Privacy Policy

Last updated: 24 September 2026

1. Who we are

DigiSignWall is a cloud digital signage service operated by Amigo Smart Tech, Plot No 31, Thirumala Hills, Mahadevapuram, Gajularamaram, Hyderabad – 500055, Telangana, India (“we”, “us”). This policy covers our marketing website (digisignwall.com), the admin console at app.digisignwall.com, our web player, and our Android and TV player apps (together, the “Service”).

For the personal data described in section 3, we are the controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023). For personal data inside the content and screens our customers manage, we act as a processor for the customer — see section 4.

Contact. For any privacy question, or to exercise your rights, email emailus@digisignwall.com or write to us at the address above.

Grievance Officer (India). Under the Information Technology Act, 2000, the rules made under it, and the DPDP Act, 2023, you can raise a grievance with our Grievance Officer at emailus@digisignwall.com (subject “Grievance”). We will acknowledge it within 24 hours and aim to resolve it within 15 days.

2. Summary

• We collect what we need to run the Service: account details, the content you upload, information about your screens, billing records and security logs.
• We do not sell personal data, and we do not share it with advertisers.
• Website analytics cookies are set only if you accept them. You can change your choice at any time in cookie settings.
• Card payments are handled by Stripe. We never see or store full card numbers.
• Audience measurement with a camera is off unless a customer turns it on for a screen. Images stay on the device, and we do not use facial recognition (section 3.6).

3. Personal data we collect and why

3.1 Account data

When you sign up or are invited: your name, email address, organisation name, role and permissions, an optional mobile number, and your password (stored only as a salted one-way hash). To confirm your email address we send a one-time code and link. We store them hashed, and they expire after a short period. We use this data to create and secure your account, sign you in, and send you service messages about security, billing and changes to the Service.

3.2 Customer content

Images, videos, playlists, layouts, schedules, widgets and data feeds that you upload or configure. We store, process and deliver them to your screens. Content may include personal data (for example, staff photos on a welcome screen). We handle that as a processor (section 4).

3.3 Screen and player data

For each paired screen we collect a device identifier, pairing code, device and app details, screen name and location (if you enter one), online status and heartbeats, the content currently playing, playback confirmations (“proof of play”), impressions, and diagnostics. We use this data to deliver content, show screen health, report what played, and troubleshoot. Players save the latest schedule and a copy of your media files in the screen device’s local storage, so they keep playing through network outages and after a restart. The cache has a size limit, and older files are removed from it automatically.

3.4 Support, contact and enquiries

When you contact us through the website form, email or a support ticket, we collect your name, email address, organisation, the details of your enquiry, and any attachments or screenshots you send. We use them to answer you and keep a record of the conversation.

3.5 Billing data

Your plan, billing contact, billing address and tax details (where provided), invoices, payment status, and Stripe customer and subscription identifiers. Card details go directly to Stripe and are never stored on our systems.

3.6 Optional audience measurement (Android player app)

Our Android and TV player app can measure audiences with a camera. This feature is off by default. It runs only on screens where the customer has switched it on and fitted a camera, and the app asks for camera permission first. When it is on:

• The app looks at camera frames on the device, about once or twice a second, to detect whether faces are present and turned towards the screen. Where the device supports it, it also estimates a broad age band (for example “25–34”) and gender.
• Camera images and face crops are processed in the device’s memory only. They are not saved to storage and are never sent to us. No microphone is used.
• The player sends us only statistics, with the screen identifier and a timestamp: for each short viewing window, the number of people present, and for each person who looked at the screen, an estimated age band, gender and dwell time. These records contain no image and nothing that identifies the person. A temporary number that stops the device counting the same person twice in a short window stays on the device.
• We do not use facial recognition. We do not identify individuals, create face templates, recognise returning people, or link audience statistics to names, accounts or other identities.

Customers use these statistics for audience analytics and to choose which content to show. The customer who enables the feature decides whether to use it, is the controller of that processing, and is responsible for having a lawful basis, for any required assessment, and for putting up clear notices at the screen. If you have a question about a screen that uses a camera, contact the organisation that operates it. You can also contact us and we will pass your request on.

3.7 AI content assistant

If you use the optional AI assistant, we send your instructions and the material you include (layout data, media references and any screenshots) to third-party AI model providers. We send it only to generate the layout or content you asked for. The providers process it under their own terms. We do not use your AI requests to train models. We keep the resulting layouts in your account like any other content. Please do not include sensitive personal data in AI requests.

3.8 Security and usage logs

IP address, browser and device user agent, timestamps, requests made, sign-in events, and an audit log of administrative actions in your account (for example who changed a schedule or invited a user). We use them to keep the Service secure, prevent abuse and fraud, rate-limit requests, investigate incidents, and give account admins an activity history.

3.9 Maps and location

The admin console uses Google Maps to let you place screens on a map and to set locations for weather widgets. Your browser loads the map directly from Google, so Google receives your IP address and map requests. We fetch weather data from weather-data providers using the screen’s location coordinates. We send them no personal data.

3.10 Website analytics

On this marketing website only, and only if you accept analytics cookies, we use Google Analytics 4. It collects a pseudonymous identifier, pages viewed, referrer, approximate location derived from your IP address, device and browser information, and events such as clicks on “Start free”. We use it in aggregate to understand which pages are useful. The admin console and players do not use Google Analytics. See the Cookie Policy for details.

4. Customer data we process for our customers

Our customers decide what content appears on their screens, who can use their accounts, and whether to enable audience measurement. For personal data within customer content, screen data and audience statistics, the customer is the controller (data fiduciary), and we process that data on the customer’s instructions to provide the Service. If you are a member of the public, or an employee of one of our customers, please direct requests about that data to the organisation concerned. We will help them respond.

Business customers who need a data processing agreement (DPA) can request one at emailus@digisignwall.com.

5. Legal bases for processing

UK GDPR and EU GDPR. We rely on:

• Contract: to create and run your account, deliver content to your screens, process payments and provide support (3.1–3.5, 3.7, 3.9).
• Legitimate interests: to secure the Service, prevent fraud and abuse, keep audit logs, improve reliability, and reply to business enquiries (3.3, 3.4, 3.8). We have balanced these interests against your rights, and you can object (section 9).
• Consent: for analytics cookies on our website (3.10), and for any optional marketing emails. You can withdraw consent at any time.
• Legal obligation: to keep tax and accounting records and to respond to lawful requests.

India (DPDP Act, 2023). We process personal data with your consent, which you give with notice of this policy when you sign up, contact us or accept analytics cookies. We also rely on the legitimate uses the Act permits, including data you give us voluntarily for a specified purpose, compliance with law and court orders, and responding to emergencies. You can withdraw consent at any time. This will not affect processing already carried out, but we may not be able to continue providing the Service.

UAE (Federal Decree-Law No. 45 of 2021, PDPL). We process personal data with consent, or where it is necessary to perform our contract with you, to comply with legal obligations, or as otherwise permitted by the PDPL.

6. Who we share personal data with

We share personal data only with service providers (“sub-processors”) who process it on our instructions under contract, and only as much as they need to do their job:

• Cloud hosting providers: application servers, the MySQL database, Redis cache, media storage and backups.
• Stripe: payment processing, subscriptions and invoicing.
• Google: Google Analytics 4 on the marketing website (only with consent), and Google Maps in the admin console.
• Email delivery provider (SMTP): verification codes, password resets, notifications and service emails.
• SMS gateway provider: text-message notifications, where enabled.
• Third-party AI model providers: only when you use the AI assistant (3.7).
• Weather and data-feed providers: location coordinates only, no personal data (3.9).

You can ask for a current list of named sub-processors at emailus@digisignwall.com. We may also disclose personal data if the law, a court or a government authority requires it, to protect the rights, safety or property of our users or the public, or to a buyer or successor in a merger, acquisition or asset sale. In that case we will tell you before your data becomes subject to a different privacy policy.

7. International transfers

We are based in India, and our providers may process data in other countries. Some personal data may leave the UK, the EEA or the UAE. When it does, we use a recognised safeguard: an adequacy decision where one exists, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another mechanism the PDPL recognises. We do not transfer personal data to any country to which the Government of India has restricted transfers under the DPDP Act. You can ask us for details of these safeguards.

8. How long we keep personal data

• Account data and customer content: while the account is active, then for 30 days after it is closed or terminated so it can be restored or exported, and then deleted.
• Screen, proof-of-play and audience statistics: while the account is active, then deleted with the account (30 days after closure). Customers can delete screens and their data earlier.
• Security, access and audit logs: up to 12 months, unless we need them longer to investigate an incident or meet a legal obligation.
• Backups: on a rolling 14-day cycle, so deleted data disappears from backups within 14 days of being removed from our live systems.
• Billing and tax records: for as long as tax and company law requires (in India, up to 8 years).
• Support tickets and contact enquiries: up to 24 months after the conversation ends, or with the account if that is later.
• Email verification codes: until they are used or expire, whichever comes first.
• Website analytics: Google Analytics keeps event data for up to 14 months.

9. Your rights

Your rights depend on where you live. Subject to legal exceptions, you can:

• UK and EU (GDPR): access your data, correct it, have it erased, restrict or object to processing (including processing based on legitimate interests), receive it in a portable format, and withdraw consent at any time. You can also complain to a supervisory authority: in the UK the Information Commissioner’s Office (ico.org.uk), in the EU your local data protection authority.
• India (DPDP Act): get a summary of your personal data and how it is processed, and of whom it has been shared with; correct, complete, update or erase it; withdraw consent; nominate someone to exercise your rights on your behalf if you die or become incapacitated; and use our grievance process (section 1). If you are not satisfied with our response, you may complain to the Data Protection Board of India.
• UAE (PDPL): get information about processing, access your data, correct or erase it, restrict or stop processing, object to processing, including decisions based solely on automated processing, and have your data transferred. You may complain to the UAE Data Office.

How to exercise your rights. Email emailus@digisignwall.com from the address linked to your account, or tell us how we can verify your identity. You can also correct most account details yourself in the admin console. We will respond within one month, or sooner where local law requires. If a request is complex we may extend this where the law allows, and we will tell you why. We do not charge a fee unless a request is clearly unfounded or excessive. If your request concerns data a customer controls (section 4), we will refer it to that customer.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

10. Security

We protect personal data with measures that include TLS encryption in transit, salted password hashing, role-based access control, separation of each customer’s data, audit logging of administrative actions, restricted and logged access to production systems, and regular backups. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant regulators as the law requires. More detail is on our Security page.

11. Children

The Service is for businesses and organisations and is not directed at children. Account holders must be 18 or older, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it. Screens in public places may be seen by children. Customers who enable audience measurement must take this into account.

12. Cookies and similar technologies

Our website uses Google Analytics cookies only if you accept them, plus a small number of strictly necessary items, such as remembering your cookie choice and protecting the contact form. The admin console and players use browser storage only to keep you signed in and to make the Service work. See our Cookie Policy for the full list and to change your choice.

13. Marketing

We send service messages about your account, security, billing and important changes. You cannot opt out of these while you have an account. If we send product news or marketing emails, we do so only where the law allows, and every such email includes an unsubscribe link.

14. Changes to this policy

We will update this policy when our practices or the law change, and revise the date at the top. If a change materially affects how we use your personal data, we will email account holders before it takes effect and, where the law requires, ask for your consent again.