Privacy Policy

This policy applies to the DhriOSA website, client services, connected account features, operational tools and support channels. A business using DhriOSA controls the business content and customer interactions it authorises us to process. DhriOSA processes that information only to provide, secure and improve the requested service and to meet applicable obligations.

Depending on the features you use, information may include:

• Contact and business information, such as names, email addresses, business details, locations, brand guidance and support messages.
• Connected-account information, such as Instagram professional account IDs, usernames, WhatsApp Business Account IDs, phone number IDs and authorised sender identifiers.
• Content and engagement information, including posts, captions, comments, replies, direct messages, status updates and approval decisions.
• Media and instructions you provide, including images, videos, content notes, scheduling choices and files added to a business content library.
• Webhook and delivery information needed to receive events, route them to the correct business, prevent duplicate processing and record delivery outcomes.
• Service, security and audit information, such as request times, feature activity, device or browser information, IP addresses, error details and administrative actions.
• Content drafts, classifications, recommendations and other outputs produced while delivering AI-assisted features.

DhriOSA may receive access tokens or similar credentials when an authorised administrator connects a platform account. Tokens are treated as secrets, encrypted for storage, restricted to authorised services and never displayed back through ordinary client responses. We use them only to perform actions that the connected business has authorised, such as publishing approved content or responding to an eligible interaction.

Passwords for Instagram, Facebook or WhatsApp should never be sent to DhriOSA. Platform authentication remains with Meta and the relevant account owner.

We receive information directly from business users, authorised administrators and people who contact a connected business. We also receive authorised data and webhook events from platform providers, including Meta, when a connected account publishes content, receives a comment or message, or reports a delivery status.

We use information to:

• Set up and operate a business's DhriOSA workspace.
• Route connected-platform activity to the correct authorised business.
• Prepare, review, schedule and publish content according to client instructions and approvals.
• Receive, classify and respond to comments or messages under the business's configured engagement policy.
• Maintain content libraries, operational history, analytics and service-status information requested by the business.
• Provide support, prevent misuse, investigate failures, secure the service and comply with applicable requirements.

DhriOSA does not sell personal information or use connected-account messages, comments or media for third-party advertising.

Some DhriOSA features use AI services to prepare drafts, interpret instructions, organise media, classify interactions or recommend a response. Relevant business context and submitted content may be sent to a contracted AI service only when needed for that feature.

DhriOSA is designed to apply business permissions, approval states and safety controls before external actions. Businesses remain responsible for reviewing material where their selected workflow requires approval and for the instructions, content and account authority they provide.

We may use carefully selected hosting, database, security, email, monitoring and AI service providers to operate DhriOSA. They process information only as needed to provide their contracted service and are not permitted to use it for their own unrelated purposes.

Instagram, Facebook and WhatsApp are Meta services. Data exchanged with those services is also governed by Meta's applicable terms and privacy policies. DhriOSA is not Meta and does not control Meta's own processing.

We keep information only for as long as needed to operate the authorised service, maintain security and audit records, resolve disputes or meet legal obligations. Retention varies by the type of record and the client's service configuration.

Connected credentials are revoked or removed when the relevant connection is terminated. Following a verified deletion request, eligible account data is removed from active systems within 30 days. Residual copies in protected backups are isolated from ordinary use and expire through the backup lifecycle, normally within 90 days, unless a longer period is required by law or for fraud and security protection.

DhriOSA uses measures appropriate to the information handled, including encrypted transport, encrypted credential storage, tenant-aware access controls, limited administrative access, signature verification for supported webhooks, audit records and monitoring. No system can guarantee absolute security, but we work to prevent unauthorised access, disclosure, alteration and misuse.

An authorised business administrator may disconnect a platform account, revoke its platform access or ask DhriOSA to delete eligible connected-account information. Individuals may also ask about, correct or request deletion of personal information associated with an interaction, subject to verification and applicable exceptions.

See our Data Deletion Instructions for the request process, the information we need to locate a record and what happens after a request is received.

To request access to or correction of your personal information, email hello@dhriosa.com with the subject “DhriOSA Data Correction Request”. Tell us which information is inaccurate and what should change. We verify identity and authority before sharing or changing records. Do not send passwords, access tokens or identity documents in your first email.

For browser storage and account cookies, see our Cookies & browser storage notice.

DhriOSA and its service providers may process information in countries outside your own. Where applicable, we use contractual, organisational and technical safeguards appropriate to the transfer and the services involved.

DhriOSA is a business service and is not directed to children. We do not knowingly invite children to create DhriOSA business accounts.

We may update this policy as DhriOSA develops or its data practices change. The current version and effective date will remain available on this page. Material changes may also be communicated through the service or directly to affected business administrators.

Privacy, security and data-deletion questions can be sent to hello@dhriosa.com. Please do not include passwords or access tokens in an email.