What we hold, and why we hold it.

GaliGali Soft Labs Private Limited is a private limited company incorporated in India, with its registered office at 2-3-55/43, Uppal, New Shanti Nagar, Hyderabad, Medchal Malkajgiri, Telangana 500039. Our GSTIN is 36AALCG9710B1ZP, our PAN is AALCG9710B, and our CIN is U63990TS2025PTC197247. In this policy, “we”, “us” and “our” mean that company. We are the company responsible for the information described here.

This policy applies to:

• pdooh.ai — the pDOOH Brands Manager, where advertisers plan and run campaigns.
• media.pdooh.ai — the pDOOH Media Owner Console, where media owners follow delivery and earnings.
• login.galigali.in — the shared sign-in used across our products.
• galigali.in — this website.

Together we call these “the platform”. Where we have signed a separate written agreement with you that deals with personal information, that agreement applies alongside this policy.

Registration is how you get an account. When you register and when you sign in, we handle:

• Your identity on the platform — your name, the email address or mobile number you registered with, and your display name if you set one.
• Your sign-in codes — we sign you in with a one-time code sent to your email address or mobile number. We store a cryptographic hash of the code so that it can be checked, and the code expires shortly after it is issued.
• The workspaces you belong to — the advertiser or media owner workspaces you are a member of, the role you hold in each, and invitations you have sent or accepted.
• Sign-in and session activity — records of code requests, sign-ins and sessions, including the time, the internet address the request came from and the browser or app used. We use these to keep accounts secure and to investigate suspicious activity.

Where you invite colleagues into a workspace, we handle the contact details you give us for them so that we can send the invitation and set up their access.

Advertisers and media owners give us the details we need to bill them and to issue valid tax documents. A billing profile holds the legal entity name and any trade name, the GSTIN and PAN, the billing address with state and pincode, and the invoice contacts — the email address and phone number to which billing documents and notices are sent.

Your state or place of supply is needed for every account, because it decides which GST applies. A GSTIN is needed where you want a business tax invoice in your entity’s name.

Changes to a billing profile are recorded with the identity of the person in your workspace who made them, so that a change to an invoicing detail can be traced later.

Payments on the platform are handled by a regulated payment gateway. Card, bank and UPI details are entered on the gateway’s own secure page and are handled by the gateway under its terms. The gateway is given the details it needs to take the payment and to reach you about it — your name, email address, mobile number and the amount — and it returns a confirmation of the outcome, including the payment method used and its own reference for the transaction. We keep that confirmation as the record of the payment.

We issue GST invoices, receipts and statements from the details on your billing profile. Each document freezes a copy of your legal name, GSTIN and address as they stood when it was issued, because a tax document must not shift after the fact. These documents, and the accounting records behind them, are retained for the period Indian tax and company law requires.

• Campaigns — the campaigns you create, their settings, schedules, budgets and status, and the changes made to them.
• Creatives — the files you upload for a campaign, and the outcome of the review they go through before they run.
• Delivery reports — the reports we produce for your campaigns and, for media owners, the delivery and earnings shown in the Media Owner Console.
• Spend and balance — funds you add, spend accrued as your campaigns run, settlements, and the invoices, receipts and statements issued to your account.
• Account activity — a record of significant actions taken in a workspace and who took them, which we use for support, security and billing enquiries.

If you write to us — a support request, a billing query, a grievance — we keep that correspondence so that we can answer it and refer back to it.

When you visit our websites, our servers receive the ordinary information a browser sends in order to serve a page. We use cookies and similar browser storage to run the sites: to carry your sign-in session across our products so that one sign-in works everywhere, to keep that session secure, and to remember preferences you have set.

You can control cookies through your browser settings. Blocking the cookies that carry your sign-in session will stop you from signing in and using the platform.

Where we ask for your consent for a particular use, you may withdraw it at any time. Withdrawing consent does not affect anything done before you withdrew it, and it does not affect processing we carry out to perform our contract with you or to meet a legal obligation.

• Within your workspace — members of a workspace can see that workspace’s campaigns, documents and account activity, according to the role they hold. Invite people accordingly.
• The payment gateway — a regulated gateway that processes payments, as described in section 4.
• Service providers — organisations that help us operate, secure and support the platform and send service messages. They act on our instructions, under contract, for that purpose only.
• Professional advisers — our accountants, auditors, bankers, insurers and lawyers, where they need the information to advise us.
• Authorities — tax authorities, regulators, courts and law enforcement, where the law requires it or a valid legal request is made.
• A corporate transaction — if our business, or part of it, is reorganised, acquired or transferred, information may pass to the party involved, subject to this policy.

Some of the organisations we work with operate outside India. Where information is handled outside India, we do so in accordance with applicable Indian law and under contractual terms that require it to be protected.

Invoices, receipts, statements and the accounting records behind them are retained for the period Indian tax and company law requires. We cannot delete a tax document on request, and we would be in breach of the law if we did.

Other information is kept while your account is open and for as long as we need it for the purposes set out in section 7 — including answering a query, resolving a dispute, and establishing, exercising or defending a legal claim.

Subject to Indian law, you may ask us to:

• Give you a summary of the personal information we hold about you and how we process it.
• Correct, complete or update information that is wrong or out of date. Note that a tax document already issued carries a frozen snapshot: a correction is made by issuing a further document, not by editing the original.
• Erase information we are not required to keep for a legal, tax or accounting purpose, or that we no longer need for the purposes in section 7.
• Withdraw a consent you gave us, where our processing rests on it.
• Nominate another person to exercise these rights on your behalf in the circumstances the law provides for.

How to raise a request

Write to our Grievance Officer using the details at the foot of this page. Send your request from the email address on your account, or include the mobile number registered to it, and tell us what you want. We verify who you are before we act on a request about personal information, and we may ask for more detail to do that. If you are not satisfied with how we have handled a request, you may take the matter to the authority appointed under Indian data protection law.

We take reasonable technical and organisational measures to protect the information we hold. In general terms:

• Information is encrypted in transit and at rest, and our systems are reached over encrypted connections.
• There is no password to lose. We sign you in with a one-time code, we store a hash of that code rather than the code itself, and codes expire quickly and are rate-limited.
• Session tokens are stored as hashes, rotate as you use the platform, and are cut off when we detect a token being reused after it was retired.
• Access to systems and to customer information is restricted to people who need it for their role, and administrative access is held narrowly.
• Billing documents are served through short-lived links rather than public addresses, and sign-in identifiers are masked in our operational logs.

Keeping your own account safe matters too: keep control of the email inbox or mobile number attached to it, never pass a sign-in code to anyone, and tell us promptly if you think your account has been used without your permission.

The platform is for businesses. Accounts are for people aged 18 or over who are acting for a business, and our products are not directed at children. If you believe a person under 18 has registered with us, write to our Grievance Officer and we will look into it and act.

We may update this policy as our products and our legal obligations develop. The date at the top of the page shows the current version. Where a change materially affects how we handle information about you, we will tell account holders by email or through the platform before it takes effect.