Privacy Policy

2.1 Information We Collect

Account Information

• Name and email address provided at registration
• User role (Company, Creator, or Voter)
• Account verification status (verified or unverified)
• Credit balance and transaction history

Voter Profile Information (Verified Voters Only)

• Anonymous UUID-based voter ID (generated upon verification — not linked to personal identity in the vote data model)
• Self-reported demographic attributes: age bracket, gender, country, city
• Verification status (boolean: verified true/false)
• dvtd does NOT store government-issued ID images, biometric data, full name, date of birth, or any document-level personal information. Identity verification is conducted entirely by our third-party provider. We receive only a verification confirmation token.

Poll and Voting Data

• Polls created by your account (question, options, filters, status)
• Polls you have voted on (recorded against your anonymous voter ID only — not your personal identity)
• Credits earned through voting

Payment Information

• Credit purchases are processed by Stripe. dvtd does not store your card number, CVV, or banking details. Stripe provides dvtd with a transaction confirmation and customer ID only. Stripe's privacy policy governs the handling of your payment data.

Technical and Usage Data

• IP address and approximate location (for geographic eligibility enforcement and security purposes)
• Browser type and device information
• Pages visited, features used, and interaction data collected via Vercel Analytics
• Advertising interaction data collected via Meta Pixel (Facebook/Instagram) and X Pixel (Twitter/X), subject to your cookie consent choices

2.2 Identity Verification — Third-Party Processing

Government ID verification and liveness checks are conducted by our third-party provider (Persona Technologies Inc. or Stripe Identity). These providers collect and process your government ID document and facial image directly. dvtd does not receive or store these materials. The provider's processing of your biometric and identity data is governed by their own privacy policy. We strongly encourage you to review your verification provider's privacy policy before completing verification.

dvtd receives only: (a) a confirmation that verification was passed or failed, and (b) a non-PII verification token stored in our database.

2.3 How We Use Your Information

• To create and manage your account and authenticate your identity
• To enforce poll eligibility criteria (geographic and demographic filters set by poll creators)
• To process credit purchases and maintain your credit ledger
• To deliver transactional emails (verification status, purchase receipts, poll alerts you have opted in to)
• To detect, investigate, and prevent fraud, abuse, and violations of our Terms
• To improve and develop the Platform's features and user experience
• To measure advertising campaign effectiveness (via pixel data, subject to your consent)
• To comply with legal obligations

2.4 Cross-Border Data Transfers

dvtd uses third-party service providers that are based in the United States, including Supabase (database infrastructure), Vercel (hosting), Stripe (payments), Persona or Stripe Identity (verification), and Resend (transactional email). Your data may be transferred to and processed in the United States. We take reasonable steps to ensure these providers maintain appropriate data protection standards. Where required by GDPR, we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

2.5 Data Sharing

• dvtd does not sell, rent, or trade your personal data.
• We share data with service providers strictly for the purpose of operating the Platform (Supabase, Vercel, Stripe, Persona/Stripe Identity, Resend). These providers are contractually prohibited from using your data for their own purposes.
• We may disclose data if required by law, court order, or to protect the rights, property, or safety of dvtd, its users, or the public.
• Aggregated, anonymized poll result data (containing no personal information) may be shared publicly or with third parties for research and reporting purposes.

2.6 Data Retention

• Account data is retained for as long as your account is active and for a reasonable period thereafter to resolve disputes and enforce agreements.
• Vote records are retained indefinitely. They are immutable by design and cannot be deleted. However, vote records contain only your anonymous voter ID — not your personal identity.
• Verification tokens are retained only as long as necessary to maintain your verified status.
• Payment records are retained as required by Canadian tax and financial recordkeeping laws (minimum 7 years).
• If you close your account, your personal account data will be deleted within 90 days, subject to legal retention requirements. Your anonymized vote record cannot be deleted.

2.7 Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you are under 18, do not use the Platform. If we become aware that we have collected personal data from a minor, we will take steps to delete that information promptly.

2.8 Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that inaccurate data be corrected
• Deletion: Request deletion of your personal data (subject to immutability constraints on vote records)
• Portability: Request your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Opt-out of sale (CCPA): dvtd does not sell personal data

To exercise any of these rights, contact us at hello@dvtd.app. We will respond within 30 days. We may require identity verification before processing your request.

2.9 Security

dvtd implements reasonable technical and organizational security measures to protect your data, including encrypted data transmission (SSL/TLS), Row-Level Security policies on our database, restricted administrative access, and Stripe webhook signature verification. No system is completely secure; we cannot guarantee absolute security.

2.10 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or a notice on the Platform. Your continued use of the Platform after the effective date of changes constitutes acceptance.

2.11 Contact