Privacy Policy

1. Who is responsible

Fursnacks BV, established in the Netherlands, is the controller for the processing described in this policy. Questions and privacy requests can be sent to [email protected]. Our website is fursnacks.com.

2. Scope

This policy applies to SocialDesk and its connection to Instagram. Instagram and Meta operate their own services under their own terms and privacy policies. This policy does not govern data that Meta processes independently.

3. Data we process

Depending on the features used and the permissions granted through Instagram, SocialDesk may process:

• Connected Instagram professional-account identifiers, username, display name, account type, profile image, granted permissions, and token expiry information.
• An encrypted Instagram access token used to perform authorised actions.
• Instagram media metadata, captions, public URLs, publication dates, and comment counts.
• Comments and replies, including comment identifiers, usernames, text, timestamps, and like counts.
• Direct-message conversation identifiers, participant details, message text, attachment metadata, direction, and timestamps.
• Drafts, schedules, uploaded media, publication status, and errors created while using SocialDesk.
• Summaries and inferred topics, sentiment, intent, questions, risks, or suggested replies generated from selected comments or conversations.
• Webhook events and limited technical information needed for reliability, security, troubleshooting, and abuse prevention.

4. Where the data comes from

Data comes from the connected account owner, use of SocialDesk, and the Instagram API and webhooks authorised by that account owner. Comment and message data may relate to people who interact with the connected Instagram account.

5. Why we process data

• To connect and maintain the authorised Instagram integration.
• To display media, comments, and eligible conversations.
• To create drafts, schedule or publish content, and send user-approved replies.
• To create requested summaries that help the account owner understand feedback and support conversations.
• To secure, operate, diagnose, and improve the service and comply with legal obligations.

The applicable legal bases may include performance of a contract, Fursnacks BV's legitimate interests in providing and securing SocialDesk, compliance with legal obligations, and consent where consent is specifically requested. Legitimate interests are balanced against the rights and interests of affected individuals.

6. Automated analysis

SocialDesk can generate summaries and suggested replies. These outputs may be incomplete or inaccurate. They are decision-support tools and are not used to make decisions producing legal or similarly significant effects about individuals. A person must choose whether to use or send a suggested reply.

7. Service providers and disclosures

Data may be processed by providers used to operate SocialDesk, including Meta/Instagram for the connected service, cloud hosting and infrastructure providers, and security or network providers. If an external AI provider is enabled, selected comment or message text needed for a requested summary may be sent to that provider. SocialDesk currently identifies the configured AI provider inside the application.

We may also disclose information when required by law, to protect rights and security, or in connection with a corporate transaction subject to appropriate safeguards. We do not sell personal data.

8. International processing

Some providers, including Meta and infrastructure or AI providers, may process data outside the European Economic Area. Where required, transfers must rely on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism.

9. Retention

The active Instagram token is retained until the account is disconnected, the token is revoked, or it expires. Workspace data such as media metadata, comments, messages, drafts, uploads, webhook records, and summaries is retained while needed to provide and secure the service or until it is deleted following a verified request. Some records may be retained longer where required for legal claims, security, fraud prevention, or compliance.

Disconnecting Instagram removes the active stored token but does not by itself erase all historical workspace data. Follow the data-deletion instructions to request full deletion. Residual copies may remain temporarily in protected backups until those backups are overwritten.

10. Security

SocialDesk uses measures designed to protect data, including HTTPS, server-side secrets, encrypted storage of Instagram access tokens, password-protected workspace access, request limits, webhook signature verification, and restricted administrative access. No security measure can eliminate every risk.

11. Your rights

Subject to applicable law, you may have rights to information, access, correction, deletion, restriction, objection, and portability, and the right to withdraw consent where processing relies on consent. Email [email protected] to exercise a right. We may request information needed to verify your identity and locate the relevant record.

You may also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or another competent authority.

12. Children

SocialDesk is intended for professional account management and is not directed to children. Please contact us if you believe a child's data has been processed inappropriately.

13. Changes

We may update this policy when SocialDesk or legal requirements change. The effective date above identifies the current version. Material changes will be communicated where required.