Draft
This document is a draft prepared for legal review and is not yet in effect.

Agency Delegation Terms

DRAFT for counsel review. Not yet in effect. Version 0.1, 21 October 2026.

These terms supplement the SotialMedia Terms of Service for organizations that manage other organizations' workspaces ("Agencies") and for the organizations whose workspaces are managed ("Clients"). They describe how delegation works in the Service and what each party is responsible for. Operated by DataHubz; contact support@sotialmedia.com.

1. How delegation works in the Service

  • Every Client is a separate organization in the Service with its own workspaces, connected accounts, content, history and billing identity. When an Agency creates a Client organization on the Client's behalf, the Agency user who created it holds the owner role only until a Client stakeholder accepts the owner invitation; the Agency must send that invitation before connecting any account to the workspace, and the Client's owner may remove the Agency user from the Client organization at any time.
  • Access is delegated through a grant from the Client organization to the Agency organization for one workspace, with a role ceiling chosen by the Client (manager, editor, publisher or viewer). The Agency then assigns its own staff to the grant; no assigned role can exceed the ceiling.
  • Agency staff see only the workspaces they are assigned to. They never see other Clients of the Agency, and the Client never sees the Agency's other Clients.
  • Every action an Agency user takes in a Client workspace is recorded in the Client's audit log with the user's identity and the Agency's identity.
  • A Client can require approval for every publication in a workspace; the approver must be a different person than the one who scheduled it.

2. Lawful authorization

  • Before an Agency connects a social media account to a Client workspace, or asks the Client to do so, the Agency must hold written authorization from the account owner that covers publishing through SotialMedia. "Written" includes a signed agreement, an executed order form or an email from the account owner's business address.
  • The Agency keeps that authorization for the duration of the engagement and 12 months after and provides it to DataHubz within 5 business days of a request. DataHubz may request it when an account owner or a platform disputes the Agency's authority.
  • Where a Client's own staff connect accounts, the Client is responsible for being the owner or holding authorization.
  • Authorization must cover the scopes granted on the platform consent screen (for X: reading and writing posts, reading the account profile, uploading media, and offline access for token refresh). Requesting the Client or account owner to grant additional scopes requires separate written authorization.

3. Agency responsibilities

  • Publish only content the Client has approved, within the scope of the engagement, and in compliance with the Acceptable Use Policy and the destination platform's policies.
  • Assign the least role each staff member needs; remove assignments promptly when staff leave or change engagements.
  • Enable multi-factor authentication for all Agency administrators (required by the Service) and encourage it for all staff.
  • Keep Client credentials and API keys confidential; never share one Client's data with another.
  • Forward to the Client any deletion, export or complaint request from an account owner within 2 business days.

4. Client responsibilities

  • Choose the role ceiling and the approval requirement for each workspace deliberately. A Client-created grant uses the ceiling the Client selects; an Agency-created Client starts with a "manager" grant for the Agency, and approval is off until a Client or Agency administrator turns it on for the workspace. During the pilot, approval is required on every workspace by agreement.
  • Keep at least one Client user as organization owner so the Client can revoke or change delegation without the Agency.
  • Review the audit log and connected accounts periodically.

5. Revocation

  • The Client can revoke a grant at any time from the console. Revocation takes effect immediately: all Agency assignments on the workspace end, scheduled publications remain scheduled under the Client's control, connected accounts remain connected, and all content and history stay with the Client.
  • The Agency can withdraw from a grant at any time with the same effects.
  • DataHubz may revoke a grant on the request of the account owner of a connected account, or under section 7 of the Acceptable Use Policy, and will notify both parties.
  • Revocation does not delete any Client data. Deletion is governed by the Data Retention and Deletion Policy and can be requested only by the Client's owner.

6. Portability at termination

Because each Client owns its organization, ending an Agency engagement requires no migration: the Client revokes the grant and continues to use the Service directly or through another Agency. If the Client does not intend to continue, the Client's owner may export the organization's data within 30 days and request deletion.

7. Billing

Delegation does not change who pays. A Client may be invoiced directly, or an Agency may be designated as the billing organization for one or more Clients with pooled limits and per-Client usage reporting. The arrangement is stated in the order form, and changing it requires the consent of the party that will be invoiced.

8. Liability between Agency and Client

The commercial relationship between an Agency and its Client, including fees, service levels and content responsibility, is governed by their own agreement. DataHubz is not a party to it. Each of Agency and Client is responsible to DataHubz for its own users' compliance with the Terms of Service.

9. Governing law

These terms are governed by the laws of the State of Colorado, USA, as set out in section 16 of the Terms of Service.