Privacy Policy

Account information. When you register we collect your name, email address and password (stored only as a cryptographic hash).

Workspace and client data. Content you create or upload: brand profiles, draft posts, media, calendars, campaigns, team and approval records.

Connected social account data. When a social media account is connected, we receive and store the account's public profile information (username, platform account ID, display name, profile image, account type) and the permissions you granted.

The Service connects to third-party platforms only through their official authorization (OAuth) systems, and only within the scopes you explicitly approve. Depending on the permissions granted, we may access:

• Profile information of connected accounts (Meta / Instagram, LinkedIn).
• Media and posts, in order to display, schedule and publish content on your behalf.
• Comments and mentions, in order to display them in your inbox and post replies you initiate.
• Direct messages, where the platform grants messaging permissions.
• Insights and analytics metrics that the platform makes available for your accounts.

We never collect data beyond the permissions granted, never ask for or store your third-party platform passwords, and never generate metrics that a platform does not provide.

Access tokens issued by third-party platforms are used exclusively on our servers, for the operations you request: publishing and scheduling content, reading and replying to comments and messages, and retrieving insights.

Tokens are stored encrypted in our database, are never exposed to the browser, never written to logs, and never shared with third parties other than the platform that issued them. When you disconnect an account, its encrypted token is deleted.

• To provide, operate and maintain the Service.
• To publish, schedule and manage content strictly on your instruction.
• To notify you about publishing results, approvals and account connection health.
• To secure the Service, prevent abuse and meet legal obligations.

We do not sell your data and do not use connected account data for advertising.

We retain your data while your account is active. When you delete your account or workspace, or request deletion, associated data is removed from our active systems within a reasonable period; encrypted backups expire on their normal rotation schedule.

Disconnecting a social media account deletes its encrypted access token immediately and stops all further data collection from that account. Previously imported content may be retained as part of your workspace history until you delete it or your workspace.

You can stop our access to a connected account at any time:

• Inside the Service: open the client's Social Media Accounts section and choose "Disconnect". This deletes the stored token.
• From the platform itself: remove Sosyal OS in your Meta/Instagram app settings (Settings → Apps and Websites) or in your LinkedIn permitted services. Revoking access on the platform side also prevents any further API access by the Service.

To request deletion of your data, contact us at info@nexbt.com.

We apply industry-standard measures: encryption in transit (HTTPS), encrypted storage of access tokens, row-level access isolation between workspaces, and server-side-only credential handling. No method of transmission or storage is 100% secure, but we work to protect your information and to notify affected users of any confirmed breach as required by law.

Depending on your jurisdiction, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at info@nexbt.com.

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated revision date.