Privacy Policy

Bach.ai is operated by Wittelsbach Private Limited (“Wittelsbach”, “we”, “our”, “us”), a company registered in India. This policy explains what we collect when you use Bach.ai — our agentic Meta Ads operator — at https://www.wittelsbach.ai and https://app.wittelsbach.ai, how we use it, and the privacy rights you have. This policy applies when you use Bach.ai; where we rely on your consent for a specific use, we ask for it separately.

1. Who we are (data controller)

The controller responsible for your personal data is:

Wittelsbach Private Limited
Banjara Hills, Road No. 12, Hyderabad – 500034, Telangana, India
Email: info@wittelsbach.ai

For any privacy question, or to exercise your rights, contact us at info@wittelsbach.ai.

2. Information we collect

We collect only what we need to run your audits and operate your ad account on your behalf — in three ways.

a. Information you give us

• Your name, email and phone number
• Company name, website and industry
• Authentication credentials — passwords are stored only as secure, salted hashes, never in plain text
• Billing details — processed by our payment provider; we do not store full card numbers
• Anything you send us in support requests

b. Data from accounts you connect

When you connect a Meta Ads account or e-commerce store, Bach reads only the data needed to audit your account and find revenue leaks:

• Campaign, ad set, ad and creative structure and performance
• Audience, frequency and placement metrics
• Store revenue, conversion and cart data (for true ROAS and MER)

We access only what the permissions you grant allow, and Bach stays read-only until you approve a change.

c. Information we collect automatically

• IP address, device and browser type
• How you use the site — pages visited, time spent, referral URLs
• Cookies and similar technologies (see our Cookie Policy)

3. How we use your information, and our legal bases

We use your information to:

• Run audits and rank each revenue leak by the money it costs
• Propose changes and — once you approve them — execute approved Meta Ads changes; provide Google Ads intelligence where connected
• Operate, secure and improve Bach.ai
• Process your subscription and provide support
• Detect abuse and meet our legal obligations

We do not sell your data, and we never use your account data to train AI models for anyone else.

Where the EU/UK GDPR applies, we rely on these legal bases:

• Performance of a contract — to create your account, run audits, execute the changes you approve, and bill you.
• Legitimate interests — to secure, maintain and improve the Service and prevent abuse, balanced against your rights.
• Consent — for analytics cookies and, where required, marketing emails. You can withdraw consent at any time.
• Legal obligation — to keep tax and accounting records and to respond to lawful requests.

4. Meta platform data

Bach connects to the Meta (Facebook/Instagram) advertising platform through the Meta Marketing API. Our access and use of information obtained through the Meta platform complies with the Meta Platform Terms and the Meta Developer Policies. Specifically:

• We use Meta advertising data only to provide the Service to you — to audit your account, surface revenue leaks, and execute the changes you approve.
• We do not sell Meta platform data, and we do not use it to build profiles for unrelated purposes or to train AI models for third parties.
• Access tokens are encrypted before storage, and Bach is read-only until you approve an action (see section 5).
• You can revoke Bach’s access and request deletion of your data at any time — see our Data Deletion Instructions.

5. How we protect connected accounts

Connecting your ad account is the most sensitive thing you do with Bach, so we hold it to a clear standard:

• Access tokens for connected accounts are encrypted before they are stored.
• Bach is read-only by default — it never changes your account without your explicit, per-action approval.
• Every action Bach takes is logged and, where the platform allows, reversible.
• You can disconnect an account or revoke access at any time, which immediately stops all access.

6. Cookies and analytics

We use a small number of cookies and similar technologies to keep you signed in, remember your cookie choice, and — only with your consent — understand how the site is used so we can improve it. On your first visit we ask you to accept or decline analytics cookies, and analytics load only if you accept. You can change your choice or disable cookies at any time. Full details, including each tool we use and how to withdraw consent, are in our Cookie Policy.

7. Service providers and when we share information

We share data only with service providers that act on our behalf and are bound by contract to protect it and process it only on our instructions. By category, these are:

• Cloud hosting and infrastructure
• Payment processing
• Product analytics and error monitoring
• Email delivery
• The AI providers that power Bach’s analysis

We also disclose data to authorities where the law requires. We never share one customer’s ad or store data with another, and we do not sell your personal information or share it for cross-context behavioural advertising. A list of the specific providers we use is available to business customers on request.

8. International data transfers

Wittelsbach Private Limited is based in India. If you use Bach.ai from outside India, your information will be transferred to and processed in India, and in other countries where we or our service providers operate, which may have data-protection laws different from your own. Where we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we put in place appropriate safeguards — such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) — where required by law. For more information about these safeguards, contact info@wittelsbach.ai.

9. How long we keep it

We keep your information only as long as needed to provide the Service, meet legal obligations and resolve disputes, and you can request deletion of your account at any time. Specific timeframes are set out in our Data Retention Policy.

10. Data security

We protect your data with encryption in transit and at rest, secure cloud infrastructure, limited internal access, and ongoing monitoring. No system is perfectly secure, but we take all reasonable steps to keep your data safe.

11. Automated decisions

Bach analyses your account and proposes changes, but it does not make decisions that produce legal or similarly significant effects about you without human involvement. Changes to your connected accounts are executed only after you explicitly approve them.

12. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (“right to erasure”)
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting processing already carried out

To exercise any of these, email info@wittelsbach.ai. We will respond within the time required by applicable law (for example, within one month under the GDPR, extendable where permitted). If you are in the EEA or UK and believe we have not handled your data properly, you also have the right to lodge a complaint with your local data-protection supervisory authority (for example, the Information Commissioner’s Office in the UK, or your EU member-state authority).

13. Indian users (DPDP Act)

If you are in India, the Digital Personal Data Protection Act, 2023 gives you rights to access, correct, complete, update and erase your personal data, to nominate another person to exercise your rights in the event of death or incapacity, and to grievance redressal. To exercise these rights or raise a grievance, contact us at info@wittelsbach.ai and we will respond within the time required by law.

Bach.ai is a business tool directed at advertisers and businesses, not at children. We do not knowingly process the personal data of anyone under 18, so the Act’s requirement to obtain verifiable parental consent before processing a child’s data does not arise in the ordinary course of our service (see section 16).

14. California privacy rights

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use it, to request access to or deletion of that information, to correct it, and to opt out of its “sale” or “sharing”. We do not sell or share your personal information, and we will not discriminate against you for exercising any of your rights. The categories we collect and our purposes are described in sections 2 and 3 above. To make a request, email info@wittelsbach.ai.

15. Marketing communications

If you opt in, we may send you product and marketing emails. You can unsubscribe at any time using the link in any such email, or by emailing us. Service and billing messages (for example, security, account or payment notices) are not marketing and are sent as part of operating the Service.

16. Children

Bach.ai is not intended for anyone under 18, and we do not knowingly collect data from minors.

17. Third-party links

Bach.ai may link to third-party websites and services we do not own or control — for example our social profiles, or the stores and ad platforms you connect. This policy does not cover their practices, and we are not responsible for the content, privacy or security of any third-party site. Review the privacy policy of any external site before you share information with it.

18. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a new “Last updated” date.

19. Contact us

Questions about this policy or your data? Contact:
Wittelsbach Private Limited
Banjara Hills, Road No. 12, Hyderabad – 500034, Telangana, India
Email: info@wittelsbach.ai
Website: https://www.wittelsbach.ai