Privacy Policy
What we collect, why, how long we keep it, and what you can ask us to do about it. Written to be read rather than to be survived.
Who we are
EngageDigital is operated by Proceed Interactive Marketing Group LTD, a company registered in Cyprus under number HE 371549, with its registered office at Onoufriou Kliride 9, 6027 Larnaca, Cyprus. We are the data controller for the personal data described in this policy.
For anything in this document, including requests to exercise your rights, write to [email protected].
What this policy covers
This policy covers the EngageDigital website, the EngageDigital dashboard at app.engagedigital.com, and the early-access waitlist we ran before launch. It does not cover the social platforms you connect to us. Instagram, TikTok, LinkedIn and the rest each have their own policies, and your relationship with them is governed by those.
What we collect
We collect 3 categories of data, and we try to collect as little of each as the service allows.
We never receive or store your social account passwords. Every connection goes through the platform’s own login screen, and what we hold afterwards is a revocable token.
Media, integrations and client links
Some parts of the dashboard hold data beyond the categories above. Each one is only used when you, or someone in your workspace, turns it on.
People who use a client link are not our customers, but their data is handled under the same rules as yours. For that data, the customer who sent the link is the controller and we act as processor under the DPA.
Payment data
Paid plans are not open yet. When they are, card details will be handled entirely by a third-party payment provider and will not touch our systems. We will hold only the subscription record, the plan, the billing period and the invoices.
Why we are allowed to
- Contract. Running your account, publishing what you schedule, taking payment. Without this data there is no service.
- Legitimate interests. Security, abuse prevention, debugging, and basic product analytics. We have weighed these against your interests; you can object at any time.
- Consent. The waitlist email, the changelog newsletter, and any non-essential cookie. Our analytics, Google Analytics 4, only loads on this website after you accept statistics cookies: decline and no request is sent to Google. Withdraw it at any time; withdrawal does not affect what was done beforehand.
- Legal obligation. Tax and accounting records once we invoice you.
AI features and your content
When you use an AI feature, the content that request needs, such as the brief you typed, the comment thread you are replying to, the review you are answering or the part of your calendar you asked about, is sent to our AI provider, Anthropic, and the result is returned to you.
- Your content is not used to train any model, by us or by the provider.
- The provider may keep a request for a limited period under its commercial terms, for example to detect abuse, and then deletes it. It never keeps it for training.
- It is not shared with other customers, and one workspace’s content is never used to write for another.
- Nothing the AI produces is published, sent, scheduled or deleted until a person in your workspace approves it. We do not use AI to make decisions about you that have legal or similarly significant effects.
- AI output can be wrong, so every draft stays a draft until you have checked it.
- The provider is named in the sub-processor list, with its location and the transfer basis we rely on.
The Assistant and brand memory
The dashboard includes an Assistant that plans and drafts posts, suggests replies and opens the right screen for you. To do that it keeps 2 kinds of data for each workspace.
- Every fact in brand memory shows where it came from. You can edit or delete any of them, or clear the whole memory, from “What the Assistant knows”.
- Brand memory is about the business, not about people. Phone numbers, email addresses, payment details and health information are filtered out before anything is saved, and personal details of your customers or followers are not stored there.
- Learning from your edits can be switched off per workspace in Settings, under Privacy and data.
- Memory stays inside its workspace. It is never used for another workspace or another customer, and never used to train any model.
How long we keep things
Cancelling a paid plan is not the same as closing your account. After you cancel, the account moves to the Free plan at the end of the period you paid for, and your media and reports stay available for 90 days so you can export them. After that, content above the Free plan’s limits may be deleted, and we email you before we do.
When you close your account we delete or irreversibly anonymise your data, including media, brand memory and Assistant conversations, within 30 days, except records we are legally required to keep.
Data leaving the EEA
We are a Cyprus company and our primary infrastructure sits in the EU. Some sub-processors operate outside the EEA. Where that happens we rely on an adequacy decision where one exists, and otherwise on the European Commission’s Standard Contractual Clauses together with a transfer impact assessment.
The sub-processor page lists each provider’s location and the mechanism relied on.
Your rights
Under the GDPR you can ask us to:
- give you a copy of your data, and tell you what we do with it
- correct anything that is wrong
- delete your data, where we have no overriding reason to keep it
- restrict or stop a particular use of it
- hand it to you, or to another provider, in a machine-readable format
- stop processing based on legitimate interests, where your situation outweighs ours
Write to [email protected]. We reply within one month, and we will tell you if we need longer and why. You never have to pay for this.
If you are unhappy with how we handled it, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority where you live.
Security
Data is encrypted in transit and at rest. Access tokens are encrypted with a separate key. Access to production systems is limited to the people who need it, over multi-factor authentication, and is logged.
If a breach affects your data and is likely to create a risk to you, we will notify the Commissioner within 72 hours and tell you directly without undue delay.
Children
EngageDigital is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to [email protected] and we will remove it.
Changes to this policy
If we change anything material we will email account holders at least 30 days before it takes effect and post the new version here with its date.