Duma · An Auxo Digital product
Privacy Policy
Last updated: 20 October 2026
Duma is a marketing platform operated by Auxo Digital (Pty) Ltd, a company registered in South Africa (“we”). Teams use it to plan campaigns, write and schedule posts, publish them to the social and Google accounts they connect, and see the results in one report. This policy explains what personal information Duma collects, how it is used, and the choices you have. It adds to the Auxo Digital privacy notice, which covers all our products; where the two differ for Duma, this policy applies. Questions: hello@auxodigital.africa.
What we store
- Your account. Your name and email address, from Auxo ID (our sign-in service). We do not store passwords in plain text.
- Your workspace content. The content you create in Duma: workspaces, strategy maps, campaigns, posts, media you upload, approvals, notes and metrics. This is your working data and belongs to you.
- Connected accounts. When you connect a network (for example LinkedIn, TikTok, YouTube or Google), we store the access tokens needed to act for you, the account names and IDs you picked, and the numbers we fetch for Reports. Tokens are encrypted at rest and used only for the actions you ask for. Google data is covered in detail below.
This data is stored in our backend database (Convex) and file storage. We do not build advertising profiles from your data.
How we use your data
We use your data only to provide Duma: to sign you in, to store and show the content you create, to schedule and publish posts to the accounts you connect, to show your results in Reports, and to keep the product working and secure. We do not use your content for any purpose you have not asked for.
Google user data
Connecting Google is optional. A workspace member who manages channels can connect YouTube (Channels → Connect YouTube) and Google Business Profile, Search Console, Google Analytics and Google Ads (Channels → Connect Google, then Ads → Google). Google shows you the exact permissions before you agree. Duma asks only for the permissions below and uses each one only for what is listed.
YouTube youtube.upload
What Duma does: Uploads the videos you schedule in Duma to your channel, with the title, description, privacy setting and thumbnail you chose.
What we keep: The video ID and link Google returns, so the post shows as published.
YouTube youtube.readonly
What Duma does: Reads your channel's name and ID when you connect, the processing status of videos Duma uploaded, view/like/comment counts and subscriber count, and your list of uploads so you can bring past videos into Reports.
What we keep: Channel name and ID, video IDs, titles, links and the counts.
YouTube yt-analytics.readonly
What Duma does: Reads watch time, shares and subscribers gained for your channel and its videos for Reports.
What we keep: Daily totals per channel and video.
Google Business Profile business.manage
What Duma does: Lists the Business Profile locations you manage so you can pick which to connect, posts the “What’s new” updates you write in Duma, and reads views, calls, website clicks, direction requests and review count/rating for Reports.
What we keep: Location names and IDs, the IDs of posts Duma published, and the numbers.
Google Search Console webmasters.readonly
What Duma does: Lists your Search Console properties so you can pick one, then reads clicks, impressions, click-through rate, average position, top search queries and top pages for Reports. Read-only.
What we keep: The property you picked and the report numbers.
Google Analytics analytics.readonly
What Duma does: Lists your Google Analytics 4 properties so you can pick one, then reads sessions, users and top traffic sources for Reports. Read-only.
What we keep: The property you picked and the report numbers.
Google Ads adwords
What Duma does: Lists the Ads accounts you can access, reads campaign performance (impressions, clicks, cost, conversions) for Reports, and makes the changes you ask for in Duma: pause or enable a campaign, change its budget, or create a campaign from a launch pack you approved. Duma never changes your Ads account on its own.
What we keep: Account and campaign IDs and names, daily performance numbers, and a log of the changes you made through Duma.
How we protect and share it
- Google access and refresh tokens are encrypted at rest and are never shown in the app, in logs or to other workspaces.
- Google data is shown only to members of the workspace that connected it.
- We do not sell Google data, use it for advertising, or use it to build user profiles. We do not use it to train or improve AI or machine-learning models, ours or anyone else's: YouTube and Business Profile numbers are left out of Duma's optional Own model, its forecasts and benchmarks, and the posts the AI learns your writing voice from.
- We share it only with the providers that host Duma (Convex for the database, Vercel for the website), under contract and only to run the service; and, if you connect your own AI assistant to Duma (Auxo Connect), with that assistant. Duma sends data to your assistant only when you ask; that assistant's own terms then apply.
- Feedback you send with the in-app feedback widget, including any screenshot you attach, goes to our support tool and is used only to handle it. The widget is switched off on Reports, Ads, Channels and campaign pages, where Google numbers are shown.
- Our staff do not read your Google data, except with your permission to help with a support request, when needed for security (for example investigating abuse), or when the law requires it.
Limited Use
Duma's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it, and how to delete it
- Report numbers from Search Console, Google Analytics and Business Profile are cached for up to 7 days; a daily clean-up deletes anything older, and Reports fetches fresh numbers when you open it.
- YouTube numbers are kept while the channel stays connected and Duma can still access it (it checks every day). When you remove the channel in Duma we delete its YouTube data within 7 days; if you revoke access at Google we delete it, and the channel, within 30 days. The channel name is re-read from YouTube every day, and posts imported from YouTube (title, description, thumbnail) are deleted if they haven't been re-read from YouTube for 30 days.
- Google Ads numbers stay with your workspace's reports until you ask us to delete them.
- Disconnect in Duma: Channels → Disconnect Google immediately deletes the Google access tokens, the chosen Search Console and Analytics properties, every connected Business Profile location (with its own tokens and numbers) and the cached report numbers. Google Ads accounts linked on the Ads page stay listed with their numbers but can no longer be reached. Removing a YouTube channel from Channels deletes its tokens at once and, within 7 days, its numbers, the posts imported from YouTube and the YouTube links on posts you published through Duma.
- Revoke at Google: you can revoke Duma's access to your data via the Google security settings page at https://security.google.com/settings/security/permissions (also reachable at myaccount.google.com/permissions). Duma then can no longer reach your Google accounts.
- Posts and videos already published stay on YouTube or your Business Profile, because they are yours; delete them there if you want them gone.
- To have us delete all Google and YouTube data we hold for you, email hello@auxodigital.africa. We do it within 7 days.
YouTube features use YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.
We do not sell your data
We do not sell, rent, or trade your personal information. We share data only with the infrastructure providers that run the service (such as our hosting and database providers), and with the networks you choose to connect and publish to.
Your rights (POPIA)
Duma is operated from South Africa and we process personal information in line with the Protection of Personal Information Act, 2013 (POPIA). You can ask to see the personal information we hold about you, have it corrected, or have it deleted. To do any of these, or to close your account and have its data removed, email hello@auxodigital.africa. You can also complain to the Information Regulator (inforegulator.org.za).
Data retention
We keep your data while your account is active. When you ask us to delete your account, we remove your personal information and content within 30 days (Google and YouTube data within 7 days), except records the law requires us to keep.
Changes to this policy
If we make material changes we will update the date at the top of this page. We will not use Google data in a new way without asking for your consent first.
Contact
Auxo Digital (Pty) Ltd, South Africa. Questions about this policy or your data: hello@auxodigital.africa.