Privacy Policy

Duta is a tool for scheduling social media posts. You write a post, choose which of your own connected accounts should receive it, and Duta publishes it at the chosen time. Anyone may create an account, and using it beyond the free days is paid for by subscription.

Duta is made and operated by Baloot MY Digital Agency (NS0322595-U), a digital agency registered in Malaysia. That is who holds the data described below, and who a request about it reaches.

• Your email address, used to sign in.
• For each social account you connect: the account identifier the platform gives, your display name and profile picture on that platform, and which permissions you granted.
• The access tokens that let Duta publish on your behalf.
• The posts you write, the times you schedule them for, and whether publishing succeeded or failed.
• A record of actions taken, such as connecting an account, scheduling a post or a failed publish, with the reason a platform gave when something did not work.
• If you subscribe: which plan you are on, whether it is active, when the free days end, and when the next payment is due.
• The identifier Stripe gives your customer record, so Duta can ask Stripe about your subscription. Nothing else about the payment.

Duta never sees your card. The number, the expiry and the security code are typed on a page Stripe hosts and are held by Stripe. They do not pass through Duta and are not stored here in any form.

Duta does not read your feed, your followers, your messages, or anything else on the platforms you connect. It asks only for permission to publish.

Connecting an account gives Duta a token, a key that lets it publish as you. Those tokens are encrypted before they are stored, with AES-256-GCM, and the encryption key is held separately from the database. Nobody reads a token by reading the database.

Disconnecting a channel deletes its tokens from Duta immediately. You can also revoke Duta's access from the platform's own settings at any time, and Duta will stop being able to publish the moment you do.

• Supabase, the database, hosted in Singapore.
• Vercel, which runs the application itself.
• Cloudflare R2, which stores uploaded media. Media files are served over public HTTPS addresses because the social platforms have to fetch them. Those addresses are impractical to guess, but they are not password-protected.
• Railway, which runs the small service that tells Duta, once a minute, to check for posts that are due. It holds no personal data.

The social platforms you choose, and only those. When you schedule a post to a Facebook Page, Duta sends that post's text and media to Facebook. It sends nothing anywhere you did not select.

Stripe, for payment. When you subscribe, your email address goes to Stripe so it can create a customer record and send receipts, and your card details go to Stripe directly rather than through Duta. Stripe is a payment processor based in the United States and Ireland, and it holds the payment record. What Duta keeps of it is described above.

Resend, which delivers Duta's email, including the link that confirms your address, a reminder before your first payment, and a note when something needs your attention. It receives your email address and the contents of those messages.

Duta does not sell data, does not share it with advertisers, and does not use it to train anything.

• Posts and their publishing history: until you delete them.
• Access tokens: until you disconnect the channel or delete your account.
• Records of actions taken: 90 days.
• Server logs: 30 days.
• Subscription records: for as long as the account exists, and afterwards for as long as Malaysian tax and accounting law requires the transaction to be kept, which is seven years.

Deleting a post in Duta removes Duta's copy. It does not remove anything already published on a platform. That has to be deleted on the platform itself.

You can disconnect any channel, delete any post, or ask for the whole account and everything in it to be erased. See Delete my data for how.

Baloot MY Digital Agency is the data user for the purposes of the Personal Data Protection Act 2010, and Duta is operated from Malaysia under it: data is collected with consent, used only for scheduling and publishing as described here, and deleted on request.

If what Duta does with data changes, this page changes with it, and the date at the top moves.

Questions about privacy, or a request to delete your data: hello [at] baloot [dot] my

Baloot MY Digital Agency (NS0322595-U)
Lot 8115, Tingkat Bawah, Bandar Satelit Islam Pasir Tumboh, 16150 Kota Bharu, Kelantan, Malaysia