Privacy Policy
Transparent guidelines on how we collect, process, and safeguard your personal information, social telemetry, and payment records.
Last updated: September, 2026
1. Introduction & Data Controller
At Shout OTB ("we," "our," or "us"), operated as a specialized digital and software unit of Pappa Bindha Pvt Ltd (CIN: U7310MP2025PTC078535), we respect your privacy and are committed to protecting your personal data. This Privacy Policy details how we collect, handle, process, and protect your information when you visit shoutotb.com, commission digital marketing services, register for an account, or utilize our self-serve SaaS analytical tools (including our Instagram Analyzer and YouTube Analyzer).
This website is developed and maintained under the administrative authority of Md. Shahid Ali on behalf of Shout OTB. By using our website and services, you consent to the data collection and processing practices described in this Privacy Policy.
2. Information We Collect
We collect information across three primary channels: information you provide directly, information collected automatically during site navigation, and authorized third-party platform telemetry.
A. Account & Contact Information
- Identity & Profile Data: Full name, email address, password hash, job occupation, and profile avatar URL.
- Communication Data: Inquiries submitted through our contact forms, meeting booking calendar entries, resumes uploaded via career applications, and customer support correspondence.
- Credit & Wallet Ledger Data: Internal records of starter credits granted, subscription credit allocations, one-time top-up packs, credit deduction history, and tool consumption timestamps.
B. Automatically Collected Technical Data
- Device & Connection Data: IP address, browser type and version, operating system, and hardware architecture.
- Geo-Location Telemetry: Approximate geographic country and region derived from network headers (such as Cloudflare
CF-IPCountry) used exclusively to display localized pricing (INR vs. USD). - Attribution & Campaign Metadata: Marketing campaign parameters including
utm_source,utm_medium,utm_campaign, and Google Ads click identifiers (gclid) stored temporarily in your session to trace referral sources.
C. Social Media & Third-Party API Data
When you audit public handles or link your account for private analytics in our tools, we collect metrics through authorized public endpoints and official OAuth connections:
Meta / Instagram Graph API
For public audits, we fetch public profile bios, follower counts, and recent post metadata. For connected accounts, we store a 60-day encrypted long-lived OAuth token to extract private 28-day reach, impressions, profile views, and audience demographics.
YouTube Data API v3
Channel ID, subscriber figures, video view counts, upload dates, and video engagement velocity. All YouTube data processing strictly adheres to the YouTube API Services Terms of Service.
3. Third-Party OAuth Permissions & Data Restrictions
Zero Account Modification Guarantee
When you authenticate your Instagram or Google account through our platform, we only request read-only analytical scopes (e.g., instagram_basic, instagram_manage_insights, pages_read_engagement).
- We never post, like, comment, or publish content to your accounts.
- We never access your private direct messages (DMs) or personal contact lists.
- We never see, store, or intercept your account passwords. Authentication occurs entirely on Meta's or Google's secure OAuth servers.
Revoking Access: You may disconnect your linked accounts at any time from your Account Settings on our site, or directly through your Facebook Business Integrations Settings or Google Security Account Permissions.
4. Payment Processing & Financial Data Security
Shout OTB does not directly collect, process, or store sensitive financial details. We operate a completely decoupled payment pipeline:
Razorpay (Domestic India)
All INR transactions (UPI, RuPay, Netbanking, Cards) are handled directly by Razorpay Software Pvt. Ltd. Razorpay is certified under PCI-DSS Level 1. Your UPI PINs and banking credentials never touch our servers.
Paddle / MoR (International)
International USD purchases are processed through an authorized Merchant of Record (MoR) such as Paddle.com. The MoR processes card numbers through tokenized, encrypted iframes and maintains PCI-DSS compliance.
What We Retain: We only store non-sensitive billing records in our database: internal Order ID, Gateway Payment ID, billing currency, purchased credit amounts, purchase timestamps, and subscription expiration dates.
5. How We Use Your Information
We process personal and technical information strictly for legitimate operational purposes:
Platform Operation & Tool Delivery
To query social media endpoints, calculate true engagement rates, generate Chart.js visualizations, and compile downloadable PDF performance dossiers.
Credit Wallet Accounting
To maintain accurate records of your available credits, apply subscription renewals, and execute FIFO deductions when running audits.
AI Strategic Insights Generation
To feed anonymized engagement metrics into secure Large Language Models (via Groq API) to generate personalized 30-60-90 day growth playbooks.
Security & Abuse Prevention
To monitor API rate limits, verify Turnstile bot protection tokens, and prevent fraudulent attempts to bypass credit gates.
6. Data Protection & Technical Security
TLS/SSL Encryption
All traffic between your browser and our servers is secured via HTTPS/TLS 1.3 encryption.
Encrypted Tokens
OAuth access tokens and database credentials are encrypted at rest using industry standards.
Isolated Neon Database
PostgreSQL databases on Neon Tech feature automated point-in-time recovery and SSL connection pooling.
7. Sub-Processors & External Infrastructure
We partner with leading technology providers to host our applications and maintain site reliability:
| Sub-Processor | Purpose | Privacy Framework |
|---|---|---|
| Cloudflare, Inc. | Edge caching, DDoS defense, Turnstile bot verification | GDPR / Standard Contractual Clauses (SCC) |
| Neon Tech | Managed cloud PostgreSQL database storage | SOC 2 Type II, ISO 27001 Certified |
| Cloudinary Ltd. | Optimized media hosting (AVIF/WebP avatars and logos) | ISO 27001, GDPR Compliant |
| Groq, Inc. | High-speed inference for AI growth recommendations | Zero Data Retention for Training |
| Razorpay / Paddle | Payment processing and merchant-of-record billing | PCI-DSS Level 1 Service Providers |
8. Data Retention & Automatic Expiration
We retain personal information only for as long as necessary to maintain your account and meet regulatory obligations:
Snapshot Caching Windows
Public Instagram and YouTube telemetry snapshots are cached for 12 hours to reduce API loads. After 12 hours, subsequent audits execute fresh queries.
Financial & Account Records
Credit transaction logs and invoice identifiers are retained for seven (7) years to comply with Indian statutory corporate and tax audits.
9. Your Privacy Rights & Facebook Data Deletion
Under applicable data protection frameworks—including the Indian Digital Personal Data Protection Act (DPDPA 2023), GDPR (EU/UK), and CCPA (California)—you have the following rights:
Right of Access & Portability
Request an export of all personal profile data and credit transaction ledgers linked to your user account.
Right to Rectification
Update or amend your name, email, avatar, or company details via your Profile Dashboard.
Right to Erasure ("To Be Forgotten")
Request permanent deletion of your user account, OAuth tokens, and historical analytics snapshots.
Right to Withdraw Consent
Revoke consent for email newsletters or disconnect linked third-party Meta accounts instantly.
Facebook / Meta Data Deletion Instructions
In accordance with Meta Platform Rules for apps utilizing Instagram Graph APIs, if you wish to remove your data associated with our app:
- Navigate to your Facebook Profile's Settings & Privacy > Settings.
- Click on Apps and Websites to see all platforms linked to your profile.
- Locate Shout OTB and click Remove.
- Alternatively, email our data team at shahid@shoutotb.com with the subject line "Meta Data Deletion Request". We will remove all cached tokens and account telemetry within 30 days and provide an audit confirmation code.
10. Cookie Policy & Consent Management
We utilize cookies and local storage mechanisms to improve navigation, preserve theme settings, and remember session states:
Strictly Necessary
Session authentication cookies (Flask session, remember_token) required to keep you signed in.
Performance
Google Tag Manager / Analytics to assess aggregate page visits without storing direct personal identities.
Functional UI
Local storage flags such as theme (dark/light mode) and shout_wallet_balance to prevent UI flashes.
We deploy Google Consent Mode v2. Non-essential cookies remain blocked by default until you explicitly provide affirmative consent. You can customize preferences at any time:
11. Corporate Privacy Contact & Grievance Redressal
For inquiries regarding this Privacy Policy, your personal data, or to exercise your privacy rights, please reach out to our Grievance Officer:
Data Controller: Pappa Bindha Pvt Ltd (Shout OTB)
CIN: U7310MP2025PTC078535
Privacy & Data Email: services@shoutotb.com
Billing Support: swati@shoutotb.com
Phone: +91 97520 00546
Corporate Office: A-17 Pallavi Nagar, Bawadiya Kalan, Bhopal - 462026, Madhya Pradesh, India
