Effective date: 2 November 2026 · Data controller/operator: AboveCEO Online Consulting LLP, Maharashtra, India · Privacy contact: connect@aboveceo.com

This Privacy Policy explains how AboveCEO Online Consulting LLP (“AboveCEO”, “we”, “us”) handles personal data when you visit our website, create an account, use a workspace, contact us, pay for a plan, or connect an external service. It applies to our websites and Services. It does not replace the privacy notices of providers you connect or the notices you must give to people whose data you upload.

1. Our role

For account, billing, website, support and service administration information, AboveCEO generally determines the purposes and means of processing and acts as the responsible organisation/controller or equivalent under applicable law. For personal data a customer, agency or business submits to its workspace about that customer’s own leads, customers, employees or website visitors (“Customer Data”), the customer generally decides why and how that data is used; AboveCEO processes it to provide the Services on the customer’s instructions. A written data-processing agreement may further describe roles and instructions. If you are an individual whose information was uploaded by an AboveCEO customer, contact that customer first; we will assist the customer and respond as law requires.

2. Information we handle

• Account and workspace details: name, business or agency name, email, login identifiers, role, workspace membership, preferences, authentication and security events.
• Customer Data you provide: leads, customer or contact records, CRM fields, notes, tasks, forms, booking or order details and other information your workspace users enter or connect. You control what you submit.
• Connected account data: account and asset identifiers, campaign/ad group/creative settings, performance and conversion metrics, analytics reports, page or site selections and related metadata returned by Google, Meta, Reddit, WordPress/WooCommerce or other connected services. We receive this only after an authorised connection and within available scopes.
• Transactions: plan, subscription and invoice status, payment amount, currency, provider transaction/subscription references and billing contact information. Payment credentials are collected and processed by the checkout provider; AboveCEO does not intend to store full card details.
• Support and communications: messages and attachments you send us, support history, and service notices.
• Service and device information: security and diagnostic events, request information and basic technical data needed to operate and protect the service. Exact infrastructure logs and retention depend on deployment configuration.
• Optional customer-site analytics events: if a customer installs AboveCEO’s tracking SDK on its website and explicitly grants analytics consent, the SDK can send a restricted list of events and non-personal category parameters (for example, page category or campaign identifiers). The SDK defaults to denied consent and validates against the event/parameter list. It is not designed to send free-text, page URLs, email addresses, phone numbers or page text. The customer is responsible for its visitor notice, consent mechanism and legal basis.
• Optional AI report summaries: when a workspace administrator opts a report template into AI summaries and configures an API credential, the server may send bounded numerical aggregates, date range and data-status information to the configured AI provider to produce a draft summary. Product documentation states customer rows, contact details, campaign names, provider errors and raw workflow text are excluded. A user’s “Sign in with ChatGPT” identity connection is separate and does not provide access to conversations or an API key.

Please do not submit sensitive personal data, children’s information, passwords, payment card numbers, government identifiers or special-category data unless a feature expressly supports it and you have a lawful basis and appropriate safeguards.

3. Purposes and legal grounds

We use information to create and administer accounts; provide workspace, CRM, reporting, campaign and integration features; authenticate users and apply roles and plan permissions; process subscriptions and payments; provide support and service communications; protect the service, investigate misuse and maintain records; respond to legal requests; and, where enabled, perform consent-based customer-site event analytics or optional AI summaries. Depending on the applicable law and context, our legal grounds may include performing a contract, taking requested pre-contract steps, consent, compliance with legal obligations, and legitimate interests such as service security and administration where those interests are not overridden by your rights. We do not rely on a single legal basis for every processing activity.

4. How information is shared

We share information only as needed for the purposes above and under applicable protections:

• With your connected providers: Google, Meta, Reddit, WordPress/WooCommerce and other services you choose. Providers supply data to us or receive actions you direct through the integration. Their own terms and privacy policies apply.
• With service providers: hosting, storage, email delivery, payment processing, monitoring and support providers used to operate the service. Provider and hosting locations can vary by deployment. We have not published a complete fixed subprocessor register here; request current provider details at connect@aboveceo.com.
• AI provider: only when an administrator enables an AI summary and supplies the provider configuration; only the bounded input described above is sent for that feature.
• Within your organisation: workspace owners/admins and users with assigned access may view data according to workspace roles and permissions.
• Legal and safety: authorities, courts, regulators, advisers or affected parties when required by law or reasonably necessary to protect rights, safety and service integrity.
• Business changes: a successor or transaction participant if a merger, financing, restructuring or sale occurs, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data for money. We do not use Customer Data to build advertising profiles for AboveCEO’s own unrelated marketing. We do not use workspace Customer Data to train general-purpose AI models as a product purpose. The preceding statements do not restrict provider processing under the provider’s own terms after you connect that provider.

5. International processing

AboveCEO is based in India. Our service providers and connected platforms may process information in India or other countries. Where personal data is transferred internationally, we aim to use a lawful transfer mechanism and appropriate safeguards required by the law applying to the transfer. Contact us for available information about relevant safeguards. You should review connected-provider terms for their own international handling.

6. Retention

We retain information while it is needed to provide the service, maintain your account, complete transactions, meet legal and accounting duties, resolve disputes and protect the service. Connected OAuth grants and related access data are retained until you disconnect them, the grant is revoked or invalidated, or we otherwise no longer need them. Workspace records and backups may persist after a deletion request for the time required to process the request, meet legal obligations, resolve disputes or complete routine backup cycles. We have not established or publicly verified a single fixed deletion or backup-retention period for every data category. You may ask us for the current retention information relevant to your account.

7. Your privacy rights and choices

Depending on where you live and the law that applies, you may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or review of certain decisions; you may also have the right to complain to a regulator. Rights can have lawful exceptions and differ by jurisdiction. To make a request, email connect@aboveceo.com with “Privacy request” in the subject and enough information to identify the account and request. We may verify your identity and authority before acting. If your data belongs to an AboveCEO customer’s workspace, we may refer the request to that customer or act on its documented instructions. You can disconnect an integration in your workspace; you may also need to revoke access directly with the provider.

If you use our consent-based SDK on a customer’s website, use that website’s consent controls to change your choice. The SDK does not itself provide a visitor preference portal.

8. Cookies and similar technologies

Our website may use essential browser storage or cookies for authentication, security, and remembering a billing-country selection. Customer-site tracking SDK events are not collected by default and require explicit analytics consent. We do not claim that every deployment uses only essential cookies; browser and provider features may set their own storage. You can manage browser storage through browser settings, though disabling essential storage may prevent login or checkout from working.

9. Children and age

The Services are for people aged 18 or older and are not directed to children. Do not create an account if you are under 18 or upload children’s personal data unless the relevant feature is expressly designed for it and you have authority and a lawful basis. If you believe a child’s data was provided, contact us so we can assess and take appropriate action.

10. Security

We use technical and organisational safeguards intended to protect information, including role- and workspace-based access controls, server-side handling of connected OAuth credentials, authenticated sessions and input validation. Certain integration vaults use AES-256-GCM encryption in application code. Security depends on the deployed configuration and the safeguards of providers and customers; no internet service can promise absolute security. We do not claim an independent security certification. See the Security Policy for more detail and report suspected incidents to connect@aboveceo.com.

11. Applicable privacy laws

We handle personal data in accordance with applicable privacy and data-protection laws. These may include India’s Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 to the extent their relevant provisions have commenced and apply; the EU General Data Protection Regulation and UK GDPR where their territorial scope applies; and U.S. state privacy laws, including the California Consumer Privacy Act as amended, where their scope and thresholds apply. The DPDP framework has phased commencement dates; this notice does not state that provisions not yet commenced are already in force. Rights, duties and remedies depend on the law and facts applicable to a particular person and processing activity.

12. Updates and contact

We may update this policy when our practices or legal obligations change. We will post the latest text here and change its effective date. For questions, privacy requests, concerns or complaints, contact AboveCEO Online Consulting LLP at connect@aboveceo.com. Please include your country and the relevant workspace or account; do not email passwords or access tokens.