Privacy Policy

1. Introduction & Overview

Advertely operates the SocialSaaS platform ("Service"), enabling businesses, marketing teams, and content creators to publish content, manage inbound customer conversations across multiple channels, automate comment-to-direct-message workflows, and analyze social performance.

This Privacy Policy outlines how we collect, store, process, and safeguard data when you connect your accounts (including Facebook Pages and Instagram Professional accounts) to SocialSaaS.

2. Social Network Connections & Meta Integration

When you choose to connect your Facebook or Instagram account through our official Facebook Login for Business integration, you grant SocialSaaS authorization to perform authorized tasks on your behalf based on the specific permissions you approve.

We interact exclusively with official Meta Graph APIs and adhere strictly to the Meta Platform Terms and Developer Policies.

3. Data We Collect

To provide our services, SocialSaaS collects and processes the following categories of information:

• Account & Profile Identifiers: Name, business email, and workspace membership data.
• Connected Social Account Metadata: Facebook Page IDs, Page names, Instagram Professional account IDs, usernames, and profile display pictures retrieved through official API endpoints.
• OAuth Credentials & Tokens: Short-lived and long-lived OAuth access tokens granted during authentication.
• Inbound & Outbound Messaging Data: Message text, timestamps, participant identifiers, delivery statuses, and attachment metadata necessary to display and reply to private customer conversations in Omnichat.
• Webhook Events: Real-time webhook notifications dispatched by Meta for page comments, private messages, and delivery receipts to keep your workspace inbox synchronized.
• Content & Publishing Media: Post captions, scheduled publication times, images, and videos uploaded to our secure storage for social feed publishing.

4. Purpose and Legal Basis for Processing

We process collected data exclusively to fulfill our contractual commitments to you, specifically:

• Publishing and scheduling authorized content to your connected Facebook Pages and Instagram accounts.
• Aggregating customer inquiries into a unified multi-channel messaging inbox (Omnichat).
• Executing automated keyword-triggered comment-to-DM responses you have configured.
• Maintaining real-time synchronization between our platform and Meta's official APIs via secure webhooks.
• Enforcing role-based access control and strict tenant workspace isolation.

5. Security, Encryption & Token Storage

We enforce rigorous technical and organizational security controls:

• AES-256 Encryption at Rest: All third-party access tokens, refresh tokens, and sensitive OAuth credentials are encrypted at rest using AES-256 before persistence in our databases.
• TLS 1.3 Transport Security: All API communication, webhooks, and web traffic are encrypted in transit via modern TLS/HTTPS.
• Zero Credential Logging: Access tokens, user passwords, and platform app secrets are never written to log files, crash dumps, or error traces.
• Strict Tenant Isolation: Every social connection, conversation, and message is strictly bounded by workspace identity, preventing cross-tenant data leakage.

6. No Sale or Monetization of User Data

We do not sell, rent, trade, or monetize your personal information, customer messages, or social data to any third party, advertiser, or data broker. Your data is used exclusively to operate your SocialSaaS workspace.

7. Data Retention & Automatic Deletion

We retain data only as long as necessary to provide the service:

• Active Connections: Social media tokens and message data remain active while your workspace connection is maintained.
• Upon Disconnection: Disconnecting a Facebook Page or Instagram account immediately terminates webhook subscriptions, deletes stored access tokens from active databases, and marks the connection as inactive.
• Workspace Termination: Deleting a workspace results in the complete purge of all associated tokens, posts, messages, and automation rules within 30 calendar days.

8. Your Rights & Choices

Depending on your jurisdiction (including rights under GDPR and CCPA), you have the right to:

• Access and review personal data held in your account.
• Disconnect any social account at any time with immediate cessation of API calls.
• Request permanent deletion of all data associated with your social accounts or workspace.
• Revoke Advertely's permissions directly in your Facebook App Settings.

9. Contact & Inquiries

If you have any questions, requests, or privacy concerns, please contact our Data Protection Officer at: