Privacy Policy

AbhyAI ("we", "us", "our", or "the Platform") operates the AbhyAI Social Publisher service accessible at https://social.abhyai.in. We are dedicated to protecting the privacy, security, and integrity of the personal data and social media account credentials entrusted to us by our users and business clients.

This Privacy Policy explains what information we collect, how it is processed and secured, how third-party platforms (including Meta Platforms, Inc.) interact with our software, and how you can exercise full control over your data, including revocation and permanent deletion.

1. Information We Collect and Process

We only collect and process data strictly required to deliver the core functionalities of Social Publisher:

• Account Registration & Authentication: When you register or access Social Publisher, we collect your name, email address, password hash (salted and hashed via bcrypt), and tenant workspace assignment.
• Connected Social Media Accounts (Meta / Facebook / Instagram / LinkedIn): When you choose to connect a social media page or professional account, we obtain public profile identifiers, page names, page categories, and unique numeric identifiers (such as Facebook Page IDs and Instagram Professional Account IDs).
• OAuth Authentication Tokens: We receive temporary and long-lived OAuth 2.0 access tokens and refresh tokens granted by you during authorization. We store these tokens in encrypted format solely to communicate with platform APIs on your behalf.
• User-Generated Content & Media Attachments: Captions, scheduled post text, hashtags, scheduled timestamps, and uploaded media files (images, graphics, and video files) stored within your private organization workspace.
• Publishing Logs & Performance Telemetry: Records of post delivery status (Published, Scheduled, Failed), external post IDs generated upon successful publishing, and engagement indicators (post impressions, reach, reaction counts, and comment totals) retrieved through authorized API endpoints.
• Technical & Session Data: Server request logs, IP addresses, browser user-agent strings, and secure HTTP cookies used exclusively for session management and CSRF defense.

2. Purpose of Data Processing

We process your data exclusively for legitimate operational purposes:

• To authenticate your identity and authorize access to your organization's workspaces.
• To connect and maintain authorized integrations with third-party networks (e.g., Facebook Pages, Instagram Business, LinkedIn).
• To execute automated scheduling and dispatch of authored posts to your selected social channels at your designated dates and times.
• To retrieve and display post delivery status and native engagement metrics inside your dashboard.
• To ensure system security, prevent abusive or unauthorized access, and troubleshoot API exceptions.

Zero Data Sale or Advertising Exploitation: We do not sell, rent, monetize, or trade your personal data, customer rosters, follower lists, or published media to advertisers, data brokers, or third parties under any circumstances.

3. Meta Platforms Data Handling (Facebook & Instagram)

Our integration with Meta platforms (Facebook and Instagram) complies strictly with the Meta Platform Terms and Developer Policies:

• Permission Scope Minimization: We only request permissions necessary for content management and publishing, specifically:
  • pages_show_list: To list the Facebook Pages you administer so you can select which to connect.
  • pages_manage_posts: To publish, schedule, or delete posts on your authorized Facebook Page feeds.
  • pages_read_engagement: To fetch reach, reaction, and comment metrics for posts published through the platform.
  • instagram_basic & instagram_content_publish: To publish single/carousel media and reels to your connected Instagram Professional accounts.
• No Personal Profile Harvesting: We do not access or collect personal timeline posts, personal friend lists, private user messages, or sensitive profile details from your personal Facebook account.
• Separate Account Connection: Our platform uses Facebook OAuth strictly to authorize Page management. Connecting a Page does not give us access to your private profile content.

4. Token Security and Encryption Standards

All access tokens, refresh tokens, and API credentials obtained from Meta and other providers are encrypted at rest using industry-standard symmetric AES-256 cryptography. Encryption keys are managed strictly in server-side environment variables and are never checked into public version control or exposed in client-side bundles.

5. Data Storage, Hosting, and Third-Party Processors

Our infrastructure is hosted on secure cloud servers located within Amazon Web Services (AWS EC2, Mumbai region, India). We utilize the following operational processors:

• Amazon Web Services (AWS): Cloud compute, secure networking, and encrypted storage volumes.
• Meta Platforms, Inc. (Graph API): Third-party destination for authorized Facebook and Instagram publishing requests.
• Let's Encrypt (ISRG): Automated TLS/SSL certificate authority securing HTTPS transport across all domains.

6. Data Retention and Deletion

We retain your data only for as long as your workspace account remains active on the Platform:

• Active Accounts: OAuth tokens remain active until expired, revoked by you, or updated during account reconnection. Publishing history and media remain accessible in your workspace for ongoing analytics.
• Account Disconnection: You can disconnect any social media account at any time from the Accounts section of the dashboard. Disconnecting immediately deletes the encrypted access tokens and stops all scheduled jobs for that account.
• User Deletion & Revocation: When a user account or workspace is deleted, all stored access tokens, scheduling queues, and uploaded media files are permanently expunged from our production databases within 48 hours.

7. User Data Deletion Instructions (Meta Compliance)

In accordance with Meta Platform Policy, we provide multiple clear, self-service mechanisms for users to request data deletion or revoke application permissions:

1. Via Facebook App Settings: Go to your Facebook profile → Settings & Privacy → Settings → Apps and Websites → Select AbhyAI Social Publisher / mvm → Click Remove. Meta will automatically trigger our automated server-to-server data deletion callback.
2. Via Social Publisher Dashboard: Navigate to https://social.abhyai.in/accounts, find the connected account, and click Delete / Disconnect.
3. Automated Callback Endpoint: Our server implements an automated callback at https://soc.abhyai.in/meta/data-deletion that verifies Meta's signed request, purges all stored tokens, and issues a tracking confirmation code.
4. Direct Written Request: Email our Data Protection Officer at abhishekkumarmvm@gmail.com with the subject "Data Deletion Request".

For full details and to track an existing deletion confirmation code, please visit our dedicated Data Deletion Instructions page.

8. Your Legal Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• The right to access the personal information we hold about you.
• The right to rectify inaccurate or incomplete records.
• The right to request permanent erasure of your data.
• The right to restrict or object to the processing of your data.
• The right to export your content and publishing records.

9. Contact Information & Policy Updates

We may update this Privacy Policy periodically to reflect changes in our services, infrastructure, or platform partner policies. When updates occur, the "Last Updated" date at the top of this document will be revised.

For inquiries, concerns, or data protection requests, please contact: