Privacy Policy

Last updated: 2 November 2026

This Privacy Policy explains how The Digital Agency (“we”, “us”, “our”), based in India, collects, uses, stores, shares and deletes personal data when you use Agency OS (the “Service”), our web application for running an agency: tasks, clients, documents, attendance, finance, shoots, and planning and publishing social media posts.

We follow the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023, as they apply to us, together with the developer policies of the platforms we connect to (listed in section 5).

1. Who is responsible

Agency OS is operated by The Digital Agency. Where an agency or business (“your organisation”) uses Agency OS to manage its own team, clients and social accounts, your organisation decides what data goes into the Service, and we process it on its behalf to provide the Service. For the sign-in details of the people who use Agency OS, and for the data we keep to run the Service itself, we decide how the data is used.

Contact for all privacy matters, including complaints (Grievance Officer, The Digital Agency): theagencyos.net@gmail.com.

2. What we collect

Account and team data

• Name, email address, phone number, role and the organisation you belong to.
• Your password, which we store only as a one-way hash. We never see or store it in readable form.
• Work records your organisation enters: tasks, meetings, attendance, leave, travel and allowance bills, documents, shoots, finance entries, and client details.
• Files you upload (images, videos, documents) and the captions, hashtags and schedules you write for posts.

Data from connected social accounts

When an owner or admin of your organisation connects a social account, the platform asks them to approve access on the platform’s own sign-in page. We never ask for, see or store the account’s password. What we receive depends on the platform and the permissions approved:

• Facebook and Instagram (Meta): the Pages and linked Instagram professional accounts you manage (their IDs, names and usernames), an access token for each, and the posts, comments and basic performance numbers needed to publish and report. Where advertising features are used, ad account and campaign performance data.
• Threads (Meta): your Threads account ID and username and an access token, used to publish posts to that account.
• YouTube and Google Business Profile (Google): the YouTube channels and business locations you manage (IDs, names, addresses shown on the profile), and an access (refresh) token, used to upload videos and publish posts, and to read reviews where that feature is turned on.
• LinkedIn: the member or company page you authorise (ID and name) and an access token, used to publish posts to it.

These tokens are stored encrypted. We use them only to do what the person who connected the account asked: publish the posts you schedule, and show you the results.

Technical data

• Sign-in session information, IP address, browser type and basic server logs, kept to keep the Service secure and working.
• Essential cookies that keep you signed in and protect the sign-in process. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics or advertising pixels in the app.

3. Why we use it

• To provide the Service: sign you in, show your organisation’s work, and schedule and publish the posts you create to the accounts that were connected for that purpose.
• To send notices that belong to the Service, such as invitations, password resets, reminders and publishing results.
• To keep the Service secure, prevent misuse, fix faults and meet legal obligations.

We do not sell personal data. We do not use data received from Meta, Google, YouTube, LinkedIn or Threads for advertising, to build profiles or databases for sale, to train general-purpose artificial-intelligence models, or for any purpose other than providing and improving the features the user approved.

4. Who we share it with

• The platforms you connect. When you schedule a post, its text and media are sent to the platform you chose (for example Instagram or YouTube) so it can be published. The platform fetches the media through a signed link that only works for that file.
• Service providers that host the Service, store data and files, and deliver email or messages for us. They may handle data only to provide those services to us and under confidentiality and security obligations.
• Your organisation. Other authorised people in your organisation can see the work data and connected accounts their role allows.
• Authorities, when the law requires it or to protect rights, safety and security.
• A successor, if our business is merged or transferred, who must keep to this policy.

5. Data from Google, Meta and other platforms

6. How long we keep it

• Account and work data: for as long as your organisation’s account is active.
• Connected-account tokens: until the account is disconnected, the token expires or is revoked, or you ask us to delete it. Tokens are deleted when the connection is removed.
• After a verified deletion request or account closure: we delete the data within 30 days. Backup copies are overwritten within a further 30 days.
• Some records (for example finance and tax records) may be kept for the period the law requires, and only for that purpose.

7. How we protect it

We use encrypted connections (HTTPS), encrypt connected-account tokens, store passwords as hashes, limit access by role, keep audit records, and take regular backups. No system is perfectly secure. If a breach affects your personal data, we will tell the people affected and the authorities as the law requires.

8. Your rights and choices

Under Indian law you can ask us to:

• tell you what personal data we hold about you and how it is used;
• correct or complete data that is wrong;
• erase your data, and withdraw consent you gave earlier (this may stop parts of the Service from working);
• take action on a complaint, and nominate another person to exercise these rights for you if you die or cannot act.

Write to theagencyos.net@gmail.com from your registered email address. We reply within 30 days. You can also disconnect any social account yourself from inside Agency OS, and remove our access from the platform’s own settings. Step-by-step instructions are on the data deletion page. If you are not satisfied with our reply, you may complain to the Data Protection Board of India once it is operating, or to any other authority that has the power to hear it.

9. Children

Agency OS is for working adults. It is not meant for anyone under 18, and we do not knowingly collect data from children.

10. Where data is stored

Data is stored on servers chosen by us. If it is stored or processed outside India, we do so only as the law allows and with the same protection described here.

11. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows when it was last changed. For important changes we will tell signed-in users in the app or by email.

12. Contact

The Digital Agency
Email: theagencyos.net@gmail.com