AI Social Media Management Platform lets an organisation manage social media accounts and publish content for the companies it represents. This policy explains what the service collects, why, how it is handled, and how you can have it removed.
Information we collect
Account information
When you create an account we store your name, email address and a hashed password. We never store your password itself. We also record which companies (workspaces) you belong to and your role in each, because that determines what you are allowed to see and do.
Information obtained from Meta after you authorise the app
If you choose to connect Facebook, you are sent to Meta to sign in and approve access — we never see your Facebook password. When you approve, Meta returns an authorisation code that we exchange for an access token. From that we request only what publishing requires:
- the list of Facebook Pages you manage, with each Page's name, id and category;
- the access token that lets us act for a Page you explicitly choose to connect;
- where the Instagram integration is enabled and a Page has one linked, the Instagram Professional account's id, username and profile picture.
We do not request your birthday, age range, location, friends, messages, or advertising data, and we do not read your personal Facebook profile or timeline.
Facebook Page information
For a Page you connect, we store its name, platform id, profile picture URL, connection status and — later, if you use analytics — the metrics the platform reports for posts we published.
Social account identifiers and access information
Access tokens are credentials. They are encrypted before being written to our database, are never sent to your browser, and are never written to logs. They are used only to carry out actions you have asked for.
Content you create or schedule
Captions, hashtags, links, uploaded images and videos, scheduling times, approval decisions and the record of each publishing attempt (including errors returned by the platform) are stored so the service can do its job and show you what happened.
Operational records
We keep an audit trail of significant actions — a company being created or changed, an account connected or disconnected, a post approved, scheduled or published — with the user, the time and the originating IP address. Server logs record diagnostic information about requests and errors; they deliberately exclude access tokens, authorisation codes, passwords and secrets.
How we use information
- To authenticate you and enforce what your role permits in each company.
- To publish, schedule and retry the content you create, to the accounts you connect.
- To show you the state of your work: drafts, approvals, calendars, publishing results and errors.
- To keep the service secure and diagnose faults.
- To meet the platform requirements of the networks you connect.
We do not sell your information, and we do not use the content of your posts or your connected accounts for advertising.
How information is stored and protected
Data is held in our application database. Access tokens are encrypted at rest with keys held separately from the application code. Passwords are stored only as salted hashes. Access to company data is checked on every request against your membership of that company, so one company's data is not reachable from another. Traffic to the service is served over HTTPS.
No system can be guaranteed to be immune from compromise. We apply the protections described here and fix problems we become aware of; we do not claim the service is impenetrable.
When information may be shared
- With the social platforms you connect — content you publish, and the credentials required to publish it, are sent to that platform at your instruction.
- With others in your company workspace — colleagues who are members of the same company can see its content, connected accounts and activity, according to their role.
- With infrastructure providers that host the application, its database and stored media on our behalf.
- Where the law requires it, or to investigate abuse or a security incident.
Third-party services and Meta integration
Connecting a Facebook Page means Meta also processes that activity under its own terms and policies. What we send to Meta is limited to the content you publish and the request needed to publish it. Disconnecting an account in this service stops us using it and erases the stored token; it does not delete anything that was already published on the platform, which you manage through Meta directly.
If media you attach to a post is published to Instagram, Meta fetches that file from the media URL our service exposes, because that is how Instagram's publishing API works.
Data retention
- Account, company, content and connection data is kept while your account exists.
- Disconnecting a social account erases its stored access token immediately; the record that the account was connected, and the history of what was published through it, remains with the company.
- Deleting your account removes your data as described on the Data Deletion page, normally within 30 days, except where we are required to retain something to meet a legal obligation.
- Server logs are short-lived operational records and are rotated out in the normal course.
Your rights
You can view and correct your company and brand details in the app, see which accounts are connected, disconnect any of them at any time, export or delete the content you created, and delete your account. Depending on where you live, you may also have rights to request a copy of your data or object to particular processing. Contact us and we will respond within 30 days.
Requesting deletion
The Data Deletion page explains exactly what is removed and lets you delete your account yourself while signed in. If you cannot sign in, email us from the address on your account and we will verify and process the request.
Children
The service is intended for business use by adults and is not directed at children. We do not knowingly collect information from children.
Changes to this policy
We may update this policy as the service changes. The "last updated" date above always reflects the current version, and material changes will be communicated in the application before they take effect.
Contact
No contact address is configured for this
deployment yet. Set Legal:ContactEmail in configuration — Meta requires a
reachable contact for privacy and data deletion requests.