
| AWS IoT (MQTT) | Real-time device comms | Screen external IDs, device certs |
| Stripe | Payment processing | Invoice amount, currency, metadata |
| Google Maps | Map display & search | User map interactions, location searches |
| OpenWeather/OpenAQ | Weather/Air quality data | Location queries |
| SMTP Provider | Transactional email | Recipient email address, email content |
May disclose to law enforcement/courts when required by law or to protect rights.
Data may transfer during mergers/acquisitions under same privacy protections.
We never sell, rent, or trade personal info to third parties for marketing.
6Data Retention
7Data Security
We implement the following security measures:
- bcrypt hashing (cost 10) for passwords
- Short-lived JWT access tokens (15m)
- SSL/TLS encrypted databases
- AWS S3 pre-signed URLs/CDN controls
- X.509 cert mutual auth for MQTT
- HTTPS strictly enforced for APIs
- Role-based access control (RBAC)
- Comprehensive audit activity logging
Despite these measures, no system is completely secure. We cannot guarantee absolute security of your data.
9Your Rights
Depending on your jurisdiction, you may have the following rights:
To exercise rights, contact [Insert privacy/support email]. We respond within 30 days.
10Children's Privacy
The Platform is not directed at individuals under 18. We do not knowingly collect personal info from minors. If collected inadvertently, contact us to delete it.
11International Data Transfers
Hosted on infrastructure that may be located outside your country, including AWS in [Insert AWS region, e.g., ap-south-1 (Mumbai)]. By using the Platform, you consent to these transfers under appropriate safeguards.
12Third-Party Links and Integrations
This policy does not apply to third-party services linked from our Platform. Please review their respective privacy policies.
13Changes to This Privacy Policy
We may update this policy. Registered users will be notified by email and updates will be posted here. Continued use constitutes acceptance.