Privacy Policy
Premkumar Ragav — Senior Performance Marketing Specialist
Last updated: 2 November 2026 · Effective: 2 November 2026
The short version. If you message me on Instagram or Facebook, or comment on my posts, I use an AI assistant to reply and to note down what you need. I collect your name, email, phone number and business details only if you choose to give them, and only to answer your enquiry. I don't sell your data or add you to marketing lists. Reply STOP in any conversation to end all automated messages, or email me to have your data deleted.
1. Who I am
I am Premkumar Ragav, an independent senior performance markerting consultant operating as a sole proprietor from Tamil Nadu, India. I am the data controller (and, under India's Digital Personal Data Protection Act, 2023, the Data Fiduciary) responsible for the personal data described in this policy.
| Contact | Detail |
|---|---|
| Name | Premkumar Ragav |
| Trading as | Premkumar Ragav |
| premkumarragav@gmail.com | |
| Website | https://premkumarragav.in |
| @premkumarragav | |
| Facebook Page | https://www.facebook.com/profile.php?id=61580841087422 |
| Grievance Officer | Premkumar Ragav — premkumarragav@gmail.com |
2. What this policy covers
This policy applies to personal data I collect when you:
- send a direct message to my Instagram professional account or Facebook Page;
- comment on, react to, or reply to a story on my Instagram or Facebook content;
- submit an enquiry or booking form on my website;
- email, call or message me about my services;
- become a client and share information necessary to deliver the work.
It does not cover Instagram, Facebook, or any other third-party platform itself. Your use of those platforms is governed by their own privacy policies. It also does not cover personal data belonging to my clients' customers that I may process while delivering advertising services — that data is handled under a separate agreement with the client concerned, who remains its controller.
3. Data I collect
3.1 Data you give me directly
When you message me, my assistant may ask for the following. All of it is optional — you decide what to share, and you can decline any question and still get a reply.
- Your name
- Email address
- Phone or WhatsApp number
- Business name, website, and what your business sells
- What you want help with, and what marketing you're currently running
- Approximate marketing budget and timeline
3.2 Data I receive automatically from Meta
When you interact with my Instagram account or Facebook Page, Meta's platform sends me:
- Your platform-scoped user ID (a code that identifies you to my account only)
- Your public username or display name
- The content of the messages and comments you send me
- Timestamps of those interactions
3.3 What I do not collect
- Payment card, bank, or UPI details through direct messages — I will never ask for these in a DM, and you should treat any such request as fraudulent
- Government identifiers such as Aadhaar or PAN, unless separately required for a signed client contract or invoicing
- Sensitive categories of data — health, biometrics, religion, caste, sexual orientation, political affiliation, trade union membership
- Your Instagram or Facebook password, or access to your private account activity
- Your contact list or friends list
If you volunteer sensitive information in a message, I will not record it in my records and will ask you not to send it again.
4. Why I collect it
| Purpose | Data used |
|---|---|
| Reply to your enquiry and answer your questions | Message content, user ID, name |
| Understand what service you need and whether I can help | Business details, need, budget, timeline |
| Follow up on a conversation you started | Name, email, phone, user ID |
| Schedule and prepare for a call | Name, email, phone, business details |
| Honour your opt-out so I don't message you again | User ID and opt-out flag only |
| Reply to and moderate comments on my own posts | Comment content, username |
| Keep records of enquiries and improve how I answer them | Anonymised or aggregated conversation themes |
| Meet legal, tax and accounting obligations | Client billing details only |
I do not: sell, rent or trade your personal data; add you to a marketing mailing list without your explicit separate consent; use your data to build advertising audiences; send you unsolicited messages; or share your details with other businesses for their own marketing.
5. Legal basis for processing
Where India's Digital Personal Data Protection Act, 2023 applies, I process your data on the basis of the consent you give by voluntarily starting a conversation with me and choosing to share details, having been given this notice.
Where the EU or UK GDPR applies, my legal bases are:
- Consent (Article 6(1)(a)) — for collecting your contact details and for any automated follow-up message.
- Legitimate interests (Article 6(1)(f)) — for replying to an enquiry you initiated, and for basic record-keeping of business enquiries. I have balanced this against your interests and consider a prompt reply to your own message to be what you would reasonably expect.
- Contract (Article 6(1)(b)) — once you become a client.
- Legal obligation (Article 6(1)(c)) — for tax and accounting records.
You can withdraw consent at any time. Withdrawal does not affect processing that already lawfully took place, and I will retain the minimum record needed to respect your withdrawal.
6. Automated processing and AI
Please read this section. Conversations on my Instagram and Facebook accounts are handled in part by an AI assistant, not by me personally, particularly outside working hours.
Specifically:
- The assistant reads your message and generates a reply.
- It identifies details you have shared — name, business, email, phone, budget — and records them so I do not ask you the same thing twice.
- It classifies comments on my posts so I can prioritise which to answer.
- It escalates the conversation to me when you ask for a human, raise a complaint, discuss pricing or terms, or when it is not confident.
Message text is sent to a third-party AI provider (see section 7) purely to generate the reply. It is not used to train that provider's public models under the API terms I operate under.
You always have a right to a human. Ask to speak to a person at any point and the automation stops for your conversation — permanently — and I take over personally.
No decision is made about you by automated means alone that has a legal or similarly significant effect. The assistant gathers information and drafts replies; whether I take you on as a client is always my own decision.
7. Who I share data with
I use a small number of service providers (processors) to run my business. Each receives only the data necessary for its function.
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms | Delivers the Instagram and Facebook messages and comments themselves | USA / global |
| Google — Sheets & Drive | Stores my enquiry records | USA / global |
| Google — Gemini API | Generates AI replies and classifies comments | USA / global |
| n8n (self-hosted) | Automation connecting the above. Runs on infrastructure I control. | India (self-hosted) |
| Telegram | Sends me internal alerts about enquiries needing my attention | Global |
| Gmail | Email correspondence | Global |
| Accountant / tax advisor | Statutory accounts and client invoices only | India |
I may also disclose data where I am legally required to — for example in response to a valid order from a court, tax authority, or law enforcement — or where necessary to establish or defend a legal claim.
If I ever transfer my business, enquiry records may transfer with it. You would be told before that happened and given the chance to have your data deleted first.
8. Where data is stored
Enquiry records are held in a private Google Workspace account protected by a strong unique password and two-factor authentication. Automation runs on my own self-hosted n8n instance over an encrypted HTTPS connection. Message content in transit is encrypted. Access credentials are stored in a password manager and in n8n's encrypted credential store, never in plain text.
Only I have access to the enquiry records. I have no employees. If I engage a contractor who needs access, they will be bound by a written confidentiality agreement.
9. How long I keep it
| Record | Retention |
|---|---|
| Enquiry that did not become a client | 24 months from last contact, then deleted |
| Conversation message logs | 12 months, then deleted |
| AI conversation memory | Rolling — only the most recent messages in a conversation are retained |
| Client records and contracts | Duration of engagement, then as required by Indian tax law |
| Invoices and financial records | 8 years, as required by Indian law |
| Opt-out record | Indefinitely — the minimum needed to keep honouring your opt-out |
The opt-out record is deliberately kept after everything else is deleted. It contains only your platform user ID and a flag. Without it I could not reliably guarantee I would never message you again.
10. Your rights
Whatever jurisdiction you are in, you can ask me to:
- Access — tell you what personal data I hold about you, and provide a copy
- Correct — fix anything inaccurate or incomplete
- Delete — erase your data (see the next section)
- Withdraw consent — at any time, as easily as you gave it
- Object or restrict — object to processing based on legitimate interests, or ask me to pause processing while a dispute is resolved
- Portability — receive your data in a machine-readable format
- Nominate — under the DPDP Act, nominate another person to exercise your rights if you die or become incapacitated
- Complain — raise a grievance with me, and escalate to a regulator if unsatisfied
There is no charge, and I will respond within 30 days. I may need to verify you control the account making the request — usually by asking you to send it from the same Instagram or Facebook account, or the email address on file.
11. Requesting Data Deletion
You may ask me to delete all personal data I hold about you at any time, for any reason, without explanation.
Choose whichever is easiest:
- Message me on the Instagram or Facebook account you used, with the word
DELETE. SendingSTOPwill also stop all automated messages immediately. - Email premkumarragav@gmail.com with the subject line
Data deletion request. Include the Instagram handle, Facebook name, or email address you used so I can find your record.
What happens next:
- I acknowledge your request within 3 working days.
- I delete your record — name, email, phone, business details, notes and conversation logs — within 30 days, and confirm in writing when it is done.
- I instruct my processors to delete any copies they hold.
What I may have to keep, and why:
- Your platform user ID plus an opt-out flag, so I can continue to honour your request not to be contacted. Nothing else.
- Invoices and financial records if you were a paying client, for as long as Indian tax law requires.
- Anything I am required to preserve for an active legal claim.
Messages held inside Instagram or Facebook themselves are controlled by Meta, not me. To remove those, delete the conversation in the app and use Meta's own tools at accountscenter.instagram.com.
12. Stopping automated messages
Reply with any of STOP, UNSUBSCRIBE, or OPT OUT in a conversation with me on Instagram or Facebook. All automated messaging to you ends immediately and permanently. You will get one confirmation message and then nothing further.
Opting out does not delete your data — those are separate requests. Ask for both if you want both. And opting out does not stop you reaching me: if you message again, a human will reply.
13. Security
I take reasonable technical and organisational measures appropriate to a sole-proprietor business:
- HTTPS/TLS encryption for all data in transit
- Two-factor authentication on every account holding personal data
- Unique passwords held in a password manager
- Access tokens and API keys in encrypted credential storage, never in plain text or shared
- Access limited to me alone
- Data minimisation — I collect the least I need and delete on schedule
No system is completely secure. If a breach occurs that is likely to affect you, I will notify you and the relevant authority without undue delay — and, where the DPDP Rules apply, provide the Data Protection Board an initial report promptly and a detailed report within 72 hours.
14. Children
My services are for businesses and are not directed at anyone under 18. I do not knowingly collect data from children. If you believe a child has sent me personal data, email me and I will delete it promptly.
15. International transfers
Some providers in section 7 process data outside India, principally in the United States. Where the GDPR applies, such transfers rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision, as set out in each provider's own terms. Where the DPDP Act applies, transfers are made to countries not restricted by the Central Government.
16. Cookies
This page sets no cookies and runs no analytics or tracking scripts.
17. Changes to this policy
I may update this policy as my tools or the law change. The "Last updated" date at the top always reflects the current version. If a change materially affects how I handle your data, I will take reasonable steps to tell you — for example by message if we have an open conversation. Continuing to message me after a change means you accept the updated policy.
18. Contact and grievances
For any question or request about your data, or to raise a complaint:
| premkumarragav@gmail.com | |
| Subject line to use | Privacy request or Data deletion request |
| Response time | Acknowledged within 3 working days; resolved within 30 days |
| Grievance Officer | Premkumar Ragav, Tamil Nadu, India |
If you are not satisfied with my response, you may escalate to:
- India — the Data Protection Board of India, under the Digital Personal Data Protection Act, 2023
- EU — your national data protection authority
- UK — the Information Commissioner's Office (ico.org.uk)
I would rather you came to me first. Most concerns I can fix the same day.