Privacy Policy

Effective date: September 18, 2026
Last updated: September 18, 2026

This Privacy Policy explains how BJ JQZ Tech Co., LTD. ("MeDash," "we," "us," or "our") collects, uses, discloses, stores, and deletes information when you use the MeDash website, applications, and social media management services (collectively, the "Services"). It also explains how MeDash handles information received from Google APIs, including Google Sign-In, Google Drive, YouTube, and Google Business Profile.

By using the Services, you acknowledge the practices described in this Privacy Policy. If you do not agree, do not use the Services or connect a third-party account.

1. Information We Collect

1.1 Account and profile information

When you create or administer a MeDash account, we may collect your name, username, email address, password hash, profile image, language, time zone, workspace and team membership, role, permissions, plan, and account preferences. If you use Google Sign-In, we receive the basic identity information that you authorize Google to provide, such as your Google account identifier, name, email address, and profile image. We do not receive your Google password.

1.2 Billing and transaction information

If you purchase a subscription or credit package, we process plan, payment status, transaction, billing, tax, and related support information. Payment card details are generally processed by our payment service providers and are not stored in full by MeDash.

1.3 Content and service activity

We process content and instructions that you submit through the Services, including posts, captions, media, drafts, schedules, comments, replies, direct messages where supported, internal notes, approval activity, automation settings, and publishing history. We also process actions taken by authorized workspace users, such as publishing, replying, hiding, restoring, or deleting supported content.

1.4 Connected-platform information

When you connect a third-party platform, we receive OAuth access and refresh tokens and the platform data necessary to provide the features you select. Depending on the platform and permissions you grant, this may include account or Page identifiers, profile and channel metadata, media, posts, comments, messages, audience and engagement metrics, and publishing results. We do not use connected-platform data for purposes unrelated to the Services you request.

1.5 Device, log, and support information

We may collect IP address, browser and device type, operating system, timestamps, referring pages, session and cookie identifiers, error logs, security events, feature usage, and diagnostic information. When you contact support, we collect your contact details, correspondence, attachments, and the information needed to investigate your request.

2. Google API Data

MeDash accesses Google user data only after you initiate a connection and grant consent through Google's authorization screen. The exact permissions requested are displayed during authorization. You may decline or revoke access at any time, although the related feature will then stop working.

2.1 Google Sign-In

Google Sign-In is used to authenticate you and create or link your MeDash account. We use the authorized basic profile and email information to identify your account, prevent duplicate accounts, and support account security. Google Sign-In authorization is separate from authorization for Google Drive, YouTube, and Google Business Profile.

2.2 Google Drive

When you choose Google Drive as a source or destination, MeDash uses the https://www.googleapis.com/auth/drive.file permission. This permission allows MeDash to access only files that you select through the Google Picker or files that MeDash creates or opens with your authorization. MeDash does not use this permission to browse or read all files in your Google Drive.

We use selected Drive files only to perform the action you request, such as importing media into the MeDash file manager or using selected media in a post. We may store file identifiers, names, MIME types, sizes, thumbnails, and a service copy when needed to complete that action. MeDash does not modify or delete an original Drive file unless you explicitly request a supported operation and Google authorizes it.

2.3 YouTube

When you connect a YouTube channel, MeDash may request the following permissions: https://www.googleapis.com/auth/youtube, https://www.googleapis.com/auth/youtube.force-ssl, https://www.googleapis.com/auth/yt-analytics.readonly, and https://www.googleapis.com/auth/userinfo.email.

With your authorization, MeDash may process your channel identifier and metadata, videos and publishing status, playlists where needed for publishing, comments and comment threads, replies, public commenter information associated with those comments, and channel or video analytics. This data is used to connect and display your channel, publish content you submit, show performance analytics, and provide a centralized YouTube comment Inbox.

MeDash sends a reply, hides or restores a comment, or deletes a comment only after an authorized user makes that specific request in the interface. These actions may affect content on YouTube and may not be reversible. MeDash does not post unsolicited comments or use YouTube data for advertising profiles.

2.4 Google Business Profile

When you connect Google Business Profile, MeDash may request https://www.googleapis.com/auth/business.manage, https://www.googleapis.com/auth/userinfo.email, and openid. MeDash currently uses this access to list the business accounts and locations you are authorized to manage, connect the location you select, and create or manage Local Posts at your explicit direction. We may process account and location identifiers, location names and metadata, authorization tokens, Local Post content, and publishing results for these purposes.

If MeDash later introduces Google Business Profile review management, review replies, messaging, or additional analytics, we will enable those capabilities only after implementing the required Google APIs and controls, updating our disclosures where necessary, and requesting any additional authorization required before processing that data.

2.5 Google API Limited Use disclosure

MeDash's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, MeDash:

• uses Google user data only to provide or improve user-facing features that are visible and relevant to the requesting user;
• does not sell Google user data;
• does not use Google user data for personalized or interest-based advertising;
• does not transfer Google user data to advertising platforms, data brokers, or information resellers;
• does not allow humans to read Google user data unless we first obtain the user's affirmative agreement for a specific item, it is necessary for security or abuse investigation, it is required by applicable law, or the data is aggregated and anonymized for internal operations; and
• limits transfers to service providers acting on our behalf under appropriate confidentiality and data-protection obligations, or to transfers the user explicitly initiates.

Your use of YouTube features is also subject to the YouTube Terms of Service and the Google Privacy Policy.

3. How We Use Information

We use information to:

• create, authenticate, secure, and administer accounts and workspaces;
• connect accounts selected by authorized users and maintain OAuth sessions;
• publish and schedule content and carry out user-requested moderation actions;
• display comments, messages, notifications, publishing status, and analytics;
• provide file management, collaboration, approvals, automation, and support;
• process subscriptions, enforce plan limits, and maintain transaction records;
• detect fraud, abuse, unauthorized access, and technical failures;
• measure and improve the reliability, security, and usability of the Services; and
• comply with legal obligations and enforce our Terms of Service.

4. Legal Bases

Where applicable law requires a legal basis, we process information as necessary to perform our contract with you, based on your consent (including OAuth authorization), for our legitimate interests in operating and securing the Services, and to comply with law. You may withdraw consent by disconnecting an integration or revoking authorization, without affecting processing already lawfully completed.

5. How We Disclose Information

We may disclose information:

• to workspace owners, administrators, and team members according to configured roles and permissions;
• to the third-party platform when you direct MeDash to publish, reply, moderate, or otherwise perform an action;
• to hosting, storage, email, security, analytics, support, and payment providers that process data for us under contract;
• in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards; or
• when reasonably necessary to comply with law, protect rights and safety, prevent abuse, or respond to lawful process.

We do not sell personal information or Google user data.

6. Storage, Security, and International Transfers

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, transport encryption, credential protection, logging, and restricted production access. No service can guarantee absolute security, and users remain responsible for protecting their credentials and team permissions.

MeDash and its service providers may process information in countries or regions other than where you live. Where required, we use appropriate contractual or legal safeguards for cross-border transfers.

7. Retention and Deletion

We retain account and connected-platform information only for as long as needed to provide the Services, comply with law, resolve disputes, maintain security, and enforce agreements. While an integration remains active, synchronized data is retained as needed for the enabled feature.

When you disconnect a Google integration, revoke Google access, or delete your MeDash account, MeDash will remove the affected OAuth tokens and synchronized Google user data from active systems within seven days, except information that must be retained for legal, security, fraud-prevention, or transaction-record obligations. Residual encrypted backup copies are isolated from ordinary use and expire through our rolling backup cycle within 30 days. Information retained for a legal exception is minimized, access-restricted, and deleted when the obligation ends.

You can request deletion in any of these ways:

• remove the connected account from the MeDash Channels page;
• revoke MeDash through Google Account third-party connections;
• use the account deletion control in MeDash account settings; or
• email support@medash.net from the address associated with your account.

Revoking access stops future API access but does not undo actions already completed on a third-party platform, such as a published post, sent reply, or deleted comment. You may also need to manage that content directly on the third-party platform.

8. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, receive a portable copy, or withdraw consent. You may update many account details within MeDash and manage connected services from the Channels page. To make another request, contact support@medash.net. We may verify your identity before completing a request.

You may control cookies through your browser. Disabling essential cookies may prevent authentication or other Services from working.

9. Children's Privacy

The Services are intended for businesses and users who are at least 18 years old or the age of legal majority in their jurisdiction. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us so we can investigate and delete it where required.

10. Third-Party Services

Third-party platforms operate under their own terms and privacy policies. MeDash is not responsible for their independent practices, availability, API changes, or decisions. You should review the policies of each service before connecting it.

11. Changes to This Policy

We may update this Privacy Policy to reflect product, legal, or security changes. We will post the revised version with a new "Last updated" date and provide additional notice when required. If a change materially affects how previously authorized Google user data is used, we will provide appropriate notice and obtain additional consent where required before applying the new use.

12. Contact Us

BJ JQZ Tech Co., LTD. is the operator of MeDash. For privacy questions, rights requests, or data deletion requests, contact:

BJ JQZ Tech Co., LTD.
Email: support@medash.net
Website: https://medash.net