Privacy Policy

Davdigi Studio · studio.davdigi.com · Last updated 14 August 2026

Davdigi Studio ("the Service") is a social media management tool operated by Davdigi, based in Indonesia. It is provided as a managed service to client organisations, who use it to schedule and publish content to social media accounts they own or are authorised to manage.

1. Information we collect

• Account information — the email address and name of each user who signs in to the Service.
• Social media access tokens — when you connect a social media account, the platform issues an access token. We store it and use it only to perform the actions you request.
• Basic profile information from connected accounts — the display name, username, and profile picture of each account you connect, shown in the interface so you can identify it.
• Content you create — post text, captions, scheduling times, and media files (images and video) that you upload.
• Performance data — engagement and reach metrics retrieved from the connected platforms, for content you published through the Service.
• Technical logs — server logs recording requests and errors, kept for operational troubleshooting.

2. How we use it

Information is used only to operate the Service: authenticating you, publishing and scheduling the content you compose, and displaying performance metrics for that content. We do not use it for advertising, profiling, or automated decision-making, and we do not use it to train machine learning models.

3. Where it is stored

Account data, post content, scheduling records, and access tokens are stored in a private database on a server operated by Davdigi in a Hostinger data centre. Access to that server is restricted to our operations staff using SSH key authentication.

Uploaded media files (images and video) are stored in a private Google Drive account controlled by Davdigi, and are served to the Service and to the social platforms from there. Google acts as a storage provider only and does not receive your account credentials or access tokens.

4. Sharing with third parties

We share data only with the social media platforms you explicitly connect, and only to carry out actions you request, for example sending a post to Instagram when you schedule one. Their handling of that data is governed by their own policies:

• Meta (Facebook, Instagram, Threads) — Meta Privacy Policy
• TikTok — TikTok Privacy Policy
• Google (YouTube, Google Business Profile, Google Drive) — Google Privacy Policy
• LinkedIn — LinkedIn Privacy Policy
• X — X Privacy Policy

If a client enables the optional AI writing features, the caption text or prompt being worked on is sent to the AI provider whose key that client supplied, and is processed under that provider's terms. These features are off unless a key is configured.

5. Platform data we access

Each platform grants only the permissions needed to publish and to identify the connected account. In particular, for TikTok the Service requests permission to read basic profile information (display name, username, avatar) and to publish video content that you schedule. We do not read your feed, your followers, your private messages, or data about other users of that platform.

6. How long we keep it

• Access tokens — until you disconnect the account, or the platform expires them. Disconnecting deletes the stored token immediately.
• Posts and media — until you delete them. Deleting media in the Service also removes the file from our Google Drive storage; it remains recoverable in that account's trash for a limited period before being permanently erased.
• Account data — for as long as the client relationship is active, and deleted on request when it ends.
• Technical logs — retained for a short operational period and then rotated out.

7. Your choices

You can disconnect any social account at any time from the Social Accounts screen, which immediately deletes its stored access token. You can delete individual posts and media from within the Service. You can also request full deletion of your data by contacting us. See our Data Deletion Instructions.

8. Security

The Service is served over HTTPS. Access tokens and platform credentials are stored in a database that is not exposed to the public internet. Administrative access to the server is limited to key-based authentication. No system is perfectly secure, but we take reasonable measures appropriate to the nature of the data we hold.

9. Children

The Service is a business tool and is not directed to children. We do not knowingly collect information from anyone under 18.

10. Changes

If this policy changes, the revised version will be published on this page with a new "last updated" date.

11. Contact

Questions about this policy, or requests relating to your data, can be sent to davdigi2021@gmail.com.