Start free trial

Privacy Policy

Effective date: 2 October 2026

This Privacy Policy explains how ANVIKOS Group (“ANVIKOS“, “we“, “us“) collects, uses, shares, retains and protects information when you visit our website (www.anvikos.com), use the ANVIKOS platform (https://app.anvikos.com) and the apps you access through your ANVIKOS account, including AI CMO and our automation apps (together, the “Service“), and when you connect your Facebook, Instagram, Google (including YouTube), LinkedIn, Amazon Ads, Shopify, Microsoft Clarity, WhatsApp or Telegram accounts to it. Where a specific app handles additional data, this policy describes it, and we will update this policy before any app processes new kinds of data.

  1. Who we are
  2. Information we collect
  3. How we use information
  4. Google user data
  5. YouTube API Services
  6. Meta platform data (Facebook, Instagram, WhatsApp)
  7. LinkedIn data
  8. Amazon Ads, Shopify, Microsoft Clarity and Telegram data
  9. AI processing
  10. How we share information
  11. Retention and deletion
  12. Security
  13. Your rights and choices
  14. International transfers
  15. Cookies and browser storage
  16. Children
  17. Changes to this policy
  18. Contact and grievances

1. Who we are

The Service is owned and operated by ANVIKOS Group, an enterprise registered in India (Udyam/MSME), #102, Block-2, Sai Raghavendra Brundavanam, Simhapuri Colony, Bowrampet, Hyderabad, Telangana, India 500090. ANVIKOS is our brand. For the personal data described in this policy we act as the data controller (a “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023). When you use the Service for accounts you manage for your own clients, you remain responsible for having the right to connect those accounts, and for personal data about your own customers we process it on your behalf (see section 2.3).

2. Information we collect

2.1 Information you give us

  • Account details — when you sign up: your name, official email address, organisation name, contact number, WhatsApp number and password (stored only as a one-way hash). We also record the date of sign-up and the IP address used, to protect against fraud and abuse of free trials.
  • Business profile — the brand name, website, logo, currency, time zone and contact details you add in Settings.
  • Subscription details — which apps you use, your plan, and your trial or subscription dates.
  • Enquiries and communications — details you give us when you fill in our contact form (name, organisation, email, phone number, topic and message), message us on WhatsApp, or write to our support team.
  • AI provider keys — if you add your own API key for an AI provider (such as OpenAI, Anthropic, Google Gemini or xAI Grok), we store it encrypted and use it only to send your requests to that provider.
  • Report settings — the email addresses and WhatsApp numbers you choose to receive scheduled reports, and your report preferences.
  • Billing details — when paid plans are offered, payments are handled by our payment processor; we receive confirmation of payment and billing contact details, never your full card number.

2.2 Information from platforms you connect

You choose which platforms to connect, and you approve the exact permissions on each platform’s own consent screen. We never see or store your platform passwords. Depending on the permissions you grant, we receive:

PlatformWhat we receive
Meta (Facebook & Instagram)Your Facebook user ID and name; the Facebook Pages, Instagram professional accounts and ad accounts you select; their profile details; Page and Instagram insights (such as reach, views, engagement, follows and audience breakdowns); your posts and their insights; ad account, campaign, ad set and ad details and performance; where you use publishing features, the posts you create through the Service; and, where you use comment and message features, the comments on your posts and the Messenger and Instagram Direct conversations people send to your Page or account, with the sender’s name and ID, so you can read and reply to them.
GoogleYour Google account ID, name and email; the Google Analytics 4 properties, Search Console sites, YouTube channels, Google Ads accounts, Google Business Profile locations and Google Tag Manager accounts and containers you have access to; and their reporting data (such as users, sessions and page views, search clicks and impressions, channel and video statistics, campaign metrics, and calls, website clicks and direction requests from your Business Profile).
LinkedInYour LinkedIn member ID, name, email and profile photo; and, if you grant the relevant permissions, the Company Pages and ad accounts you administer and their analytics (followers, visitors, post and campaign performance).
Amazon AdsYour Amazon account user ID, name and email (through Login with Amazon); the Amazon Ads advertising accounts (profiles) you have access to, with their marketplace and currency; and campaign performance data. Access is read-only.
ShopifyYour store’s address, name, email and currency; order numbers, dates, totals and payment status; and product counts, for the store you install our app on. We do not store your customers’ names, addresses or contact details. Access is read-only.
Microsoft ClarityThe read-only Data Export token you create in Clarity, and your project’s aggregated website metrics (such as sessions, users, scroll depth, rage clicks and dead clicks). Clarity does not share individual visitors’ recordings with us through this token.
WhatsApp (WhatsApp Marketing Solutions)Your WhatsApp Business account ID, phone number ID and display name; your message templates; the contact list you upload or collect (names, phone numbers and opt-in records); and messages sent to and from your business number, with delivery and read status.
Telegram (Telegram Automation)The bot token you create with Telegram’s @BotFather; the channels and groups where your bot is an admin; and messages people send to your bot, with their Telegram user ID and name.

We also receive and securely store the access tokens each platform issues so the Service can keep your dashboard up to date. Tokens are encrypted at rest and are never displayed in your browser.

2.3 Data about your own customers

When you use our messaging, automation, voice, recruitment and business-analysis solutions, the Service processes information about people connected to your business: people who message, call or comment on your accounts; people in contact lists you upload; people who apply to your job openings (for example their CV, contact details and answers to screening questions); call recordings and transcripts handled by AI Voice Agents; and personal data contained in business records you connect to AI Business Analyst or AI Workflows. For that information, you are the data controller and we process it only on your instructions to provide the Service. You are responsible for having their consent where the law or the platform requires it. We do not contact your customers for our own purposes, and we do not sell or share their information.

2.4 Information collected automatically

When you use the Service our servers record technical information needed to run and secure it: IP address, browser type, device information, pages and features used, and date and time of requests. We use this for security, troubleshooting and service reliability.

3. How we use information

  • To provide the Service: displaying your analytics, generating reports, presentations and AI insights, and (where you choose) publishing or scheduling content you create and replying to comments and messages you receive.
  • To create and secure your account, authenticate you, manage your free trial and subscriptions, and prevent fraud and abuse.
  • To contact you by email, phone or WhatsApp about your account — for example to help you get started, remind you before a trial ends, or respond to support requests. We only send promotional messages where the law allows, and you can opt out at any time.
  • To provide customer support and send service-related messages (for example security alerts or changes to these terms).
  • To maintain, debug and keep the Service reliable and secure.
  • To comply with legal obligations and enforce our Terms of Service.

We process personal data on the basis of your consent (which you give when you create an account and when you connect each platform, and which you can withdraw at any time by disconnecting), to perform our contract with you, and where required by law.

We do not sell or rent your personal data or any data from connected platforms. We do not use data from connected platforms for advertising, retargeting or profiling, to build or enrich user profiles, to determine eligibility for credit, employment, housing or insurance, or for surveillance, and we do not share it with data brokers or ad networks.

4. Google user data

ANVIKOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We ask Google only for the access each feature needs, and you see every permission on Google’s own consent screen:

Google accessWhat we use it for
Sign-in (openid, email, profile)Identify the Google account you connected
Google Analytics (read-only)Website users, sessions, conversions and traffic sources for the properties you choose
Search Console (read-only)Search clicks, impressions, queries and pages for the sites you choose
YouTube Data and YouTube Analytics (read-only)Channel, video and audience statistics (see section 5)
Google AdsRead campaign, ad group, ad and keyword performance of the accounts you choose; we do not create or change campaigns
Google Business ProfileLocations, calls, website clicks, direction requests and reviews of the profiles you manage
Tag Manager (read-only)Containers and tags, to check your tracking is set up

Data we receive from Google APIs:

  • is used only to provide and improve the user-facing features of the Service that you can see in your dashboard (analytics, reports and insights about your own properties, sites, channels, locations and ad accounts);
  • is not transferred to others except as necessary to provide those features, to comply with law, for security, or as part of a merger or acquisition with your notice;
  • is not used for serving advertisements, including retargeting, personalised or interest-based advertising;
  • is not sold, and is not used to determine credit-worthiness or for lending purposes;
  • is not read by humans, unless you give us permission for specific data (for example when you ask for support), it is necessary for security purposes such as investigating abuse, to comply with law, or it is aggregated and anonymised for internal operations;
  • is not used to develop, improve or train generalised or non-personalised artificial intelligence or machine-learning models.

Google’s handling of your data is described in the Google Privacy Policy. You can revoke our access at any time by disconnecting Google in your dashboard or in your Google Account’s third-party access settings.

5. YouTube API Services

The Service uses YouTube API Services to show you the statistics of the YouTube channels you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

  • What we access: your channel’s ID, title and thumbnail; your videos’ titles, publish dates and statistics (views, likes, comments, watch time, subscribers gained and lost); and channel analytics such as traffic sources and audience age, gender and country in aggregate. Access is read-only: we do not upload, edit or delete anything on YouTube.
  • How we use it: only to show you your own channel’s performance, reports and AI insights in your dashboard.
  • Sharing: YouTube data is not shared with anyone except the service providers that host and run the Service (section 10).
  • Storage: we store YouTube data only to show you your history. We refresh it regularly while you stay connected and delete it within 30 days after you disconnect or revoke access, or if it can no longer be refreshed.
  • Device storage: the Service does not place cookies or similar technologies on your device for YouTube data.
  • Revoking access: disconnect YouTube in your dashboard, or remove ANVIKOS at the Google security settings page, security.google.com/settings/security/permissions.

6. Meta platform data (Facebook, Instagram, WhatsApp)

We access Facebook, Instagram and WhatsApp data only through Meta’s official APIs, only with the permissions you approve on Meta’s own screen, and in line with the Meta Platform Terms and Developer Policies.

  • Purpose: Meta data is used only to provide the Service to you — your dashboards, reports and AI insights, publishing the posts you create, and showing you comments and messages so you can reply. Replies are sent only by you (or by automatic replies you switch on), and only within Meta’s messaging windows.
  • No other use: we do not sell, license or purchase Meta data; we do not use it for advertising, to build or augment user profiles, for surveillance or for eligibility decisions; and we do not share it with data brokers, ad networks or other third parties, except service providers that process it for us under contract (section 10).
  • Who can see it: only you and the people you give access to your ANVIKOS account. Each customer’s data is kept separate from every other customer’s.
  • Removing access: disconnect Meta in your dashboard, or remove ANVIKOS in Facebook → Settings & privacy → Settings → Business integrations (or Apps and websites), or in Instagram → Settings and activity → Website permissions → Apps and websites.
  • Deletion: when you disconnect, remove our app, or ask Meta to delete your data, Meta notifies us through our data deletion callback and we delete the Meta data we hold for you within 30 days, giving you a confirmation code you can check on our Data Deletion page.

7. LinkedIn data

We access LinkedIn data only through LinkedIn’s official APIs, with the permissions you approve on LinkedIn’s own screen, and in line with the LinkedIn API Terms of Use. We use it only to show you the analytics of the Company Pages and ad accounts you administer. We do not sell LinkedIn data, use it for advertising or to build profiles of LinkedIn members, combine it with other data to identify individuals, or share it with third parties other than our service providers. You can revoke access by disconnecting LinkedIn in your dashboard or in LinkedIn → Settings → Data privacy → Permitted services; we then delete the LinkedIn data we hold for you within 30 days, or sooner where LinkedIn’s terms require.

8. Amazon Ads, Shopify, Microsoft Clarity and Telegram data

We access Amazon Ads data only through the Amazon Ads API after you sign in with Amazon and approve access, and only to show your own advertising results. You can remove our access by disconnecting Amazon Ads in your dashboard, or in your Amazon account under Login with Amazon.

We access your Shopify store only through Shopify’s official Admin API after you install our app from Shopify’s own approval screen. Disconnecting in your dashboard or uninstalling the app in Shopify removes our access, and we delete the stored connection. We respond to Shopify’s customer data and shop data erasure requests as Shopify requires.

For Microsoft Clarity, you create a read-only Data Export token in your Clarity project and paste it into your dashboard. We store it encrypted and use it only to read your project’s summary metrics. Disconnecting deletes it; you can also delete the token in Clarity at any time.

For Telegram, your bot token is stored encrypted and used only to run the bot you created. Disconnecting deletes it; you can also revoke it with @BotFather at any time.

9. AI processing

Some features create written insights, summaries, replies and content using third-party AI model providers (such as OpenAI, Anthropic, Google Gemini or xAI). To do this, we send only the metrics and text needed for your request to the provider and show you the result.

  • During a free trial (and on plans where we say so), requests use our own business accounts with these providers, under API terms that do not allow them to use the data to train their models.
  • When you add your own AI provider key, requests are sent using your key and are also governed by your own agreement with that provider.
  • We never use data from connected platforms — including Google, YouTube, Meta and LinkedIn data — to train AI models of our own or anyone else’s, and we do not use it to develop generalised AI or machine-learning models.
  • Every figure in your dashboards comes from the platforms’ own APIs; AI is used only for written insights and drafts. AI-drafted replies and posts are shown to you to review, and automatic replies are sent only in the ways you set up.

Scheduled reports

If you turn on scheduled reports, we send a summary of your own dashboard data to the email addresses and WhatsApp numbers you add and confirm. WhatsApp reports are sent through your own WhatsApp Business account. You can change or stop them at any time in your account settings.

10. How we share information

We do not sell or rent personal data or platform data. We share information only as follows:

  • Service providers that process data on our behalf under written contracts with confidentiality, security and data-protection obligations, and only to run the Service: cloud hosting and infrastructure (our servers are hosted with Hostinger), email delivery, AI model providers (section 9) and, when paid plans are offered, payment processing.
  • The platforms you connect — when you ask the Service to act on a platform (for example to publish a post or send a reply), we send the necessary content to that platform.
  • Legal and safety — where required by law, legal process or a valid government request, or to protect the rights, property or safety of our users, the public or us.
  • Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy and with notice to you.

11. Retention and deletion

  • While you are connected, we keep the platform data needed to show your history and refresh it regularly.
  • Disconnecting a platform immediately deletes the stored access tokens and connection details for that account, and we ask the platform to revoke our access where it offers a way to do so. Analytics and other data from that account are deleted within 30 days.
  • Messages, comments, contact lists, call recordings and transcripts, job applications and connected business records handled by our solutions are kept only while you use the solution, and are deleted within 30 days after you disconnect the account, end your subscription or ask us to delete them.
  • Deleting your account immediately disconnects every platform and deletes your account; remaining copies (including backups) are erased within 30 days.
  • Platform deletion requests (such as Meta’s data deletion callback) are completed within 30 days.
  • We keep limited records (for example invoices or a hashed record that a deletion was completed) only as long as the law requires.

See Data Deletion for step-by-step instructions.

12. Security

We protect information with encryption in transit (HTTPS/TLS), encryption at rest for platform access tokens, keys and secrets, hashed passwords, strict technical separation of each customer’s data, least-privilege administrative access, and logging of access to systems. No system is perfectly secure; if we become aware of a breach affecting your personal data or platform data we will notify you, the affected platforms and the relevant authorities as required by law and by the platforms’ terms.

13. Your rights and choices

Subject to applicable law (including India’s Digital Personal Data Protection Act, 2023 and, where it applies to you, the EU/UK GDPR), you can:

  • access a summary of the personal data we hold about you;
  • correct or update inaccurate data;
  • withdraw consent — by disconnecting a platform or deleting your account — and ask us to erase your data;
  • nominate another person to exercise your rights in case of death or incapacity;
  • raise a grievance with us, and escalate to the Data Protection Board of India or your local supervisory authority if unresolved.

Email contact@anvikos.com to exercise these rights. We respond within 30 days.

14. International transfers

We are based in India. Our service providers and the platforms you connect may process data in other countries. Where data is transferred, we rely on providers that offer appropriate safeguards and comply with applicable transfer rules.

15. Cookies and browser storage

We use your browser’s local storage only to keep you signed in and remember your display choices. We do not use advertising cookies or third-party tracking on the Service. The platforms you connect may set their own cookies on their sign-in and consent pages, under their own policies.

16. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

17. Changes to this policy

We may update this policy as the Service changes. We’ll post the new version here with a new effective date and, for significant changes, notify you by email or in the Service before they take effect.

18. Contact and grievances

ANVIKOS Group (ANVIKOS)
#102, Block-2, Sai Raghavendra Brundavanam, Simhapuri Colony, Bowrampet, Hyderabad, Telangana, India 500090
Phone: +91 9381222866
Privacy and data protection: contact@anvikos.com
Grievance Officer: Hemsundar Jogi — contact@anvikos.com

Chat with us