Data controller
System Reset, 2 John St., Burford, Ontario, N0E 1A0, Canada. Telephone 1-226-775-0156. Privacy requests: support@done.money. We do not have a statutory Data Protection Officer; privacy requests are handled by the operator directly.
What we collect
- Account details you provide: email address, display name, referral source.
- Content you create: posts, captions, campaigns, templates and AI prompts.
- Media you upload: images and video stored in our private storage bucket.
- Connected-channel data: OAuth access and refresh tokens, channel identifiers, and the developer-app client credentials you supply for your own platform apps.
- Engagement data we fetch on your behalf: comments, mentions, replies and post metrics.
- Billing data: email and payment status from Stripe. We never see card numbers.
- Operational logs: timestamps, error traces and request metadata.
How we use it
To operate your account, generate and publish the content you ask us to, run the automations you configure, send transactional email, prevent abuse, and provide support. We do not sell personal data and we do not run advertising trackers.
AI and training
Your content is not used to train any AI model — not ours, and not our providers'. Prompts are sent to the AI provider only to produce the output you asked for, and are not retained by us beyond the generated result you keep in your library.
Subprocessors
These are the third parties that may process your data on our behalf:
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Lovable Cloud (Supabase infrastructure) | Application hosting, database, authentication and media storage | Account details, workspace content, media uploads, encrypted channel credentials | United States / EU data centres |
| Stripe | Payment processing, invoicing and billing portal | Email, billing details, payment status. Card numbers never reach our servers. | United States / global |
| Resend | Transactional email delivery (receipts, resets, alerts) | Email address, message content | United States |
| Google (Gemini via the Lovable AI Gateway) | AI content generation you explicitly request | The prompt text and any content you submit to the AI Studio or composer | United States |
| Social platform APIs you connect | Publishing, comment and message retrieval, engagement metrics | The posts, media and replies you choose to publish or fetch | Per platform |
We notify account holders by email before adding a subprocessor that handles customer content.
International transfers
We are based in Canada and our providers operate primarily in the United States and the EU. Transfers out of the EEA or UK rely on the providers' Standard Contractual Clauses.
Security and credential handling
Data is encrypted in transit with TLS and at rest by our hosting provider. Platform client secrets you supply are additionally encrypted by us with AES-256-GCM before they reach the database, using a key held only in server environment configuration. OAuth tokens and secrets are never sent to the browser — publishing happens server-side. Database access rules scope every row to its owner. Full detail is on our security page.
Retention
- Account and profile data: Kept while your account is open, deleted within 30 days of a deletion request.
- Posts, media and campaigns: Kept until you delete them, or within 30 days of account deletion.
- Channel credentials and OAuth tokens: Deleted immediately when you disconnect a channel.
- Billing records: Retained for 7 years where tax and accounting law requires it.
- Application logs: Retained up to 90 days for debugging and abuse investigation.
Breach notification
If a breach affects your personal data we will notify affected account holders by email without undue delay and, where required, within 72 hours of becoming aware, along with what happened and what we are doing about it.
Cookies and analytics
We set only the cookies and local-storage entries needed to keep you signed in and remember your workspace. There are no advertising cookies, no cross-site trackers and no third-party analytics pixels on the marketing site.
Your rights
Depending on where you live, GDPR, UK GDPR, PIPEDA or the CCPA give you the right to access, correct, export, delete or restrict your data, to object to processing, and to withdraw consent. Exercise any of these by emailing support@done.money; we respond within 30 days. You may also disconnect any channel or delete content yourself from inside the app, and complain to your local data protection authority (in Canada, the Office of the Privacy Commissioner).
Contact
System Reset, 2 John St., Burford, Ontario, N0E 1A0, Canada. Telephone 1-226-775-0156. Email support@done.money.