Privacy notice

Spy Monk is operated by Drive Digital Media Pvt. Ltd., 417–418, Alankar Plaza, Vidhyadhar Nagar, Jaipur, Rajasthan, India ("Drive Digital", "we", "us").

For the personal data of people who use Spy Monk, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) — we decide why and how it is processed.

When a customer uses Spy Monk to watch what is said publicly about their business, brand or themselves, we process that public content on the customer's behalf and to provide the service they asked for. Section 5 explains how we treat people who are mentioned in that content.

Contact for privacy questions and requests: Grievance Officer, Drive Digital Media Pvt. Ltd., privacy@spymonk.in, at the address above.

• Account data — your name, email address, mobile or WhatsApp number (if you add one), organisation and role, team invitations, sign-in and two-factor settings, and your message preferences and consent records (section 13).
• Google account data — only if you choose "Continue with Google", or connect a Google Business Profile. Section 3 lists exactly what we receive.
• Profile details for paid services — where a paid service requires it, your full legal name, date of birth, profession, industry and postal address. Your date of birth and address are stored encrypted and are never used in a search.
• What you ask us to check — names, brands, websites and keywords you ask us to audit or monitor.
• Public content — publicly available content found in the sources an audit or monitoring run covers (for example search results, news, reviews and public posts). It may include the names of people mentioned in it.
• Case data — evidence files, notes, approvals and status history you add to cases.
• Billing data — orders, invoices, payment status and payment references. Card and UPI details are entered with the payment provider and are never stored by us.
• Enquiry data — the name, email, optional phone, organisation and message you send through our contact forms.
• Technical data — session cookies, the IP address of a request, device and browser details, and security logs.

Sign in with Google. If you choose "Continue with Google", Google shares with us, with your permission, your name, email address, profile picture and Google account ID (the permissions called openid, email and profile). We use them only to create your Spy Monk account, sign you in, and show your name and picture inside Spy Monk. We use Google's access token once, to read that profile, and do not keep it. We do not receive your Google password, and we cannot see your Gmail, Drive, contacts, calendar or any other Google data.

Google Business Profile (optional). A workspace owner or admin can connect the business's Google Business Profile. We then ask Google for the business.manage permission and use it only to:

• read the business's accounts, locations and reviews, so you can see and track them in Spy Monk; and
• publish a reply to a review only when a person in your workspace writes or approves that reply and presses publish.

We do not use it to change your business information, create posts or delete anything. The access tokens are stored encrypted. You can remove Spy Monk's access at any time in your Google Account (myaccount.google.com/permissions), which stops it at once, or ask us at privacy@spymonk.in to disconnect it — we then ask Google to revoke the tokens and delete our copy of them. The reviews and replies already saved stay in your workspace as your record, and are deleted with it. We never try to find out who a reviewer is beyond the public name Google shows.

How we use, share and keep Google user data.

• We use it only to provide the features described above, to you.
• We do not sell it, use it for advertising, or use it to build profiles of anyone.
• We share it only with the service providers in section 6 that we need to run those features (for example our hosting provider), only to provide the service, or where the law requires it.
• We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models.
• People at Drive Digital can see it only when you ask for help, when needed for security, or when the law requires it.
• We keep it while your account is open (or until you disconnect the Business Profile) and delete it as described in section 8.

Limited Use. Spy Monk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

• To create and secure your account and sign you in (one-time codes by email or WhatsApp, Google sign-in, and optional authenticator-app two-factor sign-in).
• To run the audits and monitoring you ask for, sort what we find by tone and risk, and show you which sources were and were not covered.
• To keep your cases and evidence and record who approved what.
• To take payments, issue invoices and manage credits.
• To send service messages — sign-in codes, check results, alerts, case updates and payment notices — by email and, if you verified your number and opted in, WhatsApp (section 13).
• To answer enquiries you send us.
• To keep Spy Monk secure, prevent misuse (see the Acceptable use policy) and meet our legal obligations.

We process your personal data with your consent, which you give by a clear action (for example creating an account, connecting Google, or ticking a box), and you can withdraw it at any time. Where the DPDP Act allows processing without consent — for example to comply with a law or a court order (s. 7) — we rely on that.

We do not sell personal data, and we do not use it for advertising or to build advertising profiles.

Monitoring can show content about people other than our customer — for example reviewers, journalists or commenters. We show that content only to the customer who asked for the check, alongside its public source. We do not try to identify anonymous people, combine their content with private data, or build profiles of individuals.

Content that a person has made publicly available is outside much of the DPDP Act (s. 3(c)(ii)), but we still treat it with care. If you are mentioned in content shown in Spy Monk and have a concern, write to privacy@spymonk.in or use the grievance page.

We do not sell personal data. We share it only with service providers who process it for us, under contract and on our instructions, and only as much as each needs:

• Hosting, database and storage — Hostinger (virtual private server in India).
• Email delivery — Hostinger email, for sign-in codes and notifications.
• WhatsApp messages — Meta Platforms, through the WhatsApp Business (Cloud) API, only to numbers you verified and opted in. We do not send SMS or push notifications.
• Sorting public content by tone and risk — OpenAI. We send only the public text being sorted, never your account details. Under OpenAI's API terms this data is not used to train their models.
• Finding public content — SerpAPI (web search) and public news feeds. We send them the search terms, not your account data.
• Google — Google sign-in and Google Business Profile, as described in section 3; and, on the public website only, Google Analytics 4 if you allow it on the cookie banner (section 12).
• Payments — when online payments open: Razorpay and/or Paytm. They receive what they need to take the payment, and we receive the confirmation and references.

We may also disclose personal data when the law requires it — for example to a court, a regulator or the police acting under legal authority — and to professional advisers bound by confidentiality.

Your account data, cases, evidence and the content we find are stored on our server in India, operated by Hostinger.

When public content is sorted by our AI provider (OpenAI), the text being sorted is processed on OpenAI's servers, which may be outside India. Email, WhatsApp and Google services may also process data outside India. We transfer personal data only to countries the Government of India has not restricted under s. 16 of the DPDP Act.

We keep personal data only as long as we need it for the purpose you gave it for, or as long as the law requires:

• Account data and Google sign-in data — while your account is open. When you delete your account (Settings › Profile › Delete account) there is a 7-day period in which you can change your mind; after that we erase your name, email, phone, Google account ID, profile picture and two-factor settings.
• Google Business Profile tokens — deleted when the profile is disconnected or your account is deleted.
• Workspace content (checks, mentions, reviews, cases and evidence) — while the workspace is active. It belongs to the workspace, so it stays with the workspace if one member leaves.
• Security and processing logs — one year, as the DPDP Rules, 2025 require (Rule 6), unless another law requires longer.
• Invoices and accounting records — as long as tax and company law require, generally eight years.
• Message and consent records — while your account is open, then one year.

Archiving a mention in Spy Monk hides it from your dashboard; it does not delete the content at its original source, which we do not control.

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and how we use it (s. 11);
• correct, complete, update or erase it (s. 12);
• withdraw your consent at any time, as easily as you gave it — this does not affect processing done before you withdrew it (s. 6);
• have your complaint dealt with by us (s. 13); and
• nominate someone to use these rights for you if you die or cannot act (s. 14).

You can update most details yourself in Settings, and delete your account from Settings › Profile. For anything else, write to privacy@spymonk.in or use the grievance page. We may ask you to confirm who you are. We reply as soon as we can and within 90 days at most, as the DPDP Rules, 2025 allow.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India after using our grievance process (s. 13(3)). Please give accurate information; the Act prohibits false or frivolous complaints (s. 15).

We protect personal data with reasonable security safeguards, including separation of each organisation's data, encryption of sensitive data and secrets at rest, encrypted connections (HTTPS), two-factor sign-in for staff, rate limiting, access controls, audit logs and backups. No system is perfectly secure.

If a personal data breach happens, we will tell the Data Protection Board of India and each affected person as the DPDP Act (s. 8(6)) and Rules require — in plain language, including what happened, the likely effect, what we have done, and how to contact us.

Spy Monk is for adults and organisations. We do not knowingly create accounts for anyone under 18. If you believe a child has created an account, write to privacy@spymonk.in and the account will be closed and its data erased.

Signing in uses cookies that are strictly necessary to keep your session secure. They are not used for advertising or to track you across other sites.

On the public website we use Google Analytics 4 to count visits and understand which pages help people — but only if you press "Allow" on the cookie banner. Until then nothing is requested from Google Analytics. Advertising storage and personalisation stay switched off whatever you choose, and the events we record contain no names, email addresses or phone numbers. Your choice is stored in your browser and you can change it at any time from the "Cookie settings" link. The signed-in app sends nothing to analytics unless your workspace has opted in.

Channels. We contact you only by email and through the WhatsApp Business API. We do not send SMS messages or push notifications; the alerts list inside Spy Monk is a record you open yourself. If one channel cannot deliver a sign-in code, we offer your other verified channel.

Essential and optional messages. Sign-in codes, invoices and receipts, case updates, appointment messages, replies to your help requests and security notices are part of the service you asked for. Reputation alerts, scheduled reports and news from Drive Digital are optional: you choose them per channel in your message preferences and can turn them off at any time. WhatsApp messages go only to a number you verified and opted in; reply STOP to opt out.

What we record. The channels you verified, the consents you gave or withdrew with their date and wording, the template and language of each message, the provider's message reference, and delivery status as the provider reports it.

Links instead of attachments. Invoices and reports are sent as links that expire, work only for your workspace and are logged when used.

When we change this notice we will post the new version on this page with its number and date, and tell account holders by email before a material change takes effect.

This notice is in English. A Hindi version will follow, and we will provide it in another language listed in the Eighth Schedule to the Constitution on request (DPDP Act, s. 5(3)).