Privacy Policy

1. Scope & Data Controller

This Privacy Policy outlines how DevSocial Technologies ('DevSocial', 'we', 'us', or 'our') collects, protects, uses, and shares information when you visit our website, register an account, publish content, communicate in private Deal Rooms, upload software assets, or participate in our developer marketplace.

DevSocial acts as the Data Controller for your personal account, social graph, and direct platform activities. For peer-to-peer agreements executed inside Deal Rooms, each participant is independently responsible for handling counterparty disclosures in compliance with applicable law.

2. Information We Collect

We collect information necessary to operate a secure, high-integrity social and digital asset ecosystem for developers:

We strictly limit data collection to legitimate operational, security, and contractual requirements.

• Account & Profile Information: Username, display name, verified email address, hashed passwords, avatar image, developer bio, external repository links, and skill tags.
• Developer Verification Data: Identity signals, connected GitHub/OAuth credentials, and verification requests to protect our community against impersonation and fraud.
• Social Contributions: Public posts, replies, code snippets, bookmarks, likes, mentions, and community interactions.
• Deal Room & Contract Records: Deal specifications, milestone milestones, communication logs, price points, and mutually agreed delivery conditions.
• Software Archives & Uploads: Source code zip archives, documentation, screenshots, and metadata uploaded to fulfill marketplace listings and private deals.
• Payment & Billing Identifiers: Transaction IDs, payout recipient details, and billing tokens processed securely through certified PCI-DSS third-party payment providers (DevSocial does not store raw credit card numbers).
• Automated Diagnostics & Security Telemetry: IP addresses, browser user-agent, operating system identifiers, device characteristics, request timestamps, and authentication logs.

3. Legal Bases for Processing (GDPR & Global Standards)

Under the European General Data Protection Regulation (GDPR) and equivalent global data privacy frameworks, we process your personal data under the following recognized legal bases:

• Contractual Performance: To register your developer profile, authenticate sessions, facilitate private Deal Rooms, deliver software assets, and process transactions.
• Legitimate Interests: To defend our platform against malicious attacks, investigate fraudulent listings, prevent spam, enforce platform rules, and maintain audit integrity.
• Legal Compliance: To fulfill statutory financial recordkeeping, tax reporting, anti-money laundering (AML) duties, and respond to valid legal processes.
• User Consent: For optional public disclosures, specialized notifications, or optional profile enhancements (which can be withdrawn at any time).

4. High-Risk Domains & Critical Platform Disclaimers

Specific Protections for Marketplace, Source Code, and Deal Rooms

Because DevSocial connects developers for the transfer of source code and commercial products, the following technical and legal safeguards govern all users without exception:

• Non-Escrow Payment Coordination: DevSocial coordinates payment gateways and release signals to facilitate transaction transparency. Unless explicitly approved in writing by licensed counsel and licensed banking providers, funds held or coordinated through DevSocial do not constitute a legal escrow, trust account, or banking deposit.
• Zero Server-Side Code Execution: User-uploaded source code archives and binaries are never compiled, executed, sandbox-tested, or certified by DevSocial on main or secondary infrastructure. DevSocial does not guarantee that source files are bug-free, safe, or merchantable.
• Buyer Sandboxing Obligation: Buyers and recipients bear the sole and exclusive legal obligation to inspect, scan, and run acquired source code in an isolated, secure sandbox environment before deployment. DevSocial disclaims all liability for system damage, malware, or economic loss.
• Private Storage via Ephemeral URLs: Source code archives and confidential deal files are stored privately in encrypted buckets and accessible strictly via short-lived signed URLs generated solely for authorized deal participants.
• Immutable Audit Records for Deleted Messages: To protect parties against fraud and preserve evidence in disputes, messages or posts edited or deleted by users are hidden from public views but preserved in immutable, restricted audit logs accessible only to authorized moderators and legal compliance personnel.

5. Information Sharing & Third-Party Disclosures

We do not sell, rent, monetize, or trade your personal information to data brokers, ad networks, or unaffiliated commercial third parties. We share information only under strict operational boundaries:

• Deal Room Counterparties: Counterparties in a mutual Deal Room receive only the usernames, agreed deliverables, and communication logs necessary to execute the contract.
• Infrastructure & Database Partners: We utilize enterprise cloud infrastructure (including Supabase for PostgreSQL database, authentication, and secure file storage) under strict data protection agreements.
• Payment Processors: Transaction details are shared with certified payment gateways (such as Stripe) solely to complete payments, prevent chargeback fraud, and issue developer payouts.
• Legal & Law Enforcement Mandates: We may disclose information if required by subpoena, court order, or applicable law, or when necessary to stop imminent physical harm, cyberattacks, or financial fraud.
• Corporate Restructuring: In the event of a merger, acquisition, or asset reorganization, user records will remain subject to the commitments made in this Privacy Policy.

6. Data Retention & Deletion Overrides

We retain your personal data for as long as your account remains active and as required to provide platform services. When you request account deletion, your public profile, portfolio, and public posts are scrubbed or permanently anonymized within thirty (30) days.

However, statutory and contractual retention overrides apply to high-risk records as permitted by law:

• Financial and Tax Records: Invoices, payout logs, and transaction receipts are retained for up to seven (7) years to satisfy mandatory tax and accounting obligations.
• Dispute & Moderation Audit Logs: Deal Room chat histories, delivery receipts, safety incident logs, and immutable deletion logs are retained for the duration of statutory limitation periods (typically 3 to 6 years) to resolve claims and defend legal rights.
• Security Telemetry: IP and authentication audit logs are purged on rolling cycles (maximum 180 days) unless flagged for active security investigation.

7. Your Legal Rights (GDPR, CCPA/CPRA & Global)

Depending on your jurisdiction (including the European Economic Area, the UK, and California), you possess specific legal rights regarding your personal information:

• Right to Access / Know: You have the right to request a complete copy of personal data we hold about you.
• Right to Rectification: You may correct inaccurate or incomplete profile and account information directly via Settings or by contacting support.
• Right to Erasure ('Right to be Forgotten'): You may request deletion of your account and personal data, subject to the legal retention overrides stated in Section 6.
• Right to Data Portability: You may request your authored posts and profile information in a structured, machine-readable format.
• Right to Restrict or Object: You may object to data processing based on our legitimate interests.
• California Consumer Privacy Act (CCPA/CPRA): California residents have the right to know categories of personal data collected, request deletion, and remain free from discrimination for exercising privacy rights. DevSocial does not 'sell' or 'share' personal data as defined under the CCPA.

8. Security Measures & Shared Responsibility

DevSocial implements defense-in-depth technical and organizational safeguards to protect user data, including end-to-end TLS encryption in transit, AES-256 storage encryption at rest, granular Row-Level Security (RLS) on user tables, and strict least-privilege administrative access.

However, no method of transmission over the Internet is 100% invulnerable. You are responsible for safeguarding your login credentials, enabling two-factor authentication, and ensuring secure local storage of any source code downloaded through the platform.

9. Age Limitations & Minors

DevSocial is strictly intended for software engineers, developers, and entrepreneurs aged sixteen (16) years or older. We do not knowingly solicit, collect, or process information from children under 16.

If we discover that an individual under the age of 16 has submitted personal data to DevSocial, we will promptly delete the account and terminate all associated records.

10. Cookies & Session Storage

We respect your privacy and deliberately avoid invasive tracking scripts. We utilize only essential and functional cookies:

We do not employ third-party advertising cookies, cross-site trackers, or behavioral profiling mechanisms.

• Authentication Tokens: Secure HTTP-only cookies that verify your identity across page requests.
• Security Tokens: CSRF and rate-limiting session indicators to prevent automated account abuse.
• Interface Preferences: LocalStorage keys that remember your theme (dark/light mode) and navigation state.

11. Limitation of Liability & Disclaimers

To the maximum extent permitted by applicable law, DevSocial provides its services, tools, and Deal Room infrastructure on an 'as-is' and 'as-available' basis.

In no event shall DevSocial, its founders, directors, or employees be liable for any indirect, incidental, punitive, or consequential damages, including but not limited to loss of code, loss of profits, system outages, data corruption, or damages resulting from malicious third-party code exchanged on the marketplace.

12. Policy Changes & Contact Details

We reserve the right to revise this Privacy Policy periodically to reflect architectural updates, regulatory changes, or feature launches. Substantial amendments will be announced via platform notifications or direct email alerts.

Your continued use of DevSocial following the posting of updated terms constitutes binding acceptance of the revised Privacy Policy.

For questions, data subject requests, or legal inquiries, contact our dedicated privacy team at privacy@devsocial.io or support@devsocial.io.