Privacy Policy

This Privacy Policy ("Policy") describes how DataSpeaks Services Private Limited ("DataSpeaks," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with DataSpeaks Social Management(the "Application" or "Service") — a social media management tool that helps businesses schedule, publish, and analyze content across connected social networks, including LinkedIn — as well as our website at dataspeaks.co and related services.

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

DataSpeaks Services Private Limited is the data controller responsible for your personal data under this Policy. We are an ISO/IEC 27001:2022 and ISO 9001:2015 certified technology company headquartered in Hyderabad, Telangana, India, serving clients worldwide.

For any privacy-related questions or requests, you can reach our privacy team at privacy@dataspeaks.co.

We collect the following categories of information:

a. Information you provide to us

• Account information — such as your name, email address, password (stored in hashed form), company name, and profile preferences when you register.
• Content you create — posts, captions, images, videos, comments, schedules, and other material you upload, draft, or publish through the Service.
• Support and communications — messages you send to us, including support requests and feedback.
• Billing information — where applicable, billing details processed through our third-party payment providers (we do not store full payment card numbers on our servers).

b. Information from connected social accounts

When you connect a social media account (for example, LinkedIn) via secure OAuth authorization, we receive information from that platform as described in Section 4.

c. Information collected automatically

• Usage data — pages viewed, features used, actions taken, and timestamps.
• Device and log data — IP address, browser type, operating system, device identifiers, and referring URLs.
• Cookies and similar technologies — as described in Section 12.

Our Application integrates with LinkedIn through LinkedIn's official APIs. When you authorize the connection, LinkedIn asks you to grant specific permissions (scopes). We access only the data necessary to provide the features you request, which may include:

• Basic profile information — such as your name, profile picture, headline, and LinkedIn member/organization identifier.
• Managed page/organization data — the LinkedIn Pages or organizations you administer and are authorized to manage.
• Content and publishing access — the ability to draft, schedule, and publish posts on your behalf to the accounts and Pages you have connected.
• Engagement and analytics — aggregate metrics such as impressions, reactions, comments, shares, and follower statistics for content you manage, used to display analytics within the Service.
• Access tokens — OAuth access and refresh tokens that allow the Service to act on your behalf. Tokens are stored encrypted and are never exposed to other users.

The same principles apply to any other social platform you connect: we access only what is needed, use it solely to deliver the Service, and honor each platform's developer terms.

We use the information we collect to:

• Provide, operate, and maintain the Service and its features.
• Authenticate you and connect your authorized social media accounts.
• Schedule and publish the content you create to your connected accounts.
• Generate analytics and reports on the performance of your content.
• Respond to your requests, provide customer support, and send service-related communications.
• Monitor, troubleshoot, secure, and improve the Service, including detecting and preventing fraud and abuse.
• Comply with legal obligations and enforce our terms.

We do not use your content or connected-account data to train third-party advertising models, and we do not sell your personal information.

Where the General Data Protection Regulation (GDPR) or similar laws apply, we rely on the following legal bases:

• Contract — to provide the Service you have signed up for.
• Consent — when you connect a social account or opt into certain features or communications. You may withdraw consent at any time.
• Legitimate interests — to secure, maintain, and improve the Service, provided these interests are not overridden by your rights.
• Legal obligation — to comply with applicable laws and regulations.

We do not sell your personal data. We share information only in these limited circumstances:

• Social platforms — content and requests you direct us to publish are shared with the connected platform (e.g., LinkedIn) to carry out that action.
• Service providers — trusted vendors who process data on our behalf under contract (e.g., cloud hosting, email delivery, analytics), bound by confidentiality and data-protection obligations.
• Legal and safety — when required by law, legal process, or to protect the rights, property, or safety of DataSpeaks, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We retain personal data only as long as necessary to provide the Service and for legitimate, legal, or accounting purposes. When you disconnect a social account, we delete or revoke the associated access tokens. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where retention is required by law or for legitimate business records.

You may request deletion of your data at any time by contacting privacy@dataspeaks.co.

We maintain an information security program aligned with our ISO/IEC 27001:2022 certification. Safeguards include:

• Encryption of data in transit (TLS) and at rest.
• Encrypted storage of OAuth access and refresh tokens and other secrets.
• Role-based access controls and the principle of least privilege.
• Regular security reviews, monitoring, and vulnerability management.

No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.

Depending on your location, you may have the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion— request that we delete your data ("right to be forgotten").
• Restriction & objection — restrict or object to certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent — where processing is based on consent.

Under the California Consumer Privacy Act (CCPA/CPRA), California residents also have the right to know, delete, and opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information as those terms are defined. To exercise any right, email privacy@dataspeaks.co. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your rights.

DataSpeaks operates globally, and your information may be processed in countries other than your own, including India. Where we transfer personal data across borders, we implement appropriate safeguards — such as standard contractual clauses and equivalent measures — to ensure your data receives an adequate level of protection consistent with applicable law.

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. We may use analytics tools (such as Google Analytics) that set cookies to help us measure and improve performance. You can control cookies through your browser settings; disabling some cookies may affect the functionality of the Service.

The Service integrates with and relies on third-party platforms and providers, including LinkedIn and cloud infrastructure providers. Your use of a connected platform is also governed by that platform's own privacy policy and terms. We encourage you to review them:

• LinkedIn Privacy Policy

We are not responsible for the privacy practices of third-party platforms that we do not control.

The Service is intended for business users and is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will take steps to delete it.

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the Service or by email. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

If you have questions, concerns, or requests regarding this Policy or your personal data, please contact us: