1. Who we are
PostDiva is operated by Evolve Orbit - F.Z.C, United Arab Emirates. This policy explains how we handle information when you visit our website, sign in, use a workspace or contact us. Contact cameron_y2k@hotmail.co.uk about privacy or your information.
2. Information we use
- Account details: your name, email address, account identifier and authentication records. Email/password authentication is handled through Supabase Auth.
- Workspace content: posts, drafts, scheduling details, uploaded files, brand guidance, settings, membership information and actions taken in your workspace.
- Connected accounts: if you authorize a supported social integration, the provider account identifiers, permissions and access credentials needed for that integration, along with publishing results and errors. Integration availability varies by provider.
- Service and support records: relevant usage and security events, request and error information, and the information you choose to include in correspondence. Hosting and authentication providers may process technical details such as IP addresses and browser information to operate and secure their services.
- Billing records, where enabled: subscription, customer and payment-status references. Card details are handled by the payment provider rather than stored as card numbers in PostDiva.
3. Google sign-in
If you choose Google sign-in, we request only openid, email and profile access for authentication. We use your name, verified email address and Google’s stable account identifier (the subject, or sub) to identify your account. We do not request Gmail, Drive or Calendar access through sign-in.
Google sign-in does not silently merge an existing account with a matching email. Connecting Google to an existing account requires you to sign in to that account and explicitly link it. We do not retain Google access or refresh tokens for this sign-in flow.
After verification, we issue our own revocable application session, valid for up to seven days. The server stores a hash of its secret token, not the usable token itself. Short-lived verification records help protect the sign-in process; signing out revokes the current Google application session.
We use Google identity information to provide sign-in, account access and related security. We do not sell Google user data or use it for advertising, retargeting or credit decisions. Google sign-in information is not automatically supplied to AI drafting. Our use and transfer of Google user information follows the Google API Services User Data Policy, including its Limited Use requirements.
YouTube connections
A YouTube connection is separate from Google sign-in. Where this connection is available, PostDiva uses YouTube API Services to retrieve the identifier and display name of the channel you authorize. We store those channel details, granted permissions and encrypted connection credentials to display and manage that connection in your workspace. Authorized workspace members can see the channel name and connection status according to their role; usable provider tokens are not sent to the browser.
The current integration is account connection only: it does not upload videos, retrieve audience analytics or access Gmail, Drive or Calendar. Customer YouTube connections remain unavailable while provider approval and operational retention checks are completed. YouTube channel information is not supplied to AI drafting, sold or used for advertising.
Use Disconnect in Channels to remove the stored connection credentials and channel-profile details and request revocation of the provider grant. This does not delete your videos or other content on YouTube, or your independently created PostDiva drafts. You can also revoke access through Google’s security permissions. For a stored-data deletion request or privacy question, contact cameron_y2k@hotmail.co.uk; we verify account and workspace authority before acting.
Google and YouTube apply the Google Privacy Policy and YouTube Terms of Service. Our hosting and storage providers process the connection information as described below.
4. Why we use information
We use information to authenticate you, maintain your workspace, store and display your content, carry out the publishing actions you authorize, apply workspace permissions and usage allowances, provide support and protect against abuse. If you choose an enabled AI feature or a paid subscription, we also use the relevant information to provide that requested feature or manage billing.
Workspace access is checked on the server against the authenticated user and their workspace role. People you authorize to access a workspace can see or manage its content according to their permissions. Do not upload content or personal information that you are not entitled to use.
5. Service providers and sharing
We use service providers to operate the application. The information involved depends on the features you use:
- Vercel: hosts the website and application requests.
- Supabase: provides email authentication, the application database and private file storage.
- Google: verifies your identity when you choose Google sign-in.
- AI providers through Vercel AI Gateway, when enabled: process the brief, selected brand context and requested content to generate drafts. Avoid putting sensitive or unnecessary personal information into prompts.
- Stripe, when billing is enabled: processes checkout, payment methods and subscription management, with relevant account and subscription references exchanged with the application.
- Social platforms and transactional email services, when used: receive the content or information necessary for the connection, publication or service message you request.
Providers may process information outside the UAE depending on their infrastructure and the services used. We may also disclose information where necessary to respond to lawful requests, protect the service or investigate misuse. Access to Google user information remains subject to the restrictions described above; staff access is limited to providing authorized support, necessary security work or legal obligations.
6. Cookies and security
We use cookies and similar session records to keep you signed in, complete authentication, remember the selected workspace and protect account-recovery flows. Blocking these essential cookies can prevent sign-in or workspace access. Google and other providers apply their own policies when you visit their websites.
We use server-side permission checks, private file access and encryption for stored integration credentials. No internet service can guarantee complete security. Do not share passwords, verification codes, recovery links or provider credentials with support; report suspected unauthorized access using the support page.
7. Retention and your choices
We retain account and workspace records as needed to provide the service, protect it, resolve disputes and meet applicable recordkeeping obligations. A session’s expiry ends its validity; it does not mean every related security record is immediately erased. Files, posts, billing records, security records and backups can have different retention needs.
You can edit available workspace information, delete posts or files through the available controls, and disconnect supported social accounts to remove their stored access credentials. Removing a local connection does not delete content already published on a social platform. You can also manage third-party permissions through that provider’s account settings.
To request access, correction, an export, deletion or a restriction on processing, email cameron_y2k@hotmail.co.uk from your account email. We verify identity and workspace authority before releasing or changing information. We will explain the scope and any applicable legal, security or other-person restrictions. These requests are handled through support, not an automatic account-deletion tool; some records or backup copies may need to be retained beyond deletion of active content.
8. Contact and policy updates
For questions or a concern about our handling of information, contact Evolve Orbit - F.Z.C at cameron_y2k@hotmail.co.uk. We will work with you to understand the request and the appropriate next steps.
We may update this policy as the service or its processing changes. The date shown on this page identifies the current version. Material changes affecting how we use your information will be communicated through the service or an appropriate account contact.