Privacy policy
Effective 23 October 2026
Datatrop Socials (“the app”) is an internal tool operated by Datatrop (“we”, “us”) for managing Datatrop’s own social media accounts. Only people invited by our team can sign in. This policy explains what information the app handles, why, and the choices you have.
Information we handle
About team members who sign in
- Name, email address and team role.
- Password (stored only as a one-way hash) and two-factor authentication secret (stored encrypted).
- Session records, including IP address and browser type, to keep you signed in and to detect misuse.
- An audit log of actions taken in the app (for example replying to or deleting a comment, publishing a post, changing a role), with the time and IP address.
From connected social media accounts
When a team member connects one of Datatrop’s accounts on Instagram, Facebook, Threads, YouTube, X or LinkedIn, the platform gives the app an access token and, depending on what that platform allows, the app retrieves:
- the account’s profile (name, username, profile picture) and its posts or videos;
- comments on those posts, including the commenter’s public name, username and profile picture;
- direct messages sent to the account (Instagram and Facebook only), including the sender’s name and profile picture;
- performance statistics (insights) such as reach, views and follower counts.
We also store images that team members upload to attach to posts.
How we use it
Only to provide the app’s features to Datatrop’s team: showing comments and messages in one place, replying to and moderating them, publishing and scheduling posts, and showing analytics. We do not sell information, use it for advertising, share it with data brokers, or use it to train artificial-intelligence models.
Cookies
The app uses only essential cookies: one to keep you signed in, and a short-lived one that secures the process of connecting a social media account. There are no analytics, advertising or tracking cookies.
Who processes it for us
We use the following service providers to run the app. They process data only on our instructions.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Hosting the app | Mumbai, India |
| Supabase | Database | Mumbai, India |
| Cloudflare | Image storage, encrypted backups, scheduling | Asia-Pacific |
| GitHub | Running the nightly backup job (backups are encrypted first) | Global |
Information is also exchanged with each social media platform you connect, as needed to provide the features above, under that platform’s own terms and privacy policy.
YouTube and Google
The app uses YouTube API Services. When a YouTube channel is connected, the app accesses the channel’s videos, comments and analytics, and can upload videos and reply to or moderate comments, as described above. By using these features you also agree to the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy.
You can revoke the app’s access to your Google account at any time from your Google security settings.
Datatrop Socials’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we protect it
- All connections are encrypted (HTTPS/TLS).
- Social media access tokens are encrypted (AES-256-GCM) and never sent to the browser.
- Two-factor authentication is mandatory, and every action is checked against the person’s role.
- Uploaded images are private and served only through links that expire.
- Database backups are encrypted with a key held only by Datatrop.
How long we keep it
- Data from a connected social media account is kept while the account stays connected. Disconnecting an account deletes it and everything retrieved from it.
- Team member records and the audit log are kept while the person is part of the team, and for as long as needed for security and record-keeping.
- Encrypted backups are deleted automatically after 30 days.
Your choices and rights
- Disconnect a social media account in the app (Accounts page) to delete its data.
- Revoke access from the platform itself, for example in your Facebook, Instagram, Google or LinkedIn security settings.
- Request deletion of data about you: see Data deletion.
- Ask to access, correct or erase your personal data, or raise a grievance, by emailing sales@datatrop.in. We respond within 30 days.
We process personal data in line with applicable law, including India’s Digital Personal Data Protection Act, 2023.
Children
The app is for Datatrop’s team members only and is not intended for anyone under 18.
Changes
If this policy changes, we will update it here and change the effective date above.
Contact
Datatrop, India · datatrop.in · sales@datatrop.in