Legal

Privacy notice

Last updated 24 October 2026

Draft for a lawyer’s review. This page describes what the product does today, in plain words. It has not yet been reviewed by a lawyer and may change before it becomes the final text.

This notice explains what Freebee Ads collects, why, how long we keep it, who sees it, and how to have it erased. It is written for three groups, and each has its own section: advertisers, shoppers who play and win, and people who walk past a screen. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act) and is a draft until a lawyer has reviewed it.

In one line: the only personal data we hold about a shopper is a phone number they typed in themselves after an OTP and a consent tick, and they can erase it from their phone. The cameras count; they do not record.

Who we are

Freebee Ads (Freebee Media Pvt Ltd, Hyderabad; registered company name to be confirmed) runs mall screens and the website at this address. We decide why and how the data described here is used (the "data fiduciary" in the DPDP Act). Contact: hello@freebeeads.com. (A grievance officer and the registered address will be named here before launch.)

Advertisers

What we collect:

When you sign up: your email address, a password (stored as a hash, never readable by us), your business name, and, if you add them, a phone number and GSTIN.
When you use the site: the creatives you upload, your bookings, payment status, and the plays and audience numbers for your own campaigns. A sign-in token is kept in your browser so you stay signed in.

Why: to run your account, review your creatives, play your ads, invoice you, and show you your results. The legal basis is the contract between us (the Terms).

Who sees it: our team. Your creatives are seen by our reviewers and, if the mall asks, by the mall's contact. Your business name may appear on a mall's list of advertisers. We do not sell or share your details for anyone else's marketing.

How long: for as long as your account exists, and afterwards for as long as Indian tax and company law require us to keep booking and invoice records. Creatives you delete are removed from our storage unless a booking still refers to them.

How to change or erase: edit your profile in the dashboard. To close your account and erase it, write to hello@freebeeads.com; we will confirm within 7 days. Records we must keep by law are kept for that period only.

Shoppers

This section is for shoppers who scan a QR code on a screen, play a game on their phone or at the kiosk, and save a coupon they won.

Playing the cricket game

To get a code you type a name and pick an avatar. The name is shown on the wall and on your scorecard, so pick one you are happy to see on a big screen. Names are checked by an automatic filter before they are shown; a name that fails the filter is refused and you can type another.
The name, avatar, your runs and the time of your innings are kept with the game's play record for the campaign's reports. These records count innings and runs; they do not identify you and are never matched to a phone number.
If the screen offers it, you can type a WhatsApp number to receive your code there too. That number is used only to send that one message through our WhatsApp provider and is not stored by us. If you do not type a number, nothing is sent.
Your phone keeps a small session key in its browser storage so a page reload shows your code again. It stays on your phone.

Saving a coupon to your phone (the wallet)

When you win and choose to save the coupon, we ask for your mobile number and send a one-time code to verify it. Before we save anything you tick a consent box. The exact consent text, its version and the time you ticked it are recorded.

What we store: your phone number, kept as a one-way hash (for lookup) and in encrypted form (so we can show you your own number, masked, as +91••••••1234). We also store the coupons you won, their codes, and when they were claimed or used. Nothing else: no name, no location, no contacts.

Why: so your coupons are saved to your number and you can see them on any phone by signing in with that number. We do not send marketing messages to this number today. If that changes we will ask you first, separately.

Who sees it: only you see your number, masked. Advertisers never see it. When you show a coupon at a counter, the shop sees the coupon code, the brand and the prize, not your number. Our ops team sees counts only (how many wallets, coupons and redemptions).

How long: the one-time code expires in 5 minutes and is stored as a hash. A win must be claimed within 48 hours. Coupons expire 30 days after they are issued. Your sign-in on a phone lasts 90 days. Your number stays stored until you erase it.

How to erase: open My coupons, sign in with your number, and press "Delete my number". We delete the hash and the encrypted number at once. Coupons already issued stay valid at the counter but are no longer linked to anyone. This is the DPDP right to erasure and it needs no email or form.

Children

The games are free and anyone in the mall may play. The wallet is meant for people who can give consent for their own phone number. If a child has saved a number, a parent can erase it from the wallet page in the same way, or write to us.

Passers-by

This section is for anyone who walks past one of our screens.

Some screens have a camera next to them. The camera is a counter. It counts how many people pass, how many turn their face toward the screen for about a second or more, and how long they keep looking. It also estimates age group and gender, and adds them to totals.

What leaves the camera: numbers only. Counts per ad play, total attention time, and totals per age band and gender. These are written to an append-only record and shown to advertisers as totals.

What never leaves the camera: video, photos, face images, face templates, or any identifier that could follow one person across time. Frames are processed in the device's memory and discarded. Nothing is stored or sent that could identify you, and we cannot tell whether you have walked past before.

Because nothing identifying is collected, there is nothing to look up, correct or erase about you. A short camera notice is placed next to each screen with a camera so you know it is there.

Your rights under the DPDP Act

For any personal data we hold about you (today, that is advertiser account details and wallet phone numbers), you have the right to:

know what we hold and how it is used (this notice, and a copy on request);
correct or update it (your profile; or write to us);
have it erased (the wallet page, or write to us for an account);
withdraw consent you gave earlier, as easily as you gave it (deleting your number from the wallet withdraws the wallet consent);
nominate someone to exercise these rights for you if you are unable to;
complain to us, and if you are not satisfied with our answer, to the Data Protection Board of India.

Write to hello@freebeeads.com with the subject "Privacy". We reply within 7 days and act on erasure requests within 30 days at the latest.

We use service providers to run the product. They process data only on our instructions:

cloud hosting for our database and files (Railway) and the website (Vercel);
a WhatsApp messaging provider (AiSensy) that delivers one-time codes and game codes to a number you typed;
the mall operator, who sees screen playback and audience totals, never personal data.

Some providers may store data outside India. (Hosting regions to be confirmed before launch.) We do not sell data.

Security

Passwords are stored as hashes. Wallet phone numbers are stored as a hash plus encrypted text, never as plain text, and are never written to logs. All traffic uses HTTPS. Screens authenticate with their own device tokens, which we can revoke. Play records are append-only, so they cannot be quietly edited.