Privacy Policy

Bach.ai is operated by Wittelsbach Private Limited (“Wittelsbach”, “we”, “our”, “us”), a company registered in India. This policy explains what we collect when you use Bach.ai — our agentic Meta Ads operator — at https://www.wittelsbach.ai and https://app.wittelsbach.ai, how we use it, and the privacy rights you have. Where we rely on your consent for a specific use, we ask for it separately.

It covers two things we do, and you may use either without the other:

• The Bach.ai platform — the software product you sign up for, connect accounts to, and subscribe to.
• Wittelsbach Advisory — our paid, one-off E-commerce Growth Consultation, which you can buy without a Bach.ai account. Because that is a different relationship with different data, it has its own section: see section 5.

1. Who we are (data controller)

The controller responsible for your personal data is:

Wittelsbach Private Limited
Banjara Hills, Road No. 12, Hyderabad – 500034, Telangana, India
Email: info@wittelsbach.ai

For any privacy question, or to exercise your rights, contact us at info@wittelsbach.ai.

2. Information we collect

We collect only what we need to run your audits and operate your ad account on your behalf — in three ways.

a. Information you give us

• Your name, email and phone number
• Company name, website and industry
• Authentication credentials — passwords are stored only as secure, salted hashes, never in plain text
• Billing details — processed by our payment provider; we do not store full card numbers
• Anything you send us in support requests

b. Data from accounts you connect

When you connect a Meta Ads account or e-commerce store, Bach reads only the data needed to audit your account and find revenue leaks:

• Campaign, ad set, ad and creative structure and performance
• Audience, frequency and placement metrics
• Store revenue, conversion and cart data (for true ROAS and MER)

We access only what the permissions you grant allow, and Bach stays read-only until you approve a change.

c. Information you give us when you book an E-commerce Growth Consultation

If you buy the advisory consultation, we collect the answers you type into the consultation brief (your brand, store URL, category and market, revenue and ad-spend bands, margin and repeat-rate bands, the channels and platform you run, and your description of what you think is going wrong and what you have already tried), your name, email and phone or WhatsApp number, the scheduling details of the call you choose after payment is verified, and the payment reference our payment provider returns. If you choose to connect your Meta ad account for the consultation, we also collect the read-only snapshot described in section 5.

d. Information we collect automatically

• IP address, device and browser type
• How you use the site — pages visited, time spent, referral URLs
• Cookies and similar technologies (see our Cookie Policy)

If you accept optional advertising measurement, we use the OpenAI / ChatGPT Ads pixel on the advisory sales page to measure visits and newly submitted briefs. OpenAI receives event identifiers, timestamps, page and referral information, browser identifiers and associated network information. Automatic advanced matching, when enabled, can use contact details in hashed form to match conversions to ads. When configured, we also send the accepted-brief event through OpenAI's server Conversions API using the same event identifier. We do not include your brief answers, payment credentials, booking access token or connected Meta account data in those conversion event payloads. You can decline or withdraw this measurement through Cookie settings in the footer.

When configured and accepted, the Meta Pixel also measures page visits and advisory funnel actions, including the start of a brief and a newly accepted brief. Meta receives event and browser information, page/referral information and advertising identifiers; hashed contact matching may operate when enabled in the advertiser settings. We do not manually add brief answers, payment credentials or booking tokens to these events. The payment confirmation, booking recovery and Meta authorisation-return pages load no marketing analytics.

3. How we use your information, and our legal bases

We use your information to:

• Run audits and rank each revenue leak by the money it costs
• Propose changes and — once you approve them — execute approved Meta Ads changes; provide Google Ads intelligence where connected
• Operate, secure and improve Bach.ai
• Process your subscription and provide support
• Detect abuse and meet our legal obligations
• Deliver an E-commerce Growth Consultation you have paid for — read your brief, prepare and hold the call, and write the action plan

We do not sell your data, and we never use your account data to train AI models for anyone else.

Where the EU/UK GDPR applies, we rely on these legal bases:

• Performance of a contract — to create your account, run audits, execute the changes you approve, and bill you; and, for the advisory service, to take your booking, take payment, and prepare and deliver the consultation you bought (including the read-only ad-account snapshot, where you choose to connect one).
• Legitimate interests — to secure, maintain and improve the Service and prevent abuse, balanced against your rights.
• Consent — for optional analytics and advertising measurement and, where required, marketing emails. You can withdraw consent at any time.
• Legal obligation — to keep tax and accounting records and to respond to lawful requests.

4. Meta platform data

Bach connects to the Meta (Facebook/Instagram) advertising platform through the Meta Marketing API. Our access and use of information obtained through the Meta platform complies with the Meta Platform Terms and the Meta Developer Policies. Specifically:

• We use Meta advertising data only to provide the Service to you — to audit your account, surface revenue leaks, and execute the changes you approve.
• We do not sell Meta platform data, and we do not use it to build profiles for unrelated purposes or to train AI models for third parties.
• Access tokens are encrypted before storage, and Bach is read-only until you approve an action (see section 6).
• You can revoke Bach’s access and request deletion of your data at any time — see our Data Deletion Instructions.

The advisory connection described in section 5 is a narrower, separate use of the same platform: it requests only read permissions, reads once, and revokes itself. The commitments above apply to it in full.

5. Wittelsbach Advisory — E-commerce Growth Consultation

The E-commerce Growth Consultation is a paid, one-off advisory service: you fill in a brief, pay US$49, and then choose a time for a 45-minute call. You do not need a Bach.ai account, and buying it does not create one. This section describes everything we do with your data for that service.

a. The brief, your booking and your payment

We keep the answers you gave in the brief, your contact details, the details of the call you booked, and the payment reference our payment provider returns to us. We keep them to reconcile the payment, hold the call, write your action plan and meet our tax and accounting obligations. Our lawful basis is performance of the contract you entered when you paid, and legal obligation for the financial records. Your brief is read by the two founders and by nobody else.

If you accept optional measurement, we also keep a bounded first-touch record: campaign labels, the landing path, referrer origin and the applicable advertising click identifier. It contains no booking capability or arbitrary query string. A verified payment can then be reported to the provider you accepted through a retryable server queue. Withdrawing consent cancels an event that has not entered provider delivery. A request already in flight may complete, and an event a provider already received cannot be recalled.

Scheduling is handled by an embedded third-party booking tool and payment by a third-party payment provider; both act as our service providers under contract, and the categories are listed in section 8. We never receive your full card number.

b. Connecting your Meta ad account — optional, and read-only

After your payment is verified we invite you to connect your Meta ad account so the consultation uses your real numbers rather than the brief alone. This is optional. If you skip it, the call and the written action plan go ahead exactly as described; we simply work from your brief and from screen sharing on the call. Our lawful basis is performance of that same contract, and you can withdraw at any point by disconnecting or asking us to delete what we read.

If you do connect, this is precisely what happens:

• We ask for two permissions and both are read-only: ads_read and business_management. We do not hold, and therefore cannot request, any permission that would let us create, pause, edit or spend in your account — not for the advisory service and not for anyone. It is read-only by construction, not merely by policy.
• We read your account once. In a single pass we read your ad accounts and their currency and timezone, your campaigns, ad sets and ads with their status and budgets, and your delivery and results figures for the last 90 days — spend, impressions, clicks, reach, frequency, and purchase and conversion counts and values — together with placement and age/gender breakdowns for the last 30 days.
• We do not store your Meta password or your access token. The authorisation your browser receives is sent to us once, used inside that single request, and discarded. There is nowhere in our systems that holds it.
• We switch our own access off immediately. As soon as we have read your account we remove our app from your Meta account ourselves. You will see Wittelsbach disappear from your Meta business integrations straight away. If that removal does not confirm, we tell you so on the page and ask you to remove it yourself.
• We never read your customers’ personal data. We read aggregate performance figures, not the people behind them. We do not download customer lists, custom-audience membership, lead-form submissions or messages.
• We do not sell it, share it, or train models on it. It is used to prepare your consultation and written action plan, and for nothing else.

c. How long we keep the advisory data, and how to delete it

• The ad-account snapshot is deleted automatically 90 days after we read it. That deletion is automatic and does not require you to ask.
• You can delete it sooner, yourself, at any time — there is a “delete what I shared” control on the connect page — or by emailing info@wittelsbach.ai from the address you booked with.
• Your brief and your written action plan are kept for up to 24 months so we can answer questions about the work, then deleted; you can ask us to delete them sooner.
• Payment records are kept for 7 years because tax law requires it. They are isolated and access-restricted.

Full timeframes are in our Data Retention Policy, and the request routes — including the route for people with no Bach.ai account — are in our Data Deletion Instructions.

6. How we protect connected accounts

Connecting your ad account is the most sensitive thing you do with Bach, so we hold it to a clear standard:

• Access tokens for connected accounts are encrypted before they are stored.
• Bach is read-only by default — it never changes your account without your explicit, per-action approval.
• Actions Bach takes are logged. Where the action and Meta support it, Bach also offers rollback.
• You can disconnect an account or revoke access at any time, which immediately stops all access.

7. Cookies and analytics

We use a small number of cookies and similar technologies to keep you signed in, remember your cookie choice, and — only with your consent — understand how the site is used so we can improve it. On your first visit we ask you to accept or decline analytics cookies, and analytics load only if you accept. You can change your choice or disable cookies at any time. Full details, including each tool we use and how to withdraw consent, are in our Cookie Policy.

8. Service providers and when we share information

We share data only with service providers that act on our behalf and are bound by contract to protect it and process it only on our instructions. By category, these are:

• Cloud hosting and infrastructure
• Payment processing
• Product analytics and error monitoring
• Email delivery
• Scheduling and calendar booking (the advisory call)
• The AI providers that power Bach’s analysis

We also disclose data to authorities where the law requires. We never share one customer’s ad or store data with another, and we do not sell your personal information or share it for cross-context behavioural advertising. A list of the specific providers we use is available to business customers on request.

9. International data transfers

Wittelsbach Private Limited is based in India. If you use Bach.ai from outside India, your information will be transferred to and processed in India, and in other countries where we or our service providers operate, which may have data-protection laws different from your own. Where we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we put in place appropriate safeguards — such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) — where required by law. For more information about these safeguards, contact info@wittelsbach.ai.

10. How long we keep it

We keep your information only as long as needed to provide the Service, meet legal obligations and resolve disputes, and you can request deletion of your account at any time. Advisory data follows the separate rules in section 5 — most importantly, a connected ad-account snapshot is deleted automatically 90 days after we read it. Specific timeframes are set out in our Data Retention Policy.

11. Data security

We protect your data with encryption in transit and at rest, secure cloud infrastructure, limited internal access, and ongoing monitoring. No system is perfectly secure, but we take all reasonable steps to keep your data safe.

12. Automated decisions

Bach analyses your account and proposes changes, but it does not make decisions that produce legal or similarly significant effects about you without human involvement. Changes to your connected accounts are executed only after you explicitly approve them.

13. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (“right to erasure”)
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting processing already carried out

To exercise any of these, email info@wittelsbach.ai. We will respond within the time required by applicable law (for example, within one month under the GDPR, extendable where permitted). If you are in the EEA or UK and believe we have not handled your data properly, you also have the right to lodge a complaint with your local data-protection supervisory authority (for example, the Information Commissioner’s Office in the UK, or your EU member-state authority).

14. Indian users (DPDP Act)

If you are in India, the Digital Personal Data Protection Act, 2023 gives you rights to access, correct, complete, update and erase your personal data, to nominate another person to exercise your rights in the event of death or incapacity, and to grievance redressal. To exercise these rights or raise a grievance, contact us at info@wittelsbach.ai and we will respond within the time required by law.

If you buy an E-commerce Growth Consultation, the notice required before we collect your data is given at the point of collection: the brief tells you what is stored and why before you submit it, and the connect step sets out the two read-only permissions, what we read, that we do not keep your access token, and the 90-day deletion — before you authorise anything. Connecting your ad account is a specific, informed and voluntary act you can decline or undo, and withdrawing it is a single control on that page or one email to info@wittelsbach.ai. Withdrawing does not affect the processing already carried out, and does not entitle us to keep what you asked us to delete.

Bach.ai is a business tool directed at advertisers and businesses, not at children. We do not knowingly process the personal data of anyone under 18, so the Act’s requirement to obtain verifiable parental consent before processing a child’s data does not arise in the ordinary course of our service (see section 17).

15. California privacy rights

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use it, to request access to or deletion of that information, to correct it, and to opt out of its “sale” or “sharing”. We do not sell or share your personal information, and we will not discriminate against you for exercising any of your rights. The categories we collect and our purposes are described in sections 2 and 3 above. To make a request, email info@wittelsbach.ai.

16. Marketing communications

If you opt in, we may send you product and marketing emails. You can unsubscribe at any time using the link in any such email, or by emailing us. Service and billing messages (for example, security, account or payment notices) are not marketing and are sent as part of operating the Service.

17. Children

Bach.ai is not intended for anyone under 18, and we do not knowingly collect data from minors.

18. Third-party links

Bach.ai may link to third-party websites and services we do not own or control — for example our social profiles, or the stores and ad platforms you connect. This policy does not cover their practices, and we are not responsible for the content, privacy or security of any third-party site. Review the privacy policy of any external site before you share information with it.

19. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a new “Last updated” date.

20. Contact us

Questions about this policy or your data? Contact:
Wittelsbach Private Limited
Banjara Hills, Road No. 12, Hyderabad – 500034, Telangana, India
Email: info@wittelsbach.ai
Website: https://www.wittelsbach.ai