Privacy Policy

1.Who we are and what this Policy covers

1.1 Deep Current (the “Service”) is published by Deep Development And Design LLC, a limited liability company organised under the laws of the Commonwealth of Pennsylvania, United States (“Deep Development & Design”, “we”, “us”, “our”).

1.2 This Privacy Policy (the “Policy”) applies to personal data we process through the Service at app.deepcurrentapp.com, through this website at deepcurrentapp.com, and through websites, forms and integrations operated through the Service. It forms part of our Terms of Service. Capitalised terms not defined here have the meaning given in the Terms.

1.3 A plain-English summary of this Policy is published at /privacy-plain. It is provided for convenience only and forms no part of this Policy; this Policy controls in the event of any difference.

2.Definitions

• “Customer” means the business or agency that holds a Deep Current account, and its authorised users.
• “End Customer Data” means information that a visitor or customer of a Customer submits through a website or form operated through the Service, such as an inquiry, order, booking or review.
• “Connected Account” means a third-party account a Customer authorises the Service to access, such as a Google account, YouTube channel, Google Ads account, Facebook Page, Instagram professional account, LinkedIn profile, TikTok account, Pinterest account, QuickBooks Online company or Xero organisation.
• “Google user data” means any data the Service receives from Google APIs, including YouTube API Services, under an authorisation granted by a Google account holder.
• “Access Token” means an access token or refresh token issued by a Platform that allows the Service to act on a Connected Account.
• “Platform” means the operator of a Connected Account, such as Google LLC or Meta Platforms, Inc.
• “Subprocessor” means a third party that processes personal data on our behalf to deliver the Service.

3.Information we collect

3.1 Account information. Name, email address, telephone number, business name, login credentials (passwords are stored only as salted hashes by our authentication provider) and the settings of your account.

3.2 Your Content. Text, images, video, logos, product, pricing and business information that you upload to, create in or publish through the Service, including videos you choose to post to YouTube or other networks.

3.3 End Customer Data. Information your own customers submit through websites and forms operated through the Service. For End Customer Data the Customer is the controller and we act as its processor.

3.4 Connected Account data. When you connect a Connected Account we receive an Access Token and the data described in sections 6 to 8 for that Platform.

3.5 Usage and device information. Which screens and features are used, error reports, and the technical information sent by a browser (IP address, browser type, pages requested and referring page), used as described in section 11.

3.6 Billing information. Plan, invoices and payment status. Card details are collected and held by our payment processor and are not stored by us.

3.7 Communications. Messages you send us, and support and feedback records.

4.How we use information

4.1 We use personal data only to: (a) provide, operate and maintain the Service and the features you choose to use; (b) carry out actions you instruct, such as publishing a post, uploading a video or sending an invoice; (c) secure the Service, prevent abuse and investigate incidents; (d) provide support; (e) bill for the Service; (f) comply with law; and (g) improve the Service, subject always to the stricter limits on Google user data in section 7.

4.2 We do not sell personal data. We do not use personal data, End Customer Data or Connected Account data to build advertising audiences, to serve advertising, or to train artificial-intelligence or machine-learning models.

5.Legal bases for processing

5.1 Where the laws of the European Economic Area, the United Kingdom or Switzerland apply, we process personal data on the following bases: performance of our contract with you (sections 4.1(a), (b), (d) and (e)); our legitimate interests in securing and improving the Service (sections 4.1(c) and (g)); compliance with legal obligations (section 4.1(f)); and your consent, where we ask for it, which you may withdraw at any time.

6.Connected Accounts

6.1 A Connected Account is connected only when a Customer signs in on the Platform's own authorisation page and approves the access shown there. We never receive the password for a Connected Account.

6.2 For social networks (Facebook, Instagram, LinkedIn, TikTok, Pinterest and YouTube) we receive the name, handle and identifier of the account, page, board or channel selected, an Access Token, the identifiers and links of the items we publish, and, where the Customer switches on the relevant feature, performance figures and comments for those items. We use this data solely to publish what the Customer has created or scheduled, and to show the Customer how it performed and the comments it received.

6.3 Data received from a Platform remains subject to that Platform's terms and policies, and we handle it accordingly. When a Connected Account is disconnected we stop receiving data from it.

6.4 TikTok

The Service connects to TikTok through TikTok for Developers' Login Kit and Content Posting API, and requests only the following scopes, only when the Customer chooses to connect a TikTok account:

We publish only content the Customer created or selected and expressly instructed us to post; we never post automatically without that instruction. We do not read the account's other videos, followers, messages or analytics. TikTok data is not sold, not used for advertising, not used to train artificial-intelligence or machine-learning models, and not sent to any artificial-intelligence provider. TikTok Access Tokens are encrypted with AES-256-GCM before storage, are used only by our servers to call TikTok for the Customer's posts, and are never sent to the browser. When the Customer disconnects TikTok from Connections in the Service, the stored Access Tokens and account details are deleted immediately; records of posts already published remain in the Customer's post history until the Customer deletes them or closes its account. A TikTok user may also revoke the Service's access at any time in the TikTok app under Settings and privacy → Security → Apps and services permissions. TikTok's own handling of data is described in the TikTok Privacy Policy.

6.5 LinkedIn

The Service connects to LinkedIn through Sign In with LinkedIn using OpenID Connect, Share on LinkedIn and, where approved by LinkedIn, the Community Management API. It requests only the following permissions, only when the Customer chooses to connect a LinkedIn account:

We publish only content the Customer created or selected and expressly instructed us to post, at the time the Customer chose; we never post automatically without that instruction. We do not read the member's connections, messages, feed, or other members' data, and we do not read a Page's followers or analytics. LinkedIn data is not sold, not used for advertising, not used to train artificial-intelligence or machine-learning models, not sent to any artificial-intelligence provider, and not combined with data from other sources to profile any member. LinkedIn Access Tokens are encrypted with AES-256-GCM before storage, are used only by our servers to call LinkedIn for the Customer's posts, and are never sent to the browser. When the Customer disconnects LinkedIn from Connections in the Service, the stored Access Tokens, member details and Page details are deleted immediately; records of posts already published remain in the Customer's post history until the Customer deletes them or closes its account. A LinkedIn member may also revoke the Service's access at any time in LinkedIn under Settings → Data privacy → Permitted services. LinkedIn's own handling of data is described in the LinkedIn Privacy Policy.

7.Google user data

7.1 Scope of this section. This section governs all Google user data. Where it is stricter than any other part of this Policy, this section controls.

7.2 The Google user data we access

The Service requests Google permissions (OAuth scopes) incrementally: each feature requests only the scopes it needs, and only when the Customer chooses to connect that feature. The data accessed under each scope, and the sole purposes for which it is used, are:

7.3 Limited Use

Deep Current's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Accordingly: (a) we use Google user data only to provide or improve the user-facing features described in section 7.2, which are prominent in the Service's user interface; (b) we transfer Google user data to third parties, namely those listed in section 7.4, only as necessary to provide or improve those features, to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets with notice to users; (c) we do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising; (d) we do not sell Google user data; (e) we do not use Google user data to determine credit-worthiness or for lending purposes; and (f) we do not allow humans to read Google user data unless we have the user's affirmative agreement for specific data, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymised and is used for internal operations in accordance with applicable law.

7.4 Who we share Google user data with

We share, transfer or disclose Google user data only with the recipients listed below, only the data listed against each, and only for the purpose stated. Each service provider processes the data on our behalf under a written contract, may use it only to provide its service to us, and may not use it for its own purposes, for advertising or to train artificial-intelligence models.

We share Google user data with no one else. We do not sell it, rent it or trade it. We do not share it with advertisers, data brokers or any other Customer. Data received through YouTube API Services and Google Calendar event data are not sent to any artificial-intelligence provider, and no Google user data is sent to OpenAI or Perplexity AI. Our other Subprocessors listed in section 10.1 do not receive Google user data.

7.5 Artificial intelligence and Google user data

We do not use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models, and we do not transfer Google user data to any third party that uses it for that purpose. Data received through YouTube API Services is not sent to any artificial-intelligence provider. Where a feature the Customer starts uses artificial intelligence on other Google user data (for example, the Google Ads audit, which sends account figures to Anthropic to produce a written summary for the Customer), the data is sent only through that provider's commercial API under terms that prohibit it from training models on the data, and only to produce the output the Customer requested. Section 7.4 lists exactly which Google user data each AI provider receives, and section 9 lists our AI providers.

7.6 How Google user data is protected

All Google user data is transmitted only over encrypted connections (TLS/HTTPS). Access Tokens for YouTube are encrypted by our application with AES-256-GCM before storage, using a key held only in our server environment, and are never sent to the browser. All other data, including other Google Access Tokens, is stored in our managed database, which is encrypted at rest with AES-256 by our database provider and protected by row-level access rules so that each Customer can reach only its own records. Access Tokens are used only by our servers, only to call Google for the feature the Customer connected. Administrative access to production systems is restricted to the personnel who operate the Service, using individual credentials.

7.7 Retention and deletion of Google user data

We retain Google user data only for as long as the relevant Connected Account remains connected and the data is needed for the feature described in section 7.2. When a Customer disconnects YouTube or any other Google connection from Connections in the Service, the stored Access Tokens and account details for that connection are deleted immediately. Records of posts the Customer published (including the YouTube video ID and link) remain in the Customer's post history until the Customer deletes them or closes its account. Statistics and comments retrieved under section 7.2 are stored only to display them to the Customer, and are deleted on account closure or on request. On account closure, all Google user data is deleted within thirty (30) days, except for residual copies in encrypted backups, which expire on their normal cycle. A Customer may also request deletion at any time as described in section 14.

7.8 Revoking access

A Google account holder may revoke the Service's access at any time at myaccount.google.com/permissions. For YouTube, see also the Google security settings page.

7.9 YouTube API Services

The Service uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

8.QuickBooks Online and Xero

8.1 Access requested. QuickBooks Online: com.intuit.quickbooks.accounting. Xero: accounting.transactions, accounting.contacts, accounting.settings.read, and openid profile email offline_access.

8.2 Data sent. Invoices once sent to the Customer's customer (sent, opened or paid): invoice number, title, dates, line items, discount, tax and notes, and the customer's name, email and telephone number. Drafts are never sent. An invoice cancelled in the Service after being copied is voided in the accounting system.

8.3 Data read. Payment and void status and payment date of copied invoices; products and services and tax codes (QuickBooks) or sales accounts and tax rates (Xero); the company name; and existing customers and invoices, looked up solely to prevent duplicates. We do not read bank accounts, bills, payroll or reports.

8.4 Protection and deletion. Access Tokens are encrypted with AES-256 before storage and are never shown in the browser. On disconnection from Invoices → Accounting sync, the tokens are deleted immediately and we ask Intuit or Xero to revoke them. A sync log and invoice-matching record are kept to prevent duplicate copying if the same books are reconnected, and are deleted on request or on account closure.

9.Artificial intelligence

9.1 Some features of the Service use third-party artificial-intelligence models to produce output the Customer requests, such as drafts, summaries and images. We call these providers directly through their commercial application programming interfaces; we do not use an aggregator or gateway. The providers are:

• Anthropic, PBC (Claude models, api.anthropic.com) — writing, analysis, the phone receptionist and audits;
• Google LLC (Gemini API, generativelanguage.googleapis.com, on a paid billing account) — images, music and some text;
• OpenAI, L.L.C. (api.openai.com) and Perplexity AI, Inc. (api.perplexity.ai) — used only by the AI-search visibility check, which sends a public search question (for example, “best roofer in Pittsburgh”) to see whether the Customer's business is named in the answer.

9.2 Under each provider's commercial API terms, data sent through the API is not used to train the provider's models. We do not opt in to any programme that would permit such training.

9.3 Google user data is sent to an AI provider only as described in sections 7.4 and 7.5.

10.How we share information

10.1 Subprocessors. We share personal data with Subprocessors only as needed to deliver the Service, under contracts that require them to protect it: Supabase (database, authentication and file storage); Fly.io (application hosting); Vercel (website hosting); Cloudflare (domain name services); Mailgun and Amazon Web Services (email delivery); Stripe (payments); Twilio (text messages and telephone calls); DataForSEO (search-ranking data); and the artificial-intelligence providers in section 9. Google user data is shared only with the recipients listed in section 7.4.

10.2 Platforms. We send to a Platform the content and instructions the Customer directs, such as a video to be uploaded to YouTube.

10.3 Within an account. A Customer's data is visible to the Customer's own authorised users and, for an agency Customer, to the agency and the End Client it serves. It is never shared with other Customers.

10.4 Legal and business transfers. We may disclose information where required by law or to protect the rights, property or safety of any person, and as part of a merger, acquisition or sale of assets, in which case the recipient will be bound by this Policy, including section 7.

10.5 No sale. We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.

11.Cookies and similar technologies

11.1 This website does not use Google Analytics, advertising pixels or advertising cookies, and serves its fonts and code from its own domain.

11.2 We count visits with our own first-party script. It records the page opened, the referring website and any campaign tags in the link. To count unique visitors, the IP address and browser type are converted into a one-way code that changes daily; the IP address itself is not retained. The script stores your answer to the cookie notice in a first-party cookie and local storage and, unless you decline, a random visitor identifier used to associate a later inquiry with the visit. The Service uses strictly necessary storage to keep you signed in.

12.Security

12.1 We maintain technical and organisational measures appropriate to the risk, including encryption in transit (TLS) for all traffic, encryption at rest for our database and file storage, application-level encryption of social-network and accounting Access Tokens, row-level access controls separating each Customer's data, server-side-only use of Access Tokens, and restriction of administrative access to the personnel who operate the Service.

12.2 No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you and the relevant authorities as required by law.

13.Retention

13.1 We retain personal data for as long as the account is active and as needed to provide the Service. Connected Account data is retained as described in sections 7.7 and 8.4. After account closure we delete personal data within thirty (30) days, except billing records we must keep by law and residual copies in encrypted backups, which expire on their normal cycle.

14.Deletion

14.1 Disconnecting a Connected Account deletes its stored Access Tokens and account details immediately. To delete an entire account or specific data, follow the steps on our data deletion page or contact us under section 19. We will complete the request within thirty (30) days and usually the same day.

15.Your rights

15.1 Subject to applicable law, you may request access to, correction of, deletion of, or a portable copy of your personal data, object to or restrict its processing, and withdraw consent. Residents of California, Colorado, Connecticut, Virginia, Utah and other US states have these rights by statute, together with the right to opt out of the sale of personal data and its use for targeted advertising; we do neither. Residents of the EEA, UK and Switzerland may also complain to their data-protection authority.

15.2 We will verify your identity before acting on a request, respond within forty-five (45) days, and not discriminate against you for exercising your rights. You may make a request through an authorised agent. Where we process End Customer Data as a processor, we will refer the request to, or assist, the Customer that controls it.

16.International transfers

16.1 We are based in the United States and our Subprocessors store data principally in the United States. Where personal data is transferred from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses offered by our Subprocessors.

17.Children

17.1 The Service is intended for businesses and for users aged 18 or over. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

18.Changes to this Policy

18.1 We may update this Policy. We will post the updated Policy here with a new “Last updated” date and, for material changes, notify Customers by email or in the Service before the change takes effect. We will not use Google user data in a manner materially different from that described here without first obtaining the user's consent.

19.How to contact us

Deep Development And Design LLC — Pennsylvania, United States

Email: Joey@deepdevelopmentanddesign.com
Telephone: (724) 520-3337

For a request to delete your data, see our data deletion page.