Privacy Policy
How DP Social collects, uses and protects your information.
Who we are
DP Social is a social media scheduling and publishing service operated by Digital Paradise Ltd. ("we", "us"), Toronto, Ontario, Canada. This policy explains what information we collect when you use DP Social at dpsocial.ca and how we use it.
Information we collect
- Account information: your name, email address and password (stored securely as a hash by our authentication provider).
- Connected social accounts: when you connect Facebook, Instagram or other platforms, we receive the account or Page ID, name and profile picture, and an access token that lets DP Social publish on your behalf.
- Content you create: captions, titles, scheduled times, and images or videos you upload for publishing.
- Publishing records: whether a post was published, links to the live post, and any error messages.
- Billing information: if you subscribe, payments are processed by Stripe. We receive your subscription status, not your full card details.
How we use information
- To publish the posts you schedule to the accounts you connect, at the times you choose.
- To show you your calendar, post history and live post links.
- To manage your account, team access and subscription.
- To keep the service secure and fix problems.
We do not sell your information, and we do not use data received from Meta, Google or other platforms for advertising, profiling, or any purpose other than providing the features you use in DP Social.
Media files
Google and YouTube data
When you connect a YouTube channel, DP Social requests the youtube.force-ssl permission and uses it only to:
- read your channel's name and picture so you can see which channel is connected;
- upload the videos you schedule in DP Social to your channel; and
- delete a video from your channel only when you choose "Delete from social media" for that post in DP Social.
We do not read, edit or delete any other videos, comments, ratings, captions, playlists or subscriptions, and we do not use YouTube data for advertising or profiling.
Payments
Payments are processed by Stripe. We never see or store your full card number; we keep only your Stripe customer and subscription IDs, plan, billing period and payment status.
How we protect your data
- Encryption in transit: all traffic to DP Social and between DP Social and Google, Meta, TikTok, LinkedIn and Telegram uses HTTPS (TLS).
- Encryption at rest: our database and file storage (Supabase, Canada) are encrypted at rest using AES-256.
- Access tokens: OAuth tokens for connected accounts are stored in a restricted server-side table that cannot be read from the browser or by other users. Only our publishing service uses them, and only to perform the actions described above.
- Account isolation: database access rules ensure each client workspace can only see its own accounts, posts and team.
- Least privilege: we request only the permissions each feature needs, and staff access to production systems is limited to the account owner.
- Data minimization: media files are deleted right after publishing, and tokens are deleted when an account is disconnected or a client is removed.
- Incidents: if we become aware of a security incident affecting your data, we will notify affected users without undue delay.
Where data is stored
DP Social data is stored with Supabase in Canada (ca-central-1). Our website is hosted by Hostinger. Access tokens for connected accounts are stored in a protected table that cannot be read from the browser.
Sharing
We share information only with the service providers needed to run DP Social (Supabase for data and authentication, Hostinger for hosting, Stripe for payments) and with the social platforms you choose to publish to. We may disclose information if required by law.
Retention and deletion
We keep your account information while your account is active. Disconnecting a social account deletes its stored access token. You can ask us to delete your account and all related data at any time; see our Data deletion page.
Your rights
Under Canadian privacy law (PIPEDA) and other applicable laws, you can ask to access, correct or delete your personal information. Contact us at support@digitalparadise.ca.
Changes
We may update this policy. The date at the top shows when it last changed. Significant changes will be announced in the app.
Privacy Officer, requests and complaints
Our Privacy Officer is Leon Emmanuel, Digital Paradise Ltd., Toronto, Ontario, Canada · support@digitalparadise.ca.
To see, correct or delete your personal information, withdraw consent or make a complaint, email the Privacy Officer with the subject “Privacy request”. We reply within 30 days. If you’re not satisfied, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Service providers and where your information is processed
- Supabase (database, sign-in and file storage): account details, workspaces, scheduled posts, media you upload and connection tokens. Hosted in Canada (Central).
- Hostinger (website hosting): technical request data such as IP address when you visit our pages. Servers may be outside Canada.
- Stripe (payments): name, email, billing address and card details. We never see or store your full card number. Processed in Canada and the United States.
- Resend (email delivery): your email address and the content of account emails. Processed in the European Union and the United States.
- Social networks you connect (for example Facebook, Instagram, YouTube, Pinterest, Threads, Bluesky, Mastodon, Telegram, Viber, Google Business Profile): the posts, captions and media you choose to publish, sent to that network under its own privacy policy.
- Google (optional sign-in): only if you choose “Continue with Google”.
When information is processed outside Canada it may be accessible to courts and authorities there. Each provider is bound by contract to protect it and use it only to provide its service to us.
Retention and security
We keep account information while your account is open. Published media is removed from our storage after it is posted; drafts and scheduled posts stay until you delete them. Billing records are kept for 7 years as required for tax purposes. When you delete your account, your workspaces, posts and connection tokens are deleted. Access to personal information is limited to people who need it, and connection tokens are stored on our servers only.
We keep a register of privacy incidents for at least 24 months. If a breach creates a real risk of significant harm, we notify affected people and the Office of the Privacy Commissioner of Canada as the law requires.
Emails from us
We send account emails you need (for example post failures, trial reminders, invoices and your subscription agreement). We only send promotional emails if you opt in, and every promotional email includes our contact information and an unsubscribe link that takes effect within 10 business days, as required by Canada’s anti-spam law (CASL).
Version 2026-10-27.