Privacy Policy

@-Social™ | at-social.com

Effective Date: August 15, 2026

Last Updated: August 18, 2026

@-Social™ is operated by Seranya Beck (operating name; full legal name held privately) ("we," "us," or "our"), a sole proprietor based in the Greater Toronto Area, Ontario, Canada. This Privacy Policy explains what personal information we collect when you use @-Social (the "Platform," at at-social.com), how we use it, and what rights you have over it. It also covers at-social.social, our separate promotional site (see our Terms of Service, Section 2, for how the two sites relate); Section 1.4 below describes the limited information that site collects.

We are committed to complying with Canada's *Personal Information Protection and Electronic Documents Act* (PIPEDA) and applicable Ontario privacy law. If you have questions, contact us at legal@at-social.com.

1. Information We Collect

We collect only the information necessary to operate the Platform.

1.1 Information you give us directly

• Account information: Registration is still being built and is not yet live on the Platform. Once available, this will include your name, username, and email address when you register.
• Profile information: Any bio, profile photo, or other details you choose to add to your profile.
• Content you post: Text, images, artwork, audio, and any other content you upload or publish on the Platform.
• Messages: Direct communications you send to other users through the Platform (where that feature is available).
• Payment information: If you purchase a product through a creator's DOTfront, payment is intended to move directly between you, the creator, and (where applicable) a DOT-filiate through Stripe Connect. We do not receive, hold, or store your full payment card details, and we do not hold or transmit the funds themselves; Stripe handles payment directly under its own privacy policy.
• Communications with us: Emails or messages you send to our support or legal address.

1.2 Information collected automatically

When you use the Platform, we automatically collect certain technical data:

• Usage data: Pages viewed, features used, time spent on the Platform, referring URLs.
• Device and browser data: Device type, operating system, browser type and version, screen resolution.
• IP address and approximate location: Used to detect fraud and comply with legal obligations. We do not track your precise physical location.
• Cookies and similar technologies: See our Cookie Policy for details.
• DOT-filiate referral visits: If you land on a creator's product through a DOT-filiate referral link, we briefly log the product, the referral link used, your IP address, and your browser's user agent string. This is used solely to verify that a genuine visit occurred before crediting a referral, and to support the commission clawback described in our Terms of Service if the purchase is later refunded or charged back — not for marketing, advertising, or profiling. We do not currently delete this data automatically; we are implementing an automated retention limit targeting 90 days from the visit.
• Digital delivery records: Digital files you purchase are individually generated for you at the time of delivery, and we keep a record connecting each delivered file to its purchase — part of how we protect creators' work.

1.3 Information we do not collect

We do not collect your Social Insurance Number, government-issued identification, financial account details, or sensitive health information.

1.4 Information collected on at-social.social (our promotional site)

at-social.social is a separate, standalone site from the Platform. It does not use cookies, local storage, session storage, or any analytics, advertising, or tracking scripts — nothing on that site tracks your visit.

• Platform-fee calculator. Any numbers you enter into the calculator are processed entirely in your browser. They are never transmitted to us or to anyone else, logged, or stored.
• Email signup. If you voluntarily submit the email signup form, we collect only the email address you provide, which is sent to our email service provider, Kit, to manage our mailing list. No other information (name, metadata, or otherwise) is collected through that form.
• Server logs. As with any website, our hosting provider (Netlify) automatically generates standard web server logs that include visitor IP addresses. This is routine infrastructure logging, not something we use to track or profile individual visitors.

2. How We Use Your Information

We use the information we collect for the following purposes, each of which we consider a legitimate basis under PIPEDA:

We do not use your personal information for targeted advertising. We do not build advertising profiles from your data.

3. How We Share Your Information

We do not sell your personal information. We share it only in the following circumstances:

3.1 Service providers. We share data with third-party service providers who help us operate the Platform. These providers are contractually required to protect your data and use it only as directed by us. Current providers include:

• Netlify (website hosting): hosts the at-social.social promotional site (the fee calculator). Netlify does not host the Platform (at-social.com).
• Vercel (application infrastructure): intended to host the Platform (at-social.com). As of this writing, at-social.com is not yet pointed to a live deployment.
• Render (backend services): hosts our backend infrastructure.
• Stripe (payment processing, via Stripe Connect): processes payment directly between buyers, creators, and (where applicable) DOT-filiates. @-Social does not hold or transmit these funds. Stripe's privacy practices are governed by its own privacy policy.
• Kit (email marketing): manages the mailing list for the at-social.social email signup form. Kit's privacy practices are governed by its own privacy policy.

3.2 Creators, in the context of transactions. If you purchase a product from a creator's DOTfront, we share the transaction details necessary to fulfill the order with that creator.

3.3 DOT-filiates, in the context of referrals. If you make a purchase through a DOT-filiate referral link, we share the fact that a qualifying transaction occurred with the referring DOT-filiate, so their commission (set by the creator, if any) can be calculated. We do not share your identity, contact information, or full purchase details with the DOT-filiate beyond what is needed for that calculation.

3.4 Other users, based on your settings. Content you post publicly on the Platform is visible to other users. Your profile information is visible according to the settings you choose.

3.5 Legal requirements. We may disclose your information if required to do so by law or in response to a valid court order, subpoena, or government request from Canadian authorities. We will notify you when legally permitted to do so.

3.6 Protection of rights. We may disclose information when we believe in good faith that it is necessary to prevent harm to any person, protect our legal rights, or investigate a violation of our Terms of Service.

3.7 Business transitions. If @-Social is acquired, merged, or its assets are transferred, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

4. Data Retention

We keep your personal information for as long as your account is active or as long as necessary to provide the Platform to you. When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required by law to retain it longer (for example, records related to financial transactions, which we may retain for up to 7 years under Canadian tax law).

Content you posted that other users have already interacted with (such as comments or shares) may not be fully removable from those interactions after deletion.

5. Your Privacy Rights Under PIPEDA

Under PIPEDA, you have the right to:

5.1 Access. Request a copy of the personal information we hold about you.

5.2 Correction. Ask us to correct inaccurate or incomplete information about you.

5.3 Withdrawal of consent. Withdraw consent to our use of your information where we rely on consent as the basis for processing, subject to legal and contractual restrictions. Note that withdrawing consent may affect our ability to provide the Platform to you.

5.4 Deletion. Request deletion of your account and associated personal information. Submit deletion requests to legal@at-social.com.

5.5 Complaint. Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca if you believe we have not handled your information in accordance with PIPEDA.

To exercise any of these rights, email us at legal@at-social.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

6. Security

We use reasonable technical and organizational measures to protect your personal information against unauthorized access, disclosure, or destruction. These include encrypted connections (HTTPS), access controls, and secure hosting infrastructure.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security. If we become aware of a data breach that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required under PIPEDA.

7. Cookies

We use cookies and similar tracking technologies on the Platform. For full details, including how to control cookies, see our Cookie Policy.

8. Children's Privacy

@-Social is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact us at legal@at-social.com and we will delete it.

Users between 13 and 18 may use the Platform with parental or guardian consent.

9. International Users, and Your Rights Under GDPR and CCPA

@-Social is operated from Canada, but we know our audience is global — including a meaningful number of users in the United States, the United Kingdom, and the European Union. This section explains cross-border data transfers, and describes additional rights available to you if you're located in the EU, the UK, or California.

9.1 Cross-border data transfers

If you access the Platform from outside Canada, your information will be transferred to and processed in Canada, and, through the service providers listed in Section 3.1, in the United States. By using the Platform, you consent to this transfer. Where we transfer personal information out of the European Economic Area or United Kingdom, we work with our service providers to put appropriate safeguards in place, such as standard contractual clauses, as required by applicable law. We apply the protections described in this Privacy Policy regardless of where you are located.

9.2 Your rights under the GDPR (EU and UK residents)

If you are located in the European Economic Area or the United Kingdom, the GDPR (and UK GDPR) give you the following rights, in addition to those described in Section 5 above:

• Access, rectification, and erasure. Request a copy of your personal information, ask us to correct it, or ask us to delete it ("right to be forgotten"), subject to legal exceptions.
• Restriction and objection. Ask us to restrict our processing of your information, or object to processing we carry out on the basis of legitimate interest, including profiling (we don't currently build advertising profiles, per Section 2, but this right applies to any processing on that basis).
• Data portability. Request your information in a structured, commonly used, machine-readable format, where technically feasible.
• Withdraw consent. Where we rely on your consent (for example, the at-social.social email signup), withdraw it at any time — this won't affect the lawfulness of anything we did before you withdrew it.
• Lodge a complaint. Contact your local data protection authority, or the UK's Information Commissioner's Office (ico.org.uk), if you believe we haven't handled your information properly.

The purposes and legal bases listed in the Section 2 table above (performance of our agreement with you, legitimate interest, legal obligation, and — for the at-social.social email signup — your consent) also serve as our Article 6 GDPR legal bases for processing.

To exercise any of these rights, email us at legal@at-social.com.

9.3 Your rights under the CCPA/CPRA (California residents)

If you are a California resident, we extend the following rights to you, consistent with the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to know. What personal information we collect, use, and disclose about you. The categories we collect are described in Section 1 above, and generally fall under "identifiers" (such as email address and IP address), "internet or network activity" (such as usage and device data), and "commercial information" (such as digital delivery and DOT-filiate referral records).
• Right to delete. Request deletion of personal information we've collected from you, subject to certain legal exceptions.
• Right to correct. Ask us to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share your personal information, as those terms are defined under the CCPA, and have not done so in the preceding 12 months — so there is nothing to opt out of today.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information as defined under the CCPA (for example, precise geolocation, government IDs, or financial account details — see Section 1.3).
• Right to non-discrimination. We will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised any of these rights.

To exercise any of these rights, email us at legal@at-social.com. We will respond within 45 days, which we may extend once by another 45 days if reasonably necessary, with notice to you.

10. Third-Party Links and Services

The Platform may include links to third-party services, such as Stripe for payment processing. Those services have their own privacy policies. We are not responsible for their practices. We encourage you to review the privacy policy of any third-party service you use.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy here and revise the "Last Updated" date. If changes materially affect your rights, we will notify you by email or by a prominent notice on the Platform. Your continued use of the Platform after changes take effect constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at:

legal@at-social.com

@-Social is operated by Seranya Beck (operating name; full legal name held privately), Greater Toronto Area, Ontario, Canada.

You may also contact the Office of the Privacy Commissioner of Canada:

30 Victoria Street, Gatineau, Quebec K1A 1H3

Toll-free: 1-800-282-1376

priv.gc.ca