Privacy Policy — Kilogram social AI

1. Overview and Scope

Kilogram social AI is a business productivity and social media publishing SaaS platform owned and operated by AI BotConcierge ("we", "us", or "our"). This Privacy Policy explains how we collect, use, store, protect, and delete information obtained when users authenticate via Facebook Login for Business and connect their Facebook Pages and Instagram Professional accounts through the Meta Graph API.

2. Data Collected via Meta APIs

When you explicitly authorize Kilogram social AI via Facebook Login for Business, we access only the minimum data required to provide scheduled and automated content publishing:

• Public Profile & Business Identity: Your Meta User ID and display name to identify the authenticated connection owner.
• Business Portfolios (`business_management`): List of Meta Business Manager portfolios you have access to, solely to display them in our asset selector so you can organize connected brand workspaces.
• Facebook Pages (`pages_show_list`, `pages_read_engagement`, `pages_manage_posts`): Page ID, Page Name, authorized Page Tasks (`CREATE_CONTENT`, `MANAGE`), and Page Access Tokens for the specific Facebook Pages you select, used exclusively to publish user-approved feed images and photo stories.
• Instagram Professional Accounts (`instagram_basic`, `instagram_content_publish`): Instagram Business/Creator Account ID and username linked to your selected Facebook Page, used exclusively to create media containers and publish approved feed posts and stories.

3. How We Store and Protect Your Data

• Encryption at Rest: All OAuth access tokens received from Meta are immediately encrypted server-side using AES-256-GCM before being stored in our database. Tokens are never exposed to the browser, client-side logs, or exports.
• Strict Multitenant Isolation: Each subscriber workspace is strictly isolated. Assets and tokens authorized by one subscriber are never shared with or accessible by any other subscriber.
• No Unauthorized Third-Party Sharing: Meta user tokens and private social account data are never sold, transferred, or sent to third-party AI/LLM providers (such as OpenAI).

4. Data Retention and User Data Deletion

We retain Meta connection data only for as long as your account remains active and connected. You may revoke access and delete all stored Meta tokens and asset bindings at any time through any of the following methods:

• In-App Disconnection: Navigate to Social Accounts in your workspace and click "Disconnetti Account Meta / Disconnect". All encrypted tokens and asset grants are immediately purged from our database.
• Automated Meta Data Deletion Callback: Removing Kilogram social AI from your Facebook Settings (Settings & Privacy → Settings → Apps and Websites or Business Integrations) automatically triggers our Data Deletion Callback endpoint at /api/social/meta/deauthorize, which deletes your data and issues a tracking confirmation code.
• Direct Request: Visit our Data Deletion Instructions page (/data-deletion) or email fabioslemer@gmail.com. Requests are processed within 24 hours.

1. Titolare del Trattamento

Il titolare del trattamento dei dati per l'applicazione Kilogram social AI è AI BotConcierge, contattabile all'indirizzo email fabioslemer@gmail.com.

2. Finalità del Trattamento e Dati Meta

I dati acquisiti tramite l'autenticazione ufficiale Facebook Login for Business (ID utente Meta, elenco Business Portfolio, ID e nome delle Pagine Facebook selezionate, ID dell'account Instagram Professionale collegato e relativi token di accesso) vengono utilizzati esclusivamente per consentire all'utente abbonato di programmare e pubblicare contenuti grafici e testuali (Feed e Stories) sui canali social da lui amministrati e selezionati.

3. Sicurezza, Crittografia e Cancellazione

Tutti i token di accesso sono cifrati a riposo tramite algoritmo AES-256-GCM. Nessun token o dato privato proveniente dalle API di Meta viene ceduto a terzi. L'utente può cancellare in autonomia e con effetto immediato tutti i dati collegati cliccando su "Disconnetti Account Meta" nella sezione Account Social dell'applicazione, rimuovendo l'integrazione dalle impostazioni di Facebook oppure consultando la pagina dedicata Eliminazione dei Dati (/data-deletion).