Privacy Policy

• Service Delivery: To provide, maintain, and improve the daWorld.net platform, including design editing, app building, automation workflows, and collaboration features.
• Account Management: To create and manage your account, authenticate your identity, and process account-related requests.
• Social Media Automation: To execute authorized automation workflows such as comment-triggered DM funnels, scheduled posts, and engagement monitoring on connected social media platforms.
• Payment Processing: To process payments, manage subscriptions, issue invoices, handle refunds, and prevent fraudulent transactions.
• Communication: To send transactional emails, service notifications, security alerts, and — with your consent — marketing communications.
• Analytics & Improvement: To analyze usage patterns, diagnose technical issues, and improve user experience.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.
• Security: To detect, prevent, and address fraud, abuse, security vulnerabilities, and technical problems.

daWorld.net enables organizations to connect their social media accounts for automation workflows. We take the responsible handling of this data extremely seriously.

We use trusted third-party payment processors to handle all financial transactions. We do not store credit card numbers, CVVs, or raw banking credentials on our servers.

We do not sell your personal information. We share data only in the following circumstances:

• Service Providers: Hosting (Vercel, Supabase), email delivery (Resend), payment processing (Stripe, Razorpay), and analytics services that process data on our behalf under strict contractual obligations.
• Organization Members: Content created within an organization is accessible to authorized members of that organization.
• Legal Requirements: When required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of daWorld.net, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate notice to affected users.
• Consent: When you have given explicit consent to share specific data.

• Account Data: Retained for as long as your account is active. Upon account deletion, personal data is purged within 30 days, except where retention is required by law.
• Content Data: Designs, documents, and other content are retained until you or your organization administrator deletes them.
• Social Media Tokens: Deleted immediately when you disconnect a social media account. Expired tokens are purged within 24 hours.
• Payment Records: Transaction records are retained for 7 years to comply with tax and accounting regulations (as required by Indian tax law and international financial reporting standards).
• Server Logs: Retained for 90 days for security and debugging purposes, then automatically purged.
• Backup Data: Encrypted database backups are retained for 30 days and then automatically deleted.

We employ industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3.
• Encryption at Rest: All database data is encrypted at rest using AES-256. OAuth tokens are additionally encrypted using Supabase Vault.
• Access Control: Row-Level Security (RLS) policies enforce multi-tenant data isolation at the database level. No organization can access another organization's data.
• Authentication: Secure session management using HTTP-only, SameSite cookies. No tokens stored in localStorage.
• API Security: Rate limiting (Upstash) on all sensitive endpoints. CSRF protection on all state-changing operations.
• Infrastructure: Hosted on Vercel (Edge Network) and Supabase (AWS infrastructure) with SOC 2 compliance.
• Vulnerability Management: Regular dependency audits, automated security scanning, and responsible disclosure program.

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at dpo@daworld.net. We will respond within 30 days (or sooner as required by applicable law).

• Our primary infrastructure is hosted in the Asia Pacific (Mumbai) region (AWS ap-south-1) via Supabase.
• Content delivery is accelerated via Vercel's global Edge Network.
• If your data is transferred outside your country of residence, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or equivalent mechanisms.
• Payment data processed by Stripe may be stored in the United States. Stripe is certified under the EU-US Data Privacy Framework.

The Service is not intended for individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@daworld.net.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy.
• Notify you via email or an in-app notification at least 14 days before the changes take effect.
• For significant changes, we may require you to re-acknowledge the updated policy.

We are committed to meeting the highest standards of data protection and privacy compliance:

You may request deletion of your data at any time. The following actions are available:

• Disconnect Social Accounts: Navigate to HQ > Integrations and click “Disconnect” on any connected platform. OAuth tokens are immediately and permanently deleted.
• Delete Account: Contact support@daworld.net to request full account deletion. All personal data will be purged within 30 days.
• Delete Organization: Organization administrators can delete their organization from HQ > Settings. All associated data (designs, members, channels, tokens) will be permanently deleted.
• Export Data: You can export your designs, documents, and data in standard formats (PDF, CSV, XLSX) before deletion.