Privacy Policy

Overview

enque.ai is an operating system for agencies: one workspace per client, where an agency's team runs its client work with AI agents, live data tables, dashboards and branded reports. We built it so that the agency's data stays the agency's, and each client's data stays walled from every other client's.

Three things first, because they decide the rest of this policy:

• We do not sell personal information. We do not build advertising profiles, and we do not use the content you put into your workspaces for advertising.
• We hold no AI model key of our own. Agents run on the agency OS against the model providers your agency configures and pays for. Your prompts and content reach a model provider only because your agency chose that provider.
• Credentials you connect are sealed. Tool keys and connected accounts are stored only as encrypted envelopes and are never written to a log, a page or a response.

Who we are, and in which role

enque.ai is operated by Digimaxx AI Solutions Private Limited, No.58/2, 2nd Floor, VP Road, Sankalpa (KM Nilayam), Madivala, Bengaluru, Karnataka, India, 560068 ("enque", "we", "us"). You can reach us at info@digimaxx.co.

We act in two roles:

• Controller for the personal data of people who visit enque.ai, request a demo, hold an account, or write to us: account details, website analytics, support correspondence.
• Processor for the personal data your agency puts into its workspaces — client contacts, campaign data, documents, the output of connected tools. Your agency is the controller of that data and decides why and how it is processed. A Data Processing Agreement (DPA) is available on request to info@digimaxx.co.

Information we collect

3.1Account information

Your name, email address, role (admin or member) and a password, stored only as a salted one-way hash (PBKDF2-SHA256). Joining a deployment is by email-bound invitation, so we also hold the invitation that admitted you: the inviting admin, the email it named and when it was issued.

3.2Workspace content

What your agency enters or generates in the product: client profiles and brand kits, activities and KPIs, data tables, dashboards and their queries, reports, skills, chat messages to the agents, and uploaded files. Files and knowledge collections live on the agency OS file and knowledge services; enque keeps the file records.

3.3Connected credentials

API keys, named credentials and OAuth connections your agency connects for data tools (search, ads, analytics and similar vendors). A key you paste is forwarded to the agency OS and sealed there; a connected account's token is held by the OS and never reaches enque. Enque records which credential each client uses, never the secret itself.

3.4Run and audit records

Every agent run and every decision that changes state is recorded: who acted, which agent ran, on which surface and subject, when, the model usage reported by the provider (token counts) and any error, verbatim. These records exist so that your agency can see and prove what was done in its name.

3.5Technical and log data

IP address, browser and device type, timestamps and request paths, collected by our hosting and edge providers and by the API's own logs for security and diagnostics. Logs never contain credentials or unsealed secrets.

3.6Communications

Transactional email we send you (invitations, password resets) and anything you send us at info@digimaxx.co or through a demo request.

3.7Website analytics

Aggregated, consent-based visit statistics on the public website. See the Cookie Policy.

3.8Billing information

Where a paid plan applies, billing is handled by [PAYMENT PROCESSOR]. We receive the plan, invoice status and the last four digits of a card; full card numbers never touch our systems.

3.9Google user data (Search Console, Analytics, Google Ads, BigQuery, Display & Video 360, Campaign Manager 360)

Your agency can connect Google accounts it already owns through Google's own OAuth consent screen, one consent per product. What each connector touches:

• Google Search Console (webmasters scope): search performance reports, URL Inspection results and sitemaps for sites you have verified. Used to produce search reports and indexing checks in your workspaces.
• Google Analytics (analytics.readonly and analytics.edit scopes): your GA4 accounts, properties and traffic reports, and — only on your instruction — the creation or archiving of custom dimensions and metrics.
• Google Ads (adwords scope): campaign performance, account structure and Keyword Planner data. Campaign changes are guarded: new campaigns start paused and destructive actions require typed confirmation.
• Google BigQuery (bigquery scope): the projects, datasets and tables your account can reach, and the results of the queries you run; every query is dry-run first, so one that would scan more than the configured limit is refused before it executes. On your instruction only, it also creates and updates datasets, tables and views, inserts or loads rows you provide, copies tables, and creates or removes scheduled queries in your own projects. Deleting anything requires typed confirmation.
• Display & Video 360 (display-video and doubleclickbidmanager scopes): the partners and advertisers your Google user can access in DV360, and their campaigns, insertion orders and line items; and the delivery reports you run (impressions, clicks, spend and conversions by date, campaign, insertion order and line item). Used to show your programmatic campaign structure and performance in your workspaces. The connector only reads; it makes no changes in DV360.
• Campaign Manager 360 (dfatrafficking and dfareporting scopes): the CM360 user profiles your Google user holds, the advertisers each profile can access, and those advertisers' campaigns, placements and ads; and the delivery reports you run (impressions, clicks, media cost and conversions). Used to show your Campaign Manager campaign structure and performance in your workspaces. Google offers no read-only version of these scopes; the connector only reads and makes no changes in CM360.

How this data is handled:

• Storage. We store the OAuth refresh token encrypted at rest, together with the Google account email and your selected site, property, customer ID, DV360 advertiser or CM360 profile and advertiser. Report data is fetched from Google when you ask for it and is not warehoused by us.
• Use. Google user data is used only to provide the features above inside your workspaces. It is never sold, never used for advertising, and never used to train AI models.
• Sharing. It is not shared with third parties except as needed to provide the service (section 6) or as required by law. Humans do not read it except with your permission, for security, or to comply with law.
• Revocation. Disconnecting a connector deletes the stored token and revokes our access at Google. You can also revoke access at any time from your Google Account permissions.

enque.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3.10Meta user data (Meta Ads)

Your agency can connect Meta ad accounts it already manages through Meta's own login (Facebook Login for Business). What the Meta Ads connector touches:

• Ad accounts and reporting (ads_read permission): the ad accounts your login can reach, their campaigns, ad sets and ads, and performance insights such as spend, reach, clicks and conversions. Used to produce reports and dashboards in your workspaces.
• Campaign changes (ads_management permission): only on your instruction, pausing or enabling campaigns, ad sets and ads, changing budgets, and creating campaigns, which start paused.
• Business assets (business_management permission): the businesses you belong to and the ad accounts they own, so you can choose which client account a workspace reads.
• Facebook Pages (pages_show_list, pages_read_engagement and pages_read_user_content permissions): the Pages your login manages, with their picture, followers and likes, their recent published posts with their images and reaction, comment and share counts, the comments on a post you open (the commenter's name, the text and the time), and the posts the Page's ads run with. Read only, to report on organic reach next to paid results. A Page's access token is requested for each read and never stored.
• Lead Ads (leads_retrieval and pages_manage_ads permissions): the lead forms on the Pages your login manages, and the answers people submitted on them (for example name, email and phone number). Read only, when you open a form, so you can follow up with the people who asked to be contacted. Lead answers are shown to you and are not stored by enque.ai.
• Instagram (instagram_basic and instagram_manage_insights permissions): for the Instagram business or creator account linked to a Page your login manages, its profile (username, name, picture, follower, following and post counts), its latest posts with their images, captions, likes and comments, the account's reach, views, profile visits and accounts engaged over the last 28 days, and, for a post you open, its reach, views, saves and shares. Read only, to report on organic Instagram results next to paid results. Nothing is posted, and this data is shown to you and not stored by enque.ai.

How this data is handled:

• Storage. We store the Meta access token encrypted at rest, together with the ad account you selected. Report data is fetched from Meta when you ask for it.
• Use. Meta user data is used only to provide the features above inside your workspaces. It is never sold, never used for advertising, and never used to train AI models.
• Sharing. It is not shared with third parties except as needed to provide the service (section 6) or as required by law.
• Deletion. Disconnecting the connector deletes the stored token. You can also remove enque.ai in your Facebook settings under Business Integrations; when you do, Meta tells us and we delete the token and the data we hold from that connection. The Data Deletion page explains every option.

enque.ai's use of data received from Meta complies with the Meta Platform Terms and Developer Policies.

3.11Amazon Ads data

Your agency can connect Amazon Ads accounts it already manages through Login with Amazon. What the Amazon Ads connector touches:

• Advertising profiles and reporting (advertising::campaign_management permission): the advertising profiles your Amazon login can reach, their Sponsored Products, Sponsored Brands and Sponsored Display campaigns, ad groups, keywords and targets, and performance reports such as spend, impressions, clicks, sales and ACOS. Used to produce reports and dashboards in your workspaces.
• Campaign changes: only on your instruction, pausing or enabling campaigns, changing budgets and bids, and creating campaigns, which start paused.

How this data is handled:

• Storage. We store the Amazon refresh token encrypted at rest, together with the advertising profile you selected. Report data is fetched from Amazon when you ask for it.
• Use. Amazon Ads data is used only to provide the features above inside your workspaces. It is never sold, never used for advertising, and never used to train AI models.
• Sharing. It is not shared with third parties except as needed to provide the service (section 6) or as required by law.
• Deletion. Disconnecting the connector deletes the stored token. You can also remove enque.ai from your Amazon account under Login with Amazon. The Data Deletion page explains every option.

enque.ai's use of data received from the Amazon Ads API complies with the Amazon Ads API License Agreement and the Amazon Ads Data Protection Policy.

3.12Snapchat Ads data

Your agency can connect Snapchat ad accounts it already manages by signing in with Snapchat. The Snapchat Ads connector is read-only. What it touches:

• Ad accounts and reporting (snapchat-marketing-api scope): the organizations and ad accounts your Snapchat login can reach, their campaigns, and performance statistics such as spend, impressions and swipes. Used to produce reports and dashboards in your workspaces.
• Your Snapchat profile: your Snapchat user id and display name, to show which login is connected.

How this data is handled:

• Storage. We store the Snapchat access and refresh tokens encrypted at rest, together with the ad account you selected. Statistics are fetched from Snapchat when you ask for them.
• Use. Snapchat Ads data is used only to provide the features above inside your workspaces. It is never sold, never used for advertising, and never used to train AI models.
• Sharing. It is not shared with third parties except as needed to provide the service (section 6) or as required by law.
• Deletion. Disconnecting the connector deletes the stored tokens. You can also remove enque.ai's access in your Snapchat account. The Data Deletion page explains every option.

How we use information

• To provide the service: sign you in, scope every query to your agency and to the client you are working in, run the agents you ask for, build the dashboards and reports you request.
• To send the service's own mail: invitations, password resets, notices about the service.
• To keep the service secure: detect abuse, enforce rate limits, investigate incidents, keep the audit trail.
• To support you when you write to us.
• To improve the product, using aggregated usage and the run ledger's status and error fields. We do not use your workspace content to train models, and we do not permit model providers to do so through us.
• To comply with the law and enforce our Terms.

Legal bases (EEA, UK and similar jurisdictions)

• Contract: account, workspace, run and billing processing needed to deliver the service you or your agency signed up for.
• Legitimate interests: security, abuse prevention, audit records, product improvement from aggregated data. We weigh these against your rights and do not rely on them for anything you would not reasonably expect.
• Consent: marketing email and non-essential cookies. Withdrawable at any time.
• Legal obligation: retention and disclosure the law requires of us.

For users in India, we process personal data under the Digital Personal Data Protection Act, 2023, on the basis of your consent and the legitimate uses the Act recognises.

How information is shared

We share personal data only with parties needed to run the service, each bound by contract:

We also disclose data when the law requires it, to protect the rights and safety of users or the public, or as part of a merger or acquisition, with notice to you.

We never share one agency's data with another agency. There is no shared tenant: each agency deployment is its own, with its own database.

International transfers

Our infrastructure runs in INDIA, and the model and tool vendors your agency connects run where they run. Where personal data leaves the EEA or UK we rely on the European Commission's Standard Contractual Clauses or the UK Addendum, and on the vendor's own certified safeguards.

For a dedicated or on-premises deployment, data stays in the region your agency chooses.

Data retention

Legal, accounting and dispute obligations may require us to keep some records longer.

How we protect data

Transport encryption on every connection, AES-256-GCM encryption of credentials at rest under a master key, salted one-way password hashing, signed and expiring session tokens, role-based access, per-client query scoping enforced in the data layer, and an audit record for every state change. The Security page describes the measures in detail. No system is perfectly secure, and we do not promise otherwise.

Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or port your personal data, to object to processing, to withdraw consent, and to complain to a supervisory authority. Write to info@digimaxx.co; we answer within 30 days.

• EEA / UK: the rights under the GDPR and UK GDPR above.
• California: the right to know, delete, correct, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as the CCPA defines those terms, and we do not discriminate against you for exercising your rights.
• India: the rights under the DPDP Act to access, correct, erase, nominate, and to grievance redressal. Grievances go to our Grievance Officer at info@digimaxx.co and are acknowledged within the statutory period.

If your data is in an agency's workspace, your request is usually one for that agency as controller. Tell us, and we will pass it on and help the agency honour it. Step-by-step deletion instructions, including for connected Google, Meta, Amazon and Snapchat accounts, are on the Data Deletion page.

Cookies and browser storage

The public website uses a small set of cookies. The product app uses browser local storage rather than cookies to hold your sign-in token and your layout preferences, and sets no advertising or tracking cookie. Details and your controls are in the Cookie Policy.

Children

enque.ai is a business product for agency teams. It is not directed at anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, write to info@digimaxx.co and we will delete it.

Changes to this policy

We may update this policy as the product, the law or our practices change. The date at the top moves with every change. For a material change we notify account holders by email or in the product before it takes effect.