Privacy Policy

DadyPost is operated by Vectrix Lab ("we", "us", "our"). DadyPost provides a workspace for planning, creating, scheduling and publishing content to social media platforms, managing social inboxes, and connecting online stores. This Privacy Policy applies to the DadyPost website, web application and related services (together, the "Service").

By creating an account or using the Service you agree to the collection and use of information as described here. If you do not agree, please do not use the Service.

We collect the following categories of information:

• Account information — your name, email address, password (stored hashed), profile picture, workspace name and role.
• Connected platform data — when you connect a social media account (for example X, LinkedIn, Facebook, Instagram, TikTok, YouTube, Pinterest) we receive the OAuth access token, your profile identifier, display name, handle and avatar for that platform, plus the pages, channels or organisations you manage.
• Content you create — posts, drafts, captions, media files, templates, comments and inbox replies you compose in the Service.
• Connected store data — if you connect an e-commerce store, product catalogue information (titles, descriptions, prices, images) needed to generate content.
• Billing information — subscription plan, invoices and transaction history. Card details are entered on and stored by our payment processor, Safepay; we keep only a reference to the saved card (brand, last four digits and expiry), never the full card number.
• Usage and device data — log data such as IP address, browser type, pages visited, actions taken and timestamps, used for security and to improve the Service.

• To operate the Service — publish content to the platforms you choose, at the time you choose, on your behalf.
• To display your connected accounts, inbox conversations and analytics inside your workspace.
• To generate content suggestions and captions using AI features when you request them.
• To process payments, send invoices and manage your subscription.
• To send service notifications such as failed publishes, token expiry or billing events.
• To secure the Service, prevent abuse and comply with legal obligations.

We do not sell your personal information, and we do not use the content of your posts or connected accounts for advertising.

When you connect a platform, you authorise us to access it through that platform's official API on your behalf. We only request the permissions needed for the features you use (for example, permission to publish posts and read your profile). You can revoke this access at any time from the platform's own settings or by disconnecting the channel in the Service.

Access tokens are encrypted at rest using AES-256-GCM and are used solely to perform the actions you initiate. Our use of each platform's data is subject to that platform's developer policies.

DadyPost's use of information received from Google APIs (including YouTube) adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting a YouTube channel you also agree to be bound by the YouTube Terms of Service.

Facebook and Instagram (Meta): when you connect a Facebook Page or Instagram professional account we access, through Meta's official APIs and only with the permissions you grant, the Pages and Instagram accounts you manage and their names and profile pictures. We use this access to publish the posts you schedule, to read comments, Page messages and Instagram direct messages so you can reply from the DadyPost inbox, and to read post and account insights for your analytics. If you connect a Meta ad account we read campaign performance data for reporting. We do not sell Meta data, build advertising profiles from it, or share it with anyone other than you and your workspace members. Our use of this data complies with the Meta Platform Terms.

Some features (such as caption generation, reply suggestions and product-based content ideas) send the text and product information you provide to third-party large-language-model providers to produce a result. We send only what is necessary for the request, and these providers are contractually restricted from using your data to train their models.

We use strictly necessary cookies and local storage to keep you signed in, remember your preferences (such as language and theme) and protect against cross-site request forgery. We do not use third-party advertising cookies.

You can control cookies through your browser settings; disabling essential cookies will prevent you from signing in to the Service.

We share information only with:

• The social platforms and stores you connect — to carry out the actions you request.
• Service providers that host and operate the Service on our behalf (cloud hosting, storage, email delivery, error monitoring, payment processing via Safepay, and AI model providers), bound by confidentiality obligations.
• Members of your workspace, according to the roles and permissions you assign.
• Law enforcement or regulators when required by law, or to protect the rights, safety and property of our users or the public.
• A successor entity in the event of a merger, acquisition or sale of assets, with notice to you.

We keep your account data for as long as your account is active. Platform access and refresh tokens are erased immediately when you disconnect a channel. Published post records and analytics are retained while your workspace exists so that you can review history. Billing records are retained for the period required by tax and accounting law.

You are in control of your data. At any time you can:

• Disconnect a social account from Connect Profiles. This erases the stored access and refresh tokens for that channel straight away.
• Delete individual posts, media or conversations from within the Service.
• Ask us to delete your entire account by emailing [email protected]. All personal data, connected channels and content are permanently removed within 30 days, except records we must retain by law.
• Email [email protected] to request a copy of your data, correct inaccurate data, or ask us to delete data on your behalf. We respond to all requests within 30 days.

Depending on where you live, you may also have the right to object to or restrict certain processing, to data portability, and to lodge a complaint with a supervisory authority.

We protect your information with industry-standard measures including encryption in transit (TLS), encryption of platform tokens at rest, hashed passwords, role-based access control and continuous monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we will notify you of any breach affecting your data as required by law.

Our servers and service providers may be located in countries other than your own. Where we transfer personal data internationally we rely on appropriate safeguards, such as standard contractual clauses, to protect it.

The Service is not directed to children under 16 and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time. When we make material changes we will notify you by email or with a notice inside the Service before the change takes effect. The date at the top of this page shows when it was last revised.

If you have questions about this policy or how we handle your data, email us at [email protected].