Privacy Policy · DSP Cafe

1. Information We Collect

Account and Identity

Email address — collected at signup and stored in our authentication system
Password — hashed using industry-standard encryption; never readable by us
Full name — collected during onboarding
Username — chosen by you; must be unique; change history is logged for abuse prevention
Display name preference — whether your username or real name appears publicly

Professional Information

Your role (for example Professional DSP, Family DSP, student, agency staff, family member, or advocate)
Agency or employer name
Years of experience
Zip code — optional, and only if you choose to add it (see Your zip code below)

Profile Content

Bio — free-text field authored by you
Interests — selected from a predefined list at onboarding
Profile photo / avatar — uploaded and stored in our file storage system
Privacy settings — per-field toggles controlling what appears on your public profile

Verification Data

Verification status and method used (agency email, invite code, ID badge, LinkedIn, or member vouch)
Agency email domain (if verified via work email)
Invite or access code used at signup
Work ID badge photo — uploaded to a private, admin-only storage bucket
LinkedIn profile URL — submitted voluntarily for manual review
Rejection reason — if a verification submission was denied

Community Activity

Posts, replies, and video comments you create, including text, timestamps, and whether you edited them
Photos you attach to posts and replies (see Photos below)
"Helpful" votes you give on posts and replies, and likes on videos
Community table memberships
Who you follow, and who follows you
@mentions of other members in your posts and replies
Video submissions — YouTube links, or video files you upload, sent for review before they appear (see Videos you upload below)
Reports you make about content or members, and members you block
In-app notifications, such as replies to your posts, new followers, and mentions

If you signed up on dsp.cafe

The sign-up form on dsp.cafe collects your name, email address, which best describes you ("I am a…"), an optional message, and whether you would like to be an early tester
We use this to keep you updated and, if you asked to test early, to send you a personal invitation
Our team may add private notes to a sign-up to keep track of invitations. These are never shown publicly

Technical Data

Session tokens — managed by our authentication provider; not stored in our database
Account creation timestamp
Last sign-in timestamp — tracked by our authentication provider

2. How We Use Your Information

We use the information we collect to:

Create and manage your account
Verify your identity and professional status as a Direct Support Professional
Display your profile and community activity to other verified members, subject to your privacy settings
Operate community features including Tables, posts, replies, and mentorship
Moderate content and enforce our Community Guidelines
Improve the Platform and develop new features
Communicate with you regarding your account, verification status, or Platform updates
Investigate and respond to abuse, policy violations, or legal requests

Your zip code

Adding your zip code is optional. If you add it, we use it to show you trainings, events, and perks in your area as we launch them. We may also include it in anonymous, combined totals about Direct Support Professionals, such as how many DSPs are in a region. There is very little data about where DSPs work, and these totals help make the case for the workforce.

You will never be personally identified. We never share your zip code itself, only anonymous totals. Totals never include your name, email, or anything else that points to you, and we do not report numbers so small that they could.
Your zip code is never shown on your profile or your posts. Only a small number of DSP Cafe administrators can see it.
We never sell your zip code or any of your personal information.
You can change or remove your zip code anytime from your profile. Removing it takes you out of any future totals.

Photos

Before a photo leaves your device, the app removes its hidden details (EXIF data), including the GPS location where it was taken. We never receive the original file.
Photos are kept in private storage and shown only to signed-in members viewing the post or reply they belong to.
When you delete a post or reply, or it is removed by a moderator, its photos are deleted too.

Videos you upload

Uploaded videos are stored with our video provider, Cloudflare, and are private until a moderator approves them.
A video that is never reviewed is deleted automatically after 30 days. Rejected or removed videos are deleted.
Once approved, a video appears in the DSP Cafe video library for signed-in members.

3. How We Share Your Information

We never sell, rent, or trade your personal information, and we never share information about you as an individual with employers, agencies, advertisers, sponsors, or partners. Anything we share outside DSP Cafe is anonymous and combined, and can never be traced back to you. The only other ways your information leaves the Platform are the limited circumstances below:

With other Platform members: Your display name (real name or username, per your preference), verified status, role, and public profile fields are visible to other verified members. Fields you have toggled off in your privacy settings are not shown.
With service providers: We use the following third-party processors to operate the Platform:
- Supabase — database hosting, authentication, and file storage
- Vercel — web hosting and content delivery
- Resend — transactional email delivery (e.g., verification and invitation emails)
- Cloudflare — storing and streaming videos uploaded to the video library
These providers process data on our behalf and are bound by data processing agreements. We do not authorize them to use your data for their own purposes.
Anonymous totals only: We may share anonymous, combined totals (for example, the number of DSPs in a region) with partners such as advocacy organizations. We never share a list of members, anyone's zip code, or any one person's information. See Your zip code.
For legal compliance: We may disclose information when required by law, court order, or to protect the rights and safety of our users or the public.
In a business transfer: If Red Road Ventures, LLC is acquired or merges with another entity, your data may transfer as part of that transaction. We will notify you in advance.

4. Data Retention

We retain your account information for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes or to prevent abuse.

Username history is retained for up to 12 months for abuse investigation and impersonation prevention purposes.

If you signed up on dsp.cafe, we keep your sign-up so we can stay in touch. Email us at hello@dsp.cafe and we will delete it.

5. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

Access the personal information we hold about you
Correct inaccurate information
Request deletion of your account and associated data
Adjust your public profile visibility using the privacy toggles in your profile settings
Add, change, or remove your zip code at any time from your profile
Change your username or display name preference at any time (username changes are subject to a 30-day rate limit)

To exercise any of these rights, contact us at hello@dsp.cafe.

6. Data Security

We use industry-standard security measures including encrypted connections (TLS), hashed password storage, row-level security policies on our database, and access controls on sensitive storage buckets. No system is completely secure, and we cannot guarantee absolute security.

7. Children's Privacy

DSP Cafe is intended for adults who are working professionals. We do not knowingly collect information from individuals under the age of 18. If you believe a minor has created an account, please contact us immediately at hello@dsp.cafe.

8. Third-Party Content and Embedded Players

The Platform allows users to submit links to third-party content and displays embedded video players from YouTube (operated by Google LLC). When you interact with an embedded YouTube player, YouTube may collect data about you — including cookies, device identifiers, and viewing activity — in accordance with Google's Privacy Policy. We do not control and are not responsible for YouTube's data practices.

When a post contains a YouTube link, your device loads that video's thumbnail and title directly from YouTube to show a preview.

We are not responsible for the privacy practices of any other third-party platforms linked to from DSP Cafe. Accessing third-party content is subject to those platforms' own privacy policies.

9. Cookies, Local Storage, and Cached Data

DSP Cafe uses browser local storage and session storage to maintain your login session and app state, such as unsent post drafts and announcements you have dismissed. These stay on your device. We do not use third-party advertising cookies or behavioral tracking cookies.

As a Progressive Web App (PWA), DSP Cafe uses a service worker to cache application assets locally on your device for offline performance. This cached data does not include your personal information and can be cleared by uninstalling the app or clearing your browser's site data.

If you access the Platform via a browser that embeds YouTube players, YouTube may set its own cookies on your device. See Section 8 for more information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app or sending an email to your registered address. Continued use of the Platform after changes take effect constitutes your acceptance of the updated policy.

11. Contact

For questions or requests regarding this Privacy Policy, contact us at:

Red Road Ventures, LLC
hello@dsp.cafe
Indiana, United States