Data protection

The short version

Personal data reaches us through accounts, enquiries, private messages, lead forms, advertising audiences and analytics. Ten controls apply to all of it: documented responsibilities, a data register, notices and consent, restricted access, secure accounts, vetted third parties, your rights, incident reporting, retention with secure deletion, and evidence before anything launches. Each one is set out below, with the product features that back it.

1. Responsibilities and contracts

Before anyone touches personal data, it is written down who is responsible for it.

RWA Global Inc. is the controller for the personal data handled through Y: accounts, enquiries, private messages, lead forms, advertising audiences and identifiable analytics.
Every provider that processes personal data on our behalf signs a Data Processing Agreement under Article 28 GDPR before it gets access. The split of responsibilities between us, the provider and each social platform is documented, and any independent or joint-controller activity is identified separately.
We keep our own obligations as controller in every case; a contract never hands them off.

2. What is collected, and why

A register, not a guess.

We maintain a data register listing each category of personal data, where it comes from, why it is collected, who receives it, where it is stored, how long it is kept and who may access it. The public summary is in the Privacy Policy, sections 2, 5 and 7.
Each activity has a documented lawful basis, and we collect only what the approved purpose needs.
Contact information is never reused for unrelated campaigns or for a provider’s own marketing.

3. Privacy notices and consent

You are told before, and you can change your mind.

Lead forms and other collection points carry an approved privacy notice at the point of collection.
Where consent is the basis, it is recorded and is as easy to withdraw as it was to give (Settings → Notifications for email, Settings → Privacy for the rest).
Non-essential advertising cookies, pixels and similar tracking stay inactive until valid consent exists where ePrivacy rules require it. Today the product sets no advertising cookies at all; the Privacy Policy, section 9, lists the storage it does use.
Following an account or sending an enquiry never enrols you in unrelated marketing.

4. Access and copying

Least privilege, for our team and for anyone working with us.

Access is configured per role: full contact lists, private messages and sensitive records are not visible to anyone who does not need them for their duties. Identity-verification files are served only to the account owner and the Trust Desk.
Bulk exports, downloads and external sharing are off by default wherever the tooling allows. A necessary export needs documented approval, a named recipient and a deletion date.
Personal email, personal storage, address-book syncing and unapproved AI tools are not used for company data. The AI agents in the product only send text you have explicitly asked an agent to work on.
“View-only” is a control, not a guarantee against copying; where a tool cannot prevent copying we say so and apply a compensating control.

5. Secure systems and account control

Individual accounts, strong authentication, logs.

Everyone handling personal data uses an individual account, multifactor authentication where the platform supports it, approved devices, and encryption in transit (TLS with HSTS) and at rest.
RWA Global Inc. keeps administrative ownership and recovery control of its business accounts on every platform.
Security events (sign-ins, failures, password changes) are logged and kept for 180 days. Access is reviewed regularly and revoked promptly when someone’s responsibilities change or an engagement ends.
Confidentiality commitments and data-protection training are required for everyone who handles personal data.
In the product: passwords are stored only as bcrypt hashes, sessions can be reviewed and ended from Settings → Security, and an idle session signs out after 30 minutes.

6. Third parties and international transfers

Every tool, subcontractor and hosting location is disclosed.

The processors that receive personal data from the product are listed by name and purpose in the Privacy Policy, section 5.2: the hosting provider, Resend (email), Stripe (payments), GIPHY (GIF search), Cloudflare (call relay and site analytics), the AI model provider for agents you switch on, and Let’s Encrypt (certificates).
A new subprocessor needs prior written authorisation and equivalent contractual protection before it receives any data.
Any transfer outside the EEA has a documented lawful transfer mechanism (for example Standard Contractual Clauses), with a transfer assessment and supplementary safeguards where required. EU hosting on its own is not treated as sufficient when a third party outside the EEA can reach the data.

7. Your rights

Find, correct, restrict, delete, take with you.

You can export everything we hold about you from Settings → Data (“Export my data”) and delete your account, with its posts and messages, from Settings → Account.
Requests to access, correct, restrict, delete or port data, and objections to direct marketing, go to privacy@safegram.io. Requests received through social channels are forwarded to RWA Global Inc. within two business days and answered within the legal deadline (one month under GDPR, extendable where the law allows).
A direct-marketing objection is acted on promptly and reflected in every campaign system it touches.

8. Incidents

Report fast, preserve evidence, keep people informed.

A suspected or confirmed personal-data breach is reported to RWA Global Inc. without undue delay and no later than 24 hours after discovery. This contractual deadline is separate from, and shorter than, GDPR’s.
The first notification carries the known facts, the data affected, the likely impact, the containment steps taken and a response contact, followed by updates as the picture firms up. Evidence is preserved.
Where the law requires it, the supervisory authority is notified within 72 hours of awareness and affected people are told without undue delay.
Found a vulnerability? Write to security@safegram.io; the Security page explains what to include.

9. Retention and deletion

An agreed schedule, and written confirmation at the end.

Leads, messages, exports, campaign audiences and backups follow an agreed retention schedule. In the product: sessions 30 days (sliding, 90 at most), the email outbox 30 days, security events 180 days, backups 14 days locally, identity-verification data until the account is deleted, everything else while the account exists.
When an engagement ends, personal data is returned or deleted as instructed and the deletion is confirmed in writing.
Anything that must be kept by law, or that sits in a backup awaiting its cycle, is documented, access-restricted and on a defined deletion date.

10. Evidence before launch

Nothing goes live on a promise.

Before access or a campaign is switched on, the following exist and have been reviewed: the signed data-processing terms and responsibility allocation; the data register, access matrix and approved third-party list; the privacy notices, consent arrangements and retention schedule; the incident-reporting and individual-rights procedures.
Test evidence covers permissions, export restrictions, tracking consent, deletion and access revocation, with a documented risk assessment and a data protection impact assessment where one is required.
We support reasonable compliance audits and disclose material changes to tools, access or processing before they are implemented. Launch approval depends on meeting these requirements or agreeing a documented, lawful alternative.

Disclaimer

Y is a social networking platform operated by RWA Global Inc.. It is not a financial institution, broker-dealer, custodian or investment adviser. Nothing on Y, including posts, RWA product pages, airdrops, content rewards and the NFT previews, is an offer, a recommendation or financial, legal or tax advice. Airdrops and rewards are optional incentive programmes that may change, pause or end, may carry eligibility requirements and may have tax consequences where you live.

This page describes the controls we apply; it is not a contract and does not replace the Privacy Policy, the Terms of Service or a signed Data Processing Agreement. Where this page and a signed agreement differ, the agreement applies. Messages are encrypted in transit and access-controlled by account; end-to-end encryption is on the roadmap, not live. No system is immune to every attack, and your own device, password and recovery email matter too.

Contact

Data-protection requests and questions: privacy@safegram.io. Security reports: security@safegram.io. Legal: legal@safegram.io.