Privacy Notice

Effective October 22, 2026. Version 2026-10-22.3. This notice describes data handled by DigiMarketing.

Data collected

We store your email address, a salted password hash, session credentials, campaign briefs, post text, chosen channels, schedule times and delivery results. We also record the Terms version accepted, Privacy Notice version acknowledged, acceptance time, campaign delivery attempts and worker run summaries. Batch records support pacing, troubleshooting and duplicate prevention. We do not collect your social-account password through this application. Your browser stores an essential sign-in cookie. Temporary sign-in attempt records and hosting access logs may include network addresses. An administrator can enter provider keys and social posting tokens through the protected API settings screen. Credentials entered there are encrypted in the application database with a separately stored server encryption key. Existing operator-managed environment files and social account files can also supply credentials. Saved secret values are not returned to browsers.

How data is used and shared

Data is used for authentication, campaign management, drafting, scheduling, delivery and troubleshooting. If you request AI drafting, your brief and selected channels are sent to OpenAI. If you approve publication, post content and authentication details are sent to the configured provider. Their privacy terms also apply. We request that AI responses are not stored through the API; provider operational retention may still apply. Do not submit sensitive personal information in campaign briefs.

Integration administration

Administrators can enable or disable AI drafting, choose its model, manage per-user Mastodon connections, and test the saved AI connection. Integration audit records contain action names, times and numeric actor or target IDs, without submitted passwords, keys or campaign text. These records remain until the operator removes them. A key fingerprint can identify the configured AI key without revealing it. Removing a local credential does not revoke it at its provider or remove encrypted copies from existing backups.

Automation and campaign approval

The scheduler decides when an approved post is eligible to send using your schedule, account limits and provider responses. It does not decide which people should receive unsolicited messages. Aggregate batch logs contain start/end times and processed counts; delivery records include provider receipt identifiers or failure summaries. Ansible logs report run counts without campaign text or tokens.

Marketplace and payments

We store selected products, price and currency snapshots, order references, payment-provider identifiers, payment and fulfillment status, purchase briefs and digital-product entitlements. Payment credentials entered by an administrator are encrypted using the same protected server key as other GUI-managed provider secrets. Card numbers, security codes and PayPal passwords are entered at the payment provider, not stored by DigiMarketing. Checkout can send your account email and order details to Stripe; PayPal receives order and amount details. Provider privacy notices apply to their processing.

Account deletion detaches its active order records from the user ID and clears the submitted purchase brief. Order and payment records may remain for accounting, support, disputes or other operator requirements; the operator sets the applicable retention period. Published posts, provider-held payment records and existing backups are not erased by local account deletion.

Retention and deletion

Campaign data remains until you delete it or close your account. Sessions expire after one day. Delivery-attempt timestamps are retained for the rolling 24-hour rate-limit window and pruned on worker runs; account deletion removes that user’s active attempt, AI-usage and acceptance records. Deleting an individual campaign detaches its attempt records so recent activity can still enforce account limits. A numeric allocation sequence prevents deleted account IDs being reassigned to another user; it contains no email or campaign text. Aggregate worker-run records contain no email address or campaign text and remain until the operator removes them. Use account deletion to remove your account, campaigns and delivery records from the active database. Backups and hosting logs may persist under the operator’s configured retention schedule. Deleting local data does not remove content already published to external platforms. Account deletion removes GUI-managed social tokens from the active database. Ask the operator to remove any root-managed account-file entries and revoke tokens with their provider.

Security and choices

The application uses password hashing, session controls and HTTPS when deployed through the supplied configuration. No system is completely secure. You can export campaign text, delete drafts, sign out and delete your account. No optional analytics or advertising cookies are included in this version. Contact the operator through the hosting provider’s published support channel for access or correction requests. Applicable privacy rights depend on your location.

Changes to this notice

The effective date and version identify this notice. Material changes should be presented by the operator before changed processing begins. No claim is made that all existing users have accepted this version.