1. Scope
This policy describes how iMarketing handles the information of users and of the organizations that manage content in the application, and the data it receives when social media accounts are connected through their official authorization mechanisms.
2. Who uses iMarketing
Access is by invitation. The iMarketing team creates each account and links it to an organization. An invited person can only view and publish their organization's content and connect their own social media accounts. There is no public sign-up.
3. Data processed
iMarketing account data (name, email, role and access logs); organization data (name, brand, contacts); the content that is prepared or published (text, images, videos, dates and destinations); and technical records of each post (status, identifiers returned by the network and errors).
4. Data received from TikTok
When TikTok is connected, iMarketing receives the account identifier (open_id), the display name, the username, the profile image, the granted permissions and the access and refresh tokens. Before publishing, it checks the options TikTok offers that account (privacy levels, comments, duets, stitch and maximum duration). With the publishing permission, it sends the video and text that the user reviews and confirms, and checks the status of that post. iMarketing does not ask for or store the TikTok password.
5. Data received from Meta (Instagram and Facebook)
iMarketing offers two official, independent ways to connect Instagram: Instagram Login (the professional Instagram account, without a Facebook Page) and Facebook Login (a Facebook Page and the Instagram account linked to it). Neither requires the other.
With Instagram Login, iMarketing requests only the instagram_business_basic and instagram_business_content_publish permissions. It receives the Instagram account identifier, the username, the profile name, the account type (business or creator), the granted permissions and a long-lived access token (about 60 days) that it renews before it expires. It stores the identifier, the username, the account type, the permissions, the expiry date and the encrypted token; the profile name is only used when connecting and is not stored. iMarketing does not ask for or store the Instagram password.
With these permissions, iMarketing publishes to that account the content the user prepares and confirms (images, videos and reels, carousels and stories): it sends Instagram the public address of the file and the text, creates the media container, checks its status and publishes it. For each post it stores the identifier returned by Instagram, its public link when Instagram returns it, the status and, if it fails, the error.
With these permissions iMarketing does not read or send direct messages, does not manage comments and does not read insights of the Instagram account.
With Facebook Login, iMarketing receives the identifier and name of the Facebook Page and of the linked Instagram account, and the Page access token, which it stores encrypted, to publish the content the user confirms.
6. What the data is used for
To identify the connected account and show it before publishing, keep the connection active, publish the content the user confirms, show the status of the post and allow disconnection. Data is not sold or used for advertising, and nothing is published without explicit confirmation.
7. Tokens and security
Tokens are stored only on the server, encrypted, and are never shown on screens, URLs or logs. The application secret never reaches the browser. Sessions use HttpOnly cookies, the OAuth flow uses a signed, single-use state parameter, and every action checks that the person has access to that organization.
8. Providers
To provide the service, iMarketing communicates with TikTok, Meta (Facebook and Instagram) and Cloudinary (file storage). Each provider processes information according to its own policies. iMarketing only sends what is needed for the action the user requests.
9. Disconnection and revocation
A TikTok account can be disconnected at any time from “Connected networks” («Redes conectadas»). When it is disconnected, iMarketing attempts to revoke the authorization on TikTok and deletes the account's tokens and identity; it only keeps a minimal technical record (status and date). Authorization can also be revoked from TikTok's settings.
An Instagram account connected with Instagram Login can be disconnected at any time from the client's connections in iMarketing. When it is disconnected, iMarketing deletes the access token and can no longer publish to that account; it keeps the identifier, the username and the post history while the organization uses the service, unless their deletion is requested. The authorization can also be revoked from Instagram (Settings → Apps and websites).
10. Retention and deletion
Data is kept while the organization uses the service. Correction or deletion of the account and organization information can be requested; the request will be handled by deleting the active records, except for what must be kept due to legal obligations. The procedure is on the “Data deletion” page (/eliminacion-de-datos).
11. Contact
For any question about privacy, disconnection or data deletion, write to rtd1393@gmail.com.
12. Changes
This policy may be updated due to changes in the application, in regulations or in third-party APIs. The update date appears at the top.