Beyond Social Poster Privacy Policy

1. Scope and operator

Beyond Digital Labs operates Beyond Social Poster, an agency workspace for planning, approving, scheduling, and publishing content to authorized business social profiles. This policy explains how the app handles information from agency users, business owners who complete a profile-access request, authorized agents, and connected provider accounts.

2. Information we process

• Account and workspace information: names, business contact email addresses, workspace, client and business records, roles, and session or device identifiers used to secure access.
• Provider connection information: provider user identifiers, Facebook Page identifiers, linked Instagram professional account identifiers, Google Business Profile location identifiers, granted permissions, connection status, and encrypted OAuth access or refresh tokens.
• Content and workflow information: drafts, captions, media, alt text, visible-text review, Brand Truth facts and rules, claims, destinations, schedules, approvals, publishing receipts, and reconciliation status.
• Agent and audit information: the scopes and profiles granted to an authorized software agent, plus the actor, action, outcome, request identifier, and timestamp needed for accountability.
• Technical information: essential session data, local preferences such as theme, service health, error diagnostics, security events, and request metadata needed to operate and protect the app.

We receive this information from the agency user, a business owner completing a permission request, an authorized agent, and the Meta or Google account used during provider authorization.

3. How we use information

• Authenticate users and keep each client and business workspace separate.
• Discover only the provider profiles available under the permission granted, then let the agency select the exact profiles it may use.
• Validate content against Brand Truth, route human approvals, schedule work, publish requested content, and verify provider receipts.
• Enforce profile-level agent scopes, prevent self-approval, maintain audit history, investigate failures, and protect the service.
• Respond to support, access, correction, disconnection, and deletion requests and comply with applicable law.

We do not use client content to train generalized artificial-intelligence models without separate, explicit permission.

4. Providers and disclosures

Beyond Social Poster sends information only as needed to provide the requested service:

• Meta: to authorize, discover, and manage selected Facebook Pages and linked Instagram professional accounts, and to publish or schedule approved content.
• Google: to authorize, discover, and manage selected Google Business Profile locations and publish approved updates supported by Google.
• Cloudflare: the hosted app uses Cloudflare Workers, D1, and R2 to run the service and store application records and private media.

We may also disclose information to service professionals who are bound to protect it, when required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards. We do not sell personal information, share it for cross-context behavioral advertising, or run third-party advertising in Beyond Social Poster.

5. Authorization, agents, and human control

A client-facing permission link does not create an app account, dashboard login, team membership, or role. It lets the business owner authorize provider discovery so the agency can select the exact business profiles it is permitted to manage.

Workspace owners and administrators can revoke requests, disconnect providers, disable profiles, revoke agent keys, and limit each agent to specific actions and profiles. Agent activity is audited. Agents cannot grant themselves access, expand a client’s authorization, or approve their own work.

6. Retention and deletion

We retain workspace information while it is needed to provide the service, maintain security and auditability, resolve publishing or billing disputes, or meet legal obligations. Retention depends on the record type and the agency’s relationship with the client.

Disconnecting a provider removes active credentials, disables connected profiles, and cancels affected queued or scheduled work in Beyond Social Poster. A verified deletion request also removes covered hosted media and connection records as the service processes that request. Content already delivered to Meta or Google is controlled by that provider and may also need to be removed there.

For the complete process, see the Data Deletion Instructions.

7. Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing. You may also revoke provider access through Beyond Social Poster or the provider’s own settings. We may need to verify that you are authorized to act for the affected workspace or business before fulfilling a request.

8. Security

We use HTTPS, encrypted provider credentials, role and profile-based access controls, private media storage, expiring permission requests, revocable agent keys, approval checks, audit records, and fail-closed publishing controls. No system can guarantee absolute security, so users must protect their devices and credentials and report suspected misuse promptly.

9. Children, international processing, and updates

Beyond Social Poster is a business service and is not directed to children under 13. Meta, Google, Cloudflare, and authorized users may process information in different countries subject to their terms and applicable safeguards.

We may update this policy as the product, providers, or law changes. The effective date above identifies the current version. Material changes will be communicated through the app or another appropriate channel.

10. Contact

For privacy questions or requests, email Beyond Digital Labs at office@beyondllcfl.com.