Legal
Privacy policy
Last updated 11 September 2026. This policy explains what personal data App Advisor processes, why, on what legal basis, and the rights you have — including under the EU GDPR, the UK GDPR and India's Digital Personal Data Protection Act, 2023 (DPDP).
Who we are
App Advisor ("we", "us") operates appadvisor.in, an independent software comparison and advisory service. We are the controller (DPDP: data fiduciary) for the personal data described here. Contact: hello@appadvisor.in.
What we collect
- Enquiry and demo forms: name, work email, phone/WhatsApp, company, team size, priorities, product or category you ask about, and your message.
- Submission context: IP address and approximate location (city/region/country derived from the IP), browser and device type, language, time zone, the page you submitted from, the referring page and campaign parameters (UTM, ad click IDs).
- Vendor listings and claims: product and company information, screenshots and video links you upload, and the submitter's contact details.
- Privacy requests: your name, email and the request you make.
- AI advisor and search: the questions you type. They are processed by our own engine and are not sent to third-party AI providers. Advisor conversations (your questions and the answers shown) are stored encrypted, with your IP address only as a one-way hash, for up to 24 months to improve recommendations, then deleted.
Why we use it and our legal basis
- Handling your request (shortlists, quotes, demos) and passing it to the vendors or implementation partners you ask about — steps taken at your request (GDPR Art. 6(1)(b)); under DPDP, your consent given by submitting the form.
- Fraud and abuse prevention, security and attribution of enquiries (IP, device, referrer, campaign) — our legitimate interests (Art. 6(1)(f)), balanced against your rights.
- Optional preference storage such as first-touch attribution in your browser — your consent (Art. 6(1)(a)) where the law requires it, which you can withdraw via Cookie settings in the footer.
- Legal obligations — responding to rights requests and lawful authority requests (Art. 6(1)(c)).
We do not sell personal data, we do not use advertising trackers, and we do not send marketing emails without your separate opt-in.
Who receives it
- Vendors and partners you ask about, so they can respond to your enquiry.
- Service providers acting for us: our hosting provider; IP geolocation lookups (ipwho.is, ipapi.co) which receive your IP address to return an approximate location; CRM or automation tools we connect through signed webhooks to route enquiries.
- YouTube (privacy-enhanced mode) only when you open a product video.
International transfers
Our service is operated from India. If you are in the EEA, UK or Switzerland, your data is transferred to and processed in India and may be shared with vendors in other countries at your request. Where required we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with recipients, or on the transfer being necessary to handle the request you made (GDPR Art. 49(1)(b)).
How long we keep it
Enquiries, vendor submissions and privacy requests are kept for up to 24 months from submission and then deleted automatically, unless we must keep them longer by law. Uploaded screenshots are deleted with the submission. You can ask us to delete your data sooner at any time.
How we protect it
Submissions are encrypted at rest with AES-256-GCM, admin access requires three security layers, forms are rate-limited and screened for abuse, and the site follows OWASP Top 10 practices. No method is 100% secure, and we will notify affected users and authorities of a personal-data breach where the law requires.
Your rights
Depending on where you live, you can: access your data; correct it; delete it ("right to be forgotten"); restrict or object to processing based on legitimate interests; receive a portable copy; and withdraw consent at any time without affecting past processing. Under DPDP you may also nominate a person to exercise your rights and seek grievance redressal.
Make a privacy request → We respond within 30 days (usually within 7). You also have the right to complain to your local data-protection authority (for example your EU supervisory authority, the UK ICO, or India's Data Protection Board).
Cookies and similar storage
We only use storage needed to run the site and remember your choices. Change your choice any time with Cookie settings in the footer.
| Name | Type | Purpose | Category | Duration |
|---|---|---|---|---|
| aa_consent | Cookie | Stores your cookie choice | Essential | 12 months |
| aa_cc | Cookie | Your country (from IP) to preselect the phone code | Essential | 30 days |
| aa_lead | Cookie (HttpOnly) | Remembers that you already sent a request, to avoid duplicate prompts | Essential | 6 months |
| aa:ft | Local storage | First page and campaign you arrived from (lead attribution) | Preference — only with consent in the EEA/UK | Until cleared |
| aa:recent, aa:lead | Local storage | Recent searches and request flag on your device | Preference | Until cleared |
| _ga, _ga_ZL8HCY5Y6Q | Cookie (Google Analytics) | Counts visits and which pages are used, so we can improve them. Google Signals and ad personalisation are switched off, so this is not used for advertising. | Statistics — only with consent in the EEA/UK/CH | 13 months |
| aa_admin, aa_pre, aa_admin_prefs | Cookie | Admin sign-in and admin preferences (staff only) | Essential | 8 hours / 6 months |
Children
App Advisor is a business service and is not directed at children under 18. We do not knowingly collect their data.
Changes
We will update this page when our practices change and revise the date at the top. Material changes will be highlighted on the site.