Privacy Policy

We collect information you provide directly to us when you use our Services.

We use the collected information for various purposes, including:

• To provide, maintain, and securely operate the CodivUpload dashboard infrastructure.
• To seamlessly execute your cross-platform content publishing and scheduling orders.
• To send you technical notices, updates, security alerts, and administrative messages.
• To understand and analyze how users interact with our Services, aiming strictly to improve platform performance.

CodivUpload integrates with the following social media platforms via their official APIs. Below is a complete disclosure of the permissions we request, the data we access, and how we use it for each platform.

For all platforms: OAuth tokens (access and refresh) are encrypted at rest using AES-256-GCM authenticated encryption with unique random initialization vectors. Tokens are only decrypted momentarily in server memory during authorized API operations and are never stored in plaintext, written to logs, or accessible to any human.

In accordance with Google's Limited Use requirements:

• We only use Google user data to provide and improve the user-facing features that are visible and prominent in CodivUpload's interface (video publishing and analytics display).
• We do not transfer Google user data to third parties unless necessary to provide or improve the service, comply with applicable laws, or as part of a merger/acquisition with prior user consent.
• We do not use Google user data for serving advertisements or for any advertising purpose.
• No human reads Google user data, except with explicit user consent, for security/abuse investigation, to comply with legal obligations, or when data is aggregated and anonymized for internal operations.

We share your information only with infrastructure providers (sub-processors) who are strictly required to operate the Service, under Data Processing Agreements (DPAs) and strict confidentiality obligations. These providers process data solely on our instructions and do not use your data for their own purposes.

All sub-processors maintain SOC 2 compliance and their own privacy policies linked above. We will update this list if we add or change sub-processors.

Security is our paramount priority. We implement Zero-Trust architectures:

Under the General Data Protection Regulation (GDPR) and similar frameworks, we are required to identify a lawful basis for each processing activity. The table below outlines the legal grounds on which we process your personal data.

Where we rely on legitimate interest, we have conducted a balancing assessment to ensure our interests do not override your fundamental rights and freedoms. You may request details of these assessments by contacting privacy@codivupload.com.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. The table below outlines our retention periods by data category.

When you delete your account, we will delete or anonymize your personal data within 30 days, except for data we are legally required to retain (e.g., payment records for tax compliance). Backup systems are purged on a rolling 30-day cycle following deletion.

You can instantly revoke any connected platform's access and wipe associated tokens from our databases using your CodivUpload dashboard. For Google accounts, you can also revoke access from your Google Account Permissions page.

European Economic Area, UK & Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, the General Data Protection Regulation (GDPR) grants you the following rights:

International Data Transfers (EU → US)

Your data is processed primarily in the United States. For transfers from the EEA/UK to the US, we rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) with our sub-processors. As supplementary measures, all sensitive data (OAuth tokens, credentials) is encrypted at rest using AES-256-GCM, and all data in transit is protected by TLS 1.3. You may request a copy of the applicable SCCs by contacting privacy@codivupload.com.

California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

To exercise your CCPA rights, email privacy@codivupload.com with the subject line "CCPA Request". We will verify your identity and respond within 45 days.

CodivUpload uses only strictly essential cookies required for the Service to function. We do not use any third-party tracking, analytics, or marketing cookies.

Because we use only essential cookies that are strictly necessary for the operation of the Service, no cookie consent banner is required under GDPR ePrivacy Directive or CCPA. We do not honour "Do Not Track" browser signals as we do not perform any tracking.

In compliance with the CAN-SPAM Act and applicable email marketing laws:

• All commercial and marketing emails include a clear unsubscribe link in the footer.
• Opt-out requests are honoured within 10 business days.
• Every email includes our physical mailing address: 30 N Gould St #52487, Sheridan, WY 82801, USA.
• We do not use deceptive subject lines or false header information.
• Service-related transactional emails (password resets, security alerts, billing receipts) are not affected by opt-out preferences as they are necessary for the operation of your account.