Effective 17 July 2026 · Version 1.0
Privacy Policy
ContentDesk is operated by a Sri Lankan sole proprietor trading as ContentDesk. This policy explains how account, client, content, social, billing, support, and analytics data are handled.
Information we process
We process account identity, organization and brand records, invited client/team details, content and approvals, comments and attachments, support messages, subscription records, and technical security logs. Connected social providers supply account identifiers, publishing status, and analytics according to the permissions you approve.
Why and where
Data is used to provide the contracted service, secure and isolate workspaces, publish only authorized content, deliver notifications, process PayPal subscriptions, prevent abuse, and comply with law. Supabase hosts application data; Cloudflare R2 stores private media; Postiz coordinates social integrations; Resend delivers transactional email; and PayPal processes payments. These providers may process data outside Sri Lanka under their own safeguards.
Tokens, media, and retention
Social tokens and provider secrets remain server-side. Private media is exposed only through short-lived signed URLs. Temporary publishing copies expire after 30 days. Account and billing records are kept while needed for service, disputes, security, and legal obligations; deleted workspace data is removed or anonymized according to operational backup cycles.
Your choices
You may request access, correction, export, or deletion, manage routine notification preferences, disconnect social accounts, and cancel a subscription. Security, billing, and directly assigned approval notices may remain mandatory. We do not sell personal information.