Privacy Policy

Introduction

This policy describes the data practices of the operator of this Dealzcan deployment for Dealzcan. People can register or join from an invitation. It is not a certification of GDPR, CCPA, or any other privacy law.

Business identity

No legal entity name is published in this deployment. References to the operator mean whoever controls this Dealzcan installation.

Contact information

Privacy email: admin@dealzcan.com.

Privacy and deletion requests can also be submitted on the contact and data deletion pages.

Information collected

Dealzcan stores the account email, a scrypt password hash, role, display name, workspace membership, and sign-in history such as failed attempts and lockouts. Public registration creates an inactive account until the email link is used. An owner or admin can still create an invitation.

Social account information

When a member connects a network, the app stores the account label, destination such as a Page, board, channel, or recipient, connection health, and an encrypted credential blob. Disconnecting a network clears that blob. Deleting a network removes the account row. Past posts can remain in history.

OAuth permissions

Facebook login asks for Page listing, Page posting, Page engagement, and business management when no Login for Business configuration is set. The app stores the user token and, after a Page with publishing permission is confirmed, the Page token. Instagram, Pinterest, Threads, LinkedIn, X, TikTok, and YouTube use their own OAuth apps when those apps are configured. OAuth state is single-use and expires. The app does not ask members to paste developer secrets for Facebook.

Product feed information

Configured product feeds supply titles, prices, images, merchant identifiers, and affiliate URLs. Feed contents come from the sources an operator connects. Dealzcan does not claim ownership of those catalogs.

Uploaded content and media

Studio uploads are stored as files in the deployment's object storage, with captions, hashtags, and media references in the database. Size limits apply. A failed upload does not publish a post.

Publishing and automation data

Queues, schedules, automation rules, publish jobs, provider post ids, and permalinks are stored so a post is not sent twice for the same library item, account, and slot. Dry-run is the default unless a saved production setting says otherwise. A dry-run is not a live post.

WhatsApp recipient information

WhatsApp uses the official Cloud API. The stored destination is a phone number id and a recipient number, with the Cloud API token in the encrypted credential blob. The app sends the caption as text to that saved recipient. It does not connect personal WhatsApp by QR code. Incoming webhook events are acknowledged. Message bodies from webhooks are not stored as a mailbox.

Analytics and click tracking

Affiliate clicks through the app's redirect are counted. The stored click record includes the post, product, network, and a visitor hash. The raw visitor address is not the click record. Revenue rows may be imported when a merchant report is connected.

Cookies and sessions

Sign-in uses one httpOnly cookie named social_admin. It is SameSite=Lax, and Secure on the production host. The session lasts 14 days unless it is revoked. The CSRF token used for signed-in requests stays in page memory. Theme choice is stored in local storage, not a cookie. The app does not set analytics or advertising cookies.

How information is used

Data is used to authenticate members, connect networks, prepare and publish content, run automations the member configured, track affiliate clicks, and keep an audit log of administrative actions.

Data sharing with social platforms

Publishing sends the caption and permitted media to the network API the member authorized. That network then processes the post under its own terms. Dealzcan does not sell personal information.

Third-party service providers

This deployment is hosted on Vercel. The database is hosted Postgres. Media uses object storage. Network APIs are operated by their own companies. A notification webhook is used only when one is configured. Those providers process data to run the service.

Data retention

Operators can set day windows for job logs, old OAuth states, and rate-limit rows. Posts, clicks, revenue, and the audit log are kept when those windows are saved. A completed deletion request erases the matching customer's own content and profile. It does not erase the original Dealzcan workspace, invoices, or the audit log.

Data security

Network credentials are encrypted with AES-256-GCM before they are stored. Passwords are stored as scrypt hashes. Browser traffic uses HTTPS. Other records, including emails, captions, and publish history, are stored in the database without a separate application-level encryption layer. No SOC 2 or ISO 27001 certificate is claimed.

User privacy rights

Members can ask to access or delete personal information through the data deletion page. The operator must verify identity and authority before changing or deleting records. This page does not promise a statutory response time.

Data deletion

The public form records a request and a confirmation code. Status starts as identity verification required. Nothing is deleted until an authorized operator marks the request completed. Completion deletes the matching account's customer-owned content and profile. The original Dealzcan workspace, billing invoices, and audit log are retained. Signed-in members can export their own account data from profile settings.

International data transfers

Hosting and database providers may process data outside the country where a member lives. This policy does not describe a specific transfer agreement.

Children's privacy

Dealzcan is a private business tool. It is not directed to children, and it does not verify age.

Policy updates

This version is dated 2026-10-27. Later changes replace this page. The application does not email a notice unless a contact address is configured and an operator sends one.

Contact details

Privacy email: admin@dealzcan.com.