Privacy Policy

1. Who we are

DigiMarketingOS provides a unified digital marketing platform for businesses and agencies. For account data you provide to us, DigiMarketingOS acts as the data controller. For marketing data you import or connect into your workspace — contacts, leads, campaign performance — we act as a data processor on your instructions.

2. Data we collect

We collect only what the product needs to function:

• Account data: name, work email address, hashed password credentials held by our authentication provider, organisation and workspace details.
• Marketing data you create or connect: campaigns, content, contacts, leads, deals, notes and analytics pulled from channels you explicitly authorise.
• Integration credentials: OAuth access and refresh tokens for connected channels, encrypted at rest and never exposed to browser code.
• Billing data: subscription plan, invoices and payment status. Card details are handled entirely by our payment processor and never reach our servers.
• Operational data: audit logs, security events, error reports and aggregate usage counters needed to run the service securely.

3. How we use data

We use personal data to provide and secure the service, authenticate users, enforce plan limits, send transactional email such as verification and password resets, provide support, detect abuse, and meet legal obligations. We do not sell personal data and we do not use your marketing data to train third-party models.

4. Legal bases

Where data protection law requires a legal basis, we rely on performance of our contract with you (providing the platform), our legitimate interests (security, abuse prevention, product reliability), consent (optional marketing communications and non-essential cookies), and compliance with legal obligations.

5. Sub-processors

We use a small set of vetted providers: a cloud database and authentication provider for storage and identity, a transactional email provider for platform email, a payment processor for subscriptions, and the marketing channel APIs you choose to connect. Each processes data only as needed to deliver its part of the service.

6. Retention

Account and workspace data is retained while your account is active. After deletion, production data is removed from live systems and purged from encrypted backups within 30 days, except records we must keep for tax, accounting or security-log obligations.

7. Security

Data is encrypted in transit over HTTPS and at rest. Tenant data is isolated at the database level with row-level security so one organisation cannot read another's records. Integration tokens are encrypted with authenticated encryption and are only decryptable by backend code. Privileged administrative actions are recorded in an append-only audit log.

8. Your rights

Depending on your jurisdiction you may request access, correction, deletion, portability or restriction of your personal data, and you may object to processing based on legitimate interests. Email privacy@digimarketingos.com and we will respond within 30 days. You can also delete your workspace from account settings at any time.

9. International transfers

Our infrastructure and sub-processors may process data outside your country. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.

10. Children

The platform is a business tool and is not directed to anyone under 18. We do not knowingly collect data from children.

11. Changes and contact

We will notify account owners by email before any material change to this policy takes effect. Questions: privacy@digimarketingos.com.