Privacy Policy

5.1 Information Collected

The Site may automatically collect technical data (e.g., IP address, browser type, usage data) for security and functionality. If you submit personal information through forms, booking or appointment requests, event sign-ups, contact forms, email, or other means, that information may be collected and used as described here or as otherwise disclosed at the point of collection.

5.2 Sale or Sharing of Information

Personal information may be shared with service providers, hosting or analytics partners, or other third parties for operational or business purposes. Such sharing may qualify as a "sale" or "sharing" under certain privacy laws. The Site owner does not guarantee that collected information will remain private or undisclosed.

5.3 Third-Party Privacy

Third-party scripts, analytics, or embedded services may collect or process data under their own policies. The Site owner is not responsible for the privacy practices of third-party websites or services.

5.4 Cookies and Similar Technologies

The Site may use cookies or local storage for functionality, preferences, or analytics. You may have rights to access, delete, or opt out of certain data practices depending on your jurisdiction; contact the Site owner to exercise those rights.

5.5 Social Media Campaigns, Facebook, and Instagram

Social Media Campaigns lets an authorized administrator connect a Facebook Page and publish posts to that Page. The same connection can also identify an Instagram professional account linked to that Page. When an administrator starts a connection, the Site requests these permissions from Meta:

pages_show_list is requested to list the Facebook Pages that the authorizing person can manage, including each Page's id, name, and tasks. pages_manage_posts is requested to publish posts to the selected Facebook Page. pages_read_engagement is requested as part of the connection. The Site does not currently retrieve Page insights, comments, or reaction counts. business_management is requested so Meta can include Pages that belong to a Meta Business. The Site does not make a separate Business Manager data request. instagram_basic is requested to read the Instagram professional account id and username linked to the selected Facebook Page. instagram_content_publish is requested so the Site can publish content an administrator approves to that Instagram account. The Site does not request Instagram messages, comments, or insights, and it does not publish to Instagram unless an administrator later approves a post for that account.

The Site stores the Facebook Page id, Page name, Page tasks returned by Meta, the names of the granted permissions, connection status, connection times, and the Page access token. The Page access token is encrypted before it is stored. The Site does not store the Facebook user's id, name, email, friends list, or other profile information. The Facebook user access token is used only to complete the connection, list Pages, and read which permissions were granted. It is not saved on the account record. For a confirmed Instagram account, the Site stores the Instagram account id, username, linked Facebook Page id, connection status, and connection times. It does not store a separate Instagram access token.

If Meta returns more than one Page, Page names and Page access tokens may be held in the server session until an administrator selects a Page or the session ends. An Instagram confirmation step stores the Instagram account id and username in the server session until the administrator confirms or the session ends. It does not store an access token.

Stored Page information is used to publish content an administrator creates. A Facebook publish request can include the post text, an optional link, and an optional image. The Site stores the Facebook post id returned for that publish. The OAuth token exchange, the Page list request, the granted-permission check, the Instagram account lookup, and the Facebook publish request are transmitted to Meta. Facebook Page identifiers, Instagram account identifiers, and Page access tokens are not sold.

5.6 Facebook and Instagram Data Retention and Deletion

An authorized administrator can disconnect a Facebook Page from Social Media Campaigns. Disconnecting removes the stored Page access token, any refresh token, the token expiry, the stored permission list, and the connection timestamps, and marks the account as not connected. Disconnecting does not revoke that token at Meta. The Facebook Page id, Page name, Page task list, and existing post records remain on the Site until the Site owner removes them. Disconnecting the Facebook Page also marks a linked Instagram account as needing reauthorization. It does not delete Instagram post records. An administrator can disconnect Instagram on its own. That removes the link to the Facebook Page and marks the Instagram account as not connected, without disconnecting the Facebook Page or deleting post records.

To request deletion of Facebook data stored by this Site, email info@billelgin.com or use the contact form at https://www.billelgin.com/contact . Include the Facebook Page name and enough detail to identify the connection. The Site owner will delete the stored Page access token and the associated Page connection data held for Social Media Campaigns. Post records that contain content created by a Site administrator may be retained or deleted as requested.

Removing data stored on this Site does not delete posts that remain on Facebook. Those posts are removed through Facebook. This Site does not provide automated deletion of Facebook data and does not set a fixed retention period.