Privacy Policy

This Privacy Policy explains how Herbax Ayurveda Science Pvt Ltd (“Herbax”, “we”, “us”) collects, uses, shares, stores, and protects information in connection with its affiliate network and lead-generation CRM (the “Platform”). It applies to affiliates, agents, advertisers, and end-users whose data is processed through the Platform. We handle personal data in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and we align with the core principles of the GDPR for international data.

• Personal data: name, phone number, email address, and (for affiliates) business details, payment/KYC information, and tax identifiers.
• Technical data: IP address, device and browser type, operating system, identifiers, referral/click IDs, timestamps, and tracking/postback parameters.
• Lead data collected by affiliates: end-user contact details and interest information submitted to the Platform by affiliates through forms, landing pages, or APIs.
• Usage data: dashboard activity, campaign performance, communications, and support interactions.

• Lead processing: to receive, validate, route, and fulfil Leads, and to share qualified Leads with the relevant Advertiser.
• CRM operations: to manage affiliate accounts, calculate and pay commissions, provide support, and operate the Platform.
• Analytics & fraud prevention: to measure performance, detect and prevent duplicate, fake, bot, or fraudulent activity, and maintain quality and security.
• Communication: to send transactional, account, compliance, and (where permitted) service updates.
• Legal & compliance: to comply with applicable laws, enforce our terms, and protect our rights and users.

We process data on the lawful bases of consent, contractual necessity, legitimate business interest, and legal obligation, as applicable.

• With advertisers: qualified Lead data is shared with the Advertiser for whom it was collected, to enable contact and fulfilment.
• With internal teams & processors: with our staff, call-centre agents, logistics partners, and trusted service providers who process data on our behalf under confidentiality obligations.
• Legal requirements: where required to comply with law, regulation, legal process, or governmental request, or to protect rights, safety, and against fraud.
• Business transfers: in connection with a merger, acquisition, or reorganisation, subject to this Policy.

We do not sell personal data. We do not share data beyond what is necessary for the purposes above.

We retain personal and Lead data only for as long as necessary to fulfil the purposes described, to comply with legal, tax, accounting, and audit obligations, and to resolve disputes or enforce agreements. When no longer required, data is securely deleted, anonymised, or archived in line with our retention schedule and applicable law.

The Platform uses cookies, pixels, postbacks, click IDs, and similar technologies to operate sessions, attribute Leads and conversions, prevent fraud, and analyse performance. You can control cookies through your browser settings; disabling certain cookies may impair tracking, attribution, and dashboard functionality.

We implement reasonable security practices and procedures as required under the SPDI Rules, including access controls, role-based permissions, encryption in transit, secure credentials/API keys, monitoring, and regular backups. While we take appropriate measures to protect data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, you may request to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data, subject to legal and contractual retention requirements.
• Withdraw consent or object to certain processing, where applicable.

To exercise these rights, contact us using the details in Section 13. We may verify your identity before acting on a request.

• Affiliates act as independent data collectors and are solely responsible for obtaining valid, informed end-user consent before collecting and submitting any Lead to the Platform.
• Affiliates must maintain a compliant privacy notice on their landing pages, accurately describe how data will be used, and honour user choices.
• Affiliates must not submit data obtained unlawfully, without consent, through deception, or in breach of any anti-spam or data-protection law.
• Affiliates indemnify Herbax against any claim arising from their unlawful or non-consensual collection or handling of end-user data.

The Platform integrates with third-party services such as advertising platforms (Meta, Google), communication and messaging providers, payment processors, logistics/courier partners, and analytics tools. Their use of data is governed by their own privacy policies, and we are not responsible for their practices. We share only the data necessary for the relevant integration.

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children. If we learn that we have collected data from a minor without appropriate consent, we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be notified via the dashboard or email and take effect on posting (or on the stated effective date). Your continued use of the Platform after an update constitutes acceptance of the revised Policy.

For privacy questions or to exercise your rights, contact:

• Herbax Ayurveda Science Pvt Ltd
• Email: support@herbax.in
• Grievance/Privacy: privacy@herbax.in