Data Protection & Privacy Compliance Statement
Official Regulatory Compliance Reference • Last Updated: October 19, 2026 • Governed by SocialShout (A Unit Of Dashing Webtech)
Executive Commitment: SocialShout is engineered from the ground up on the principle of Absolute Creator Data Sovereignty. We strictly comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act, Act No. 22 of 2023) and the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
We process personal data lawfully, transparently, and solely for specified, explicitly authorized purposes. We never sell, monetize, or broker creator or consumer data to third-party ad networks or data brokers.
1. Statutory Frameworks & Legal Bases for Processing
SocialShout operates as a Data Fiduciary (under the DPDP Act 2023) and as a Data Controller (under GDPR Art. 4(7)) for platform user account and billing information. For creator audience leads, digital store buyer records, and email subscriber lists, SocialShout operates as a secure Data Processor acting strictly on behalf of the creator (the primary Data Controller/Fiduciary).
We process personal digital data under the following legitimate legal grounds:
- Explicit Informed Consent (DPDP Act Sec. 6 / GDPR Art. 6(1)(a)): Granted voluntarily by creators when signing up, linking social accounts, or configuring services, and by audience members when submitting lead forms or subscribing to creator newsletters.
- Performance of Contract (GDPR Art. 6(1)(b)): Necessary to provision your workspaces, schedule social media releases, fulfill digital storefront product downloads, and dispatch authorized email campaigns.
- Legal Obligation & Financial Compliance (GDPR Art. 6(1)(c)): Retaining GST-compliant financial tax invoices and merchant order logs under applicable Indian and international laws.
2. Feature-by-Feature Compliance Architecture
The following matrix explains how each individual feature and service within the SocialShout platform adheres strictly to the DPDP Act 2023 and GDPR:
Universal Multi-Network Composer & Scheduled Publishing
Connected Networks: Twitter / X, Meta (Facebook Pages & Instagram Professional), LinkedIn, Pinterest.
- Zero Password Custody: Connection is achieved strictly through official OAuth 2.0 PKCE authentication. SocialShout never receives, asks for, or stores your social network account passwords.
- Cryptographic Vault Storage: User access tokens and refresh tokens are encrypted at rest using AES-256-CTR with per-record initialization vectors.
- Instant Token Purge: When you disconnect an account from Workspace Settings, all OAuth tokens are cryptographically purged immediately from our active database.
- Scoped Permissions: We request only the minimum API scopes necessary to schedule and publish your content.
YouTube Studio Automation & Video Release Wizard
YouTube Data API v3 integration with direct chunked high-speed video uploading.
- Google Limited Use Compliance: SocialShout’s use and transfer of information received from Google APIs to any other app adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements.
- Transparent Privacy Controls: Video releases honor creator-selected privacy states (Public, Unlisted, Private) directly in the API payload.
- Independent Revocation: Users can revoke SocialShout’s access at any time via the Google Security Permissions Console.
Smart Link-in-Bio Pro
Creator landing pages hosted on custom sovereign sub-paths (`socialshout.in/bio/@handle`).
- No Intrusive Cross-Site Tracking: We do not inject third-party ad retargeting pixels or cross-site tracking cookies into public bio visitor sessions.
- Aggregated Privacy Telemetry: Visitor counters record aggregated impressions and link clicks without capturing identifying PII (such as raw IP addresses or device serials).
- Creator Sovereignty: Creators can modify, unpublish, or permanently delete their bio pages and custom links at any time.
Social Lead Forms Pro & CRM Submissions
Dynamic lead collection forms embedded on bio pages or shared as standalone links.
- Notice & Purpose Specification (DPDP Sec. 5): Each form displays the creator's identity and clear statement of purpose before the user inputs their details.
- Granular Consent Checkbox: Forms include unambiguous consent confirmations prior to form dispatch.
- Creator Ownership & Deletion: Lead submissions belong solely to the creator. Creators can export all lead submissions to CSV or purge records with a single click.
Digital Storefront Active E-Commerce Checkout (0% Commission)
Direct merchant settlements via Razorpay, Cashfree, PayU, and Paytm with automated digital asset fulfillment.
- Zero Payment Card Custody (PCI-DSS): SocialShout never handles, routes, or stores customer credit/debit card numbers, CVVs, or UPI PINs. Transactions are processed directly on the creator’s merchant gateway via secure redirect.
- Cryptographic Digital Asset Tokens: Product downloads are protected via ephemeral, single-use signed tokens with cryptographic expiration TTLs to prevent unauthorized scraping.
- Minimal Customer Record Retention: Buyer contact info (name and email) is retained strictly for order verification, delivery, and tax receipts.
Email Marketing Broadcast Suite & Visual EmailBuilder
Broadcast campaigns, subscriber list management, and background SMTP delivery.
- Mandatory 1-Click Unsubscribe (GDPR Art. 7(3)): Every outbound email includes both a visible 1-click unsubscribe link in the footer and standard RFC 8058 `List-Unsubscribe` headers.
- Instant Suppression: Unsubscribed recipients are automatically quarantined into suppression lists, preventing future dispatches.
- Encrypted SMTP Vault: Custom SMTP server passwords and API credentials (AWS SES, Brevo, Mailgun) are stored using AES-256-CTR encryption.
WhatsApp Automation Engine (Evolution API Gateway)
Direct QR session linking for automated customer notifications and authorized messaging.
- Opt-In Enforcement: WhatsApp automation is restricted strictly to recipients who have provided explicit opt-in consent.
- Automated Opt-Out: Inbound STOP keywords automatically flag recipient contacts as unsubscribed, halting further broadcasts immediately.
- Direct Instance Encryption: Session keys and authentication states are maintained in memory-isolated environments without persistent plaintext storage.
Unified Social Inbox & Engagement CRM
Triage direct messages, comments, and mentions across connected social channels.
- Role-Based Access Control (RBAC): Granular permissions (Manager, Editor, Viewer) ensure team members view only messages relevant to their assigned scope.
- Strict PII Masking: Sensitive message metadata is masked during session monitoring to safeguard end-user confidentiality.
3. Rights of Data Principals (DPDP Act) & Data Subjects (GDPR)
Under Chapter III of the DPDP Act 2023 and Chapter III of the GDPR, you possess full statutory rights over your personal data. Here is how SocialShout guarantees and operationalizes each right:
| Statutory Right | DPDP Act (India) | GDPR (EU) | How to Exercise in SocialShout |
|---|---|---|---|
| Right of Access / Information | Section 11 | Article 15 | View all your profile details, connected accounts, and workspace assets directly on your dashboard at any time. |
| Right to Correction & Updating | Section 12 | Article 16 | Update your name, email, avatar, passwords, and billing information in real time under Account Settings. |
| Right to Erasure ("Right to be Forgotten") | Section 12 | Article 17 | Trigger immediate irreversible account and workspace purge via POST /account/delete in Workspace Settings, or email [email protected]. |
| Right to Data Portability | Recognized Principle | Article 20 | 1-Click structured data export: download all scheduled posts, leads, orders, subscribers, and analytics in CSV/JSON format. |
| Right to Grievance Redressal | Section 13 | Article 77 | Direct escalation to our Data Protection Officer at [email protected] with a guaranteed 30-day response SLA. |
| Right to Nominate | Section 14 | N/A | Nominate an individual to exercise data rights on your behalf in the event of death or incapacity by filing a verified request with our compliance desk. |
4. Technical & Organizational Security Measures (TOMs)
In accordance with Section 8(5) of the DPDP Act 2023 and Article 32 of GDPR, SocialShout implements industry-leading security controls to protect against accidental loss, unauthorized disclosure, or illicit access:
- Encryption in Transit: Strict Transport Security (HSTS) with TLS 1.3 enforced across all web, API, and webhook traffic.
- Encryption at Rest: Sensitive database columns, API keys, SMTP credentials, and OAuth tokens are encrypted using AES-256-CTR.
- Multi-Tenant Logical Isolation: Tenant boundaries are strictly separated through workspace context filters, preventing cross-tenant data leakage.
- Web Application Firewall (SafeLine WAF): Real-time semantic inspection defense against SQL injection, XSS, and automated credential stuffing.
- Automated Backups: Daily encrypted database snapshots stored in geographic redundancy with access restricted to senior site reliability engineers.
5. Protection of Children's Personal Data
Under Section 9 of the DPDP Act 2023 and Article 8 of GDPR:
- SocialShout does not knowingly collect personal data from individuals under 18 years of age (or under the age of consent applicable in your jurisdiction).
- We do not engage in behavioral monitoring, tracking, or targeted advertising directed at children.
- If we learn that personal data of a minor has been collected without verified parental consent, we will take immediate steps to permanently delete the data from our servers.
6. Cross-Border Data Transfers
Personal data processed by SocialShout is hosted in enterprise tier-IV cloud facilities adhering to strict geographic sovereignty standards. In compliance with Section 16 of the DPDP Act 2023, data is transferred only to jurisdictions permitted by the Central Government of India. For users in the European Economic Area (EEA), transfers outside the EEA are governed by Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Data Protection Officer (DPO) & Grievance Redressal
If you have inquiries, complaints, or wish to exercise your statutory rights under the DPDP Act 2023 or GDPR, please contact our designated Grievance & Data Protection Officer:
Compliance & DPO Email: [email protected]
Support Desk: [email protected]
Headquarters: Dashing Webtech, India (MSME Registered Enterprise)
Response SLA: In accordance with DPDP Rule 11 and GDPR Art. 12(3), all verified requests will receive a formal response within 30 days.
If you remain unsatisfied with our grievance resolution, you retain the statutory right to lodge a formal complaint with the Data Protection Board of India (under the DPDP Act 2023) or your competent National Data Protection Supervisory Authority within the European Union (under GDPR Article 77).
8. Legal Jurisdiction & Governing Law
Jurisdiction: All legal disputes and court cases arising out of or in connection with this website shall be subject to the exclusive jurisdiction of the competent courts in Civil Court of Jamshedpur or the High Court of Jharkhand, Ranchi only.
This platform, website, and related digital creator services are owned and operated by SocialShout (A Unit Of Dashing Webtech). All legal matters, interpretations, and proceedings arising under this Compliance Statement, the DPDP Act 2023, GDPR, or related user agreements shall be governed by and construed in accordance with the substantive laws of the Republic of India.