Privacy Policy

Account details. Your name, email address and organisation name, plus a cryptographic hash of your password. We never store the password itself.

Case evidence — the material you upload. This is the bulk of what MARIA holds, and all of it is supplied deliberately by you:

• Ad copy: primary text, headline, description, call to action and destination URL.
• Creative images and screenshots of the rejection notice, including any text MARIA reads out of them.
• The landing page URL, its redirect chain, and the visible text fetched from it.
• Case context you choose to give: industry, country, campaign objective, audience notes, a description of the offer, the rejection message, and any notes on prior enforcement.
• Client records, if you file cases per advertiser: the client name, industry and your notes.

Analysis output. The reports MARIA produces — hypotheses, cited evidence, unknowns, recommendations, scores, the policy snapshot used, and engine metadata such as processing time and token counts.

Payment records. Plan, amount, and the Razorpay order and payment identifiers. Card and bank details go directly to Razorpay and never reach our servers.

Technical logs. Ordinary server logs needed to run and secure the service.

• No advertising or analytics trackers. MARIA runs no Google Analytics, no Meta Pixel, no third-party tag manager and no session recording. Nothing on this site profiles you.
• No cookies other than one: a signed, HTTP-only session cookie that keeps you logged in. There is no cookie banner because there is nothing to consent to.
• No connection to your Meta account. MARIA does not ask for, and cannot use, Meta login, Business Manager access or ad account permissions. It works only from files and text you paste in.
• No card details, ever.

• Account details — to identify you, keep your cases separate from every other organisation’s, and contact you about your account.
• Case evidence — to run the investigation you requested. Without the creative, the copy and the landing page there is nothing to analyse.
• Analysis output — so a report stays reproducible and reopenable when you resubmit the ad.
• Outcome records (whether a resubmitted ad was approved) — to calibrate the scoring model. This is aggregated statistical work; it never surfaces one customer’s case to another.
• Payment records — to fulfil the plan you bought and to meet Indian tax and accounting obligations.

Our lawful basis is the performance of our contract with you, and our legitimate interest in keeping the service secure and correct.

Three processors, each doing one job:

• Anthropic — the AI provider behind the analysis engine. When you run an investigation, the ad copy, creative images, rejection notice and landing-page text are sent to Anthropic’s API to be read and reasoned over. Under Anthropic’s commercial terms this material is not used to train models. Processing takes place outside India.
• Razorpay — payments. They receive your name, email and payment instrument; we receive only the transaction result.
• DigitalOcean — the servers and database that run MARIA and store your cases.

When you supply a landing page URL, our server fetches that page the way a reviewer would. That request goes to your own website — it does not share your case with anyone.

We do not sell your data, share it with advertisers, or hand it to anyone else except where the law requires it.

• Cases, evidence and reports are kept while your account is open, because reopening an old case when you resubmit is the point.
• Delete a case and it is removed from your workspace immediately; its stored files and records are purged within 30 days.
• Close your account and everything personal is purged within 30 days, other than payment and tax records, which Indian law requires us to retain for up to eight years.
• You can ask us to delete a specific case or upload at any time, without closing your account.

• Passwords are hashed with scrypt and a per-user salt. Sessions are signed, HTTP-only cookies.
• Every case, upload and report is scoped to your organisation. Evidence files are served only through an authenticated, organisation-checked route — never from a public URL.
• Traffic is encrypted in transit over HTTPS.
• No system is perfect. If a breach affects your data we will tell you and the Data Protection Board promptly, with what happened and what to do about it.

Under India’s Digital Personal Data Protection Act 2023 you may ask us to show you the personal data we hold about you, correct it, complete it, or erase it, and to tell you who it has been shared with. You may nominate someone to exercise these rights if you cannot. Write to support@oye.media and we will respond within 30 days.

If you are unhappy with how we handled a request, our grievance officer can be reached at the same address with “Grievance” in the subject line, and you may escalate to the Data Protection Board of India.

If you file cases for clients, you are the one deciding what goes in. Please keep uploads to what the investigation needs — the ad, its creative, its destination and the rejection notice. Do not upload customer lists, payment details, identity documents or medical records; MARIA has no use for them and we would rather never hold them.

MARIA is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

If this policy changes materially we will email account holders before it takes effect; the date at the top always reflects the current version. Questions go to support@oye.media, or by post to Oye Media, New Delhi, India. Our Terms of Use explain the rest of the relationship.