Permissions & Data Usage Disclosure

Last Updated: 12/5/2025

This page explains the permissions our application requests from third-party platforms such as Facebook, Instagram, TikTok, Reddit and X, and how we use, store, and handle that data.
We only request the minimum permissions needed for businesses to publish their own content and manage their marketing communications through our platform.

Our service does not use your data for analytics, advertising, resale, or any purpose outside the core functions described below.

1. Facebook & Instagram Permissions

   When you connect Facebook or Instagram to our platform, we may request the following permissions through the Meta OAuth process:

   1. pages_show_list

      Why we request it:
      To display the list of Facebook Pages or Instagram Business Accounts you manage, so you can select which one to post to.

      How we use it:

      • Retrieve the list of Pages you have access to
      • Allow you to select which Page/IG account to connect to our platform

      How we store it:
      We store only the selected Page ID and related metadata necessary for posting.

   2. pages_read_engagement

      Why we request it:
      Required by Meta to verify your Page ownership and posting eligibility.

      How we use it:

      • Confirm that your Page is valid and accessible
      • Validate posting permissions

      How we store it:
      We store the Page ID and verification result. We do not store engagement metrics.

   3. pages_manage_posts

      Why we request it:
      To publish posts to your Facebook Page on your behalf.

      How we use it:

      • Upload images
      • Publish text posts
      • Publish scheduled or immediate posts
      • Check publishing status

      How we store it:
      We store only the media you upload for posting and any errors returned by Meta.

   4. instagram_basic & instagram_content_publish

      Why we request them:
      These are required to publish photos or videos to your Instagram Business Account.

      How we use them:

      • Create Instagram media containers
      • Upload images or videos
      • Publish posts

      How we store them:
      We store the IG Business ID and uploaded content only long enough to publish.

   5. pages_manage_metadata

      Why we request it:
      To retrieve token expiration times and subscribe to necessary webhook categories (if used).

      How we use it:

      • Refresh long-lived tokens
      • Maintain connection stability

      How we store it:
      We store token expiration timestamps and refresh data.

2. TikTok Permissions

   When connecting TikTok, we may request:

   1. User information (user.info.basic)

      Why we request it:
      To identify your TikTok Business Account.

      How we use it:

      • Retrieve your TikTok user ID
      • Link your account for posting

      How we store it:
      We store only the TikTok Business/User ID.

   2. Video upload & publish permissions (video.upload, video.publish)

      Why we request them:
      To allow you to upload and publish videos to your TikTok account.

      How we use them:

      • Upload your provided video
      • Apply your title/caption
      • Publish content on your behalf

      How we store it:
      We store video files only until publishing is completed or canceled.

3. Data We Collect Through Permissions

   We collect only the data required to operate the Services:

   Stored Data:

   • OAuth access tokens
   • Refresh tokens
   • Token expiration timestamps
   • Page IDs, Instagram Business IDs, or TikTok Business IDs
   • Content you choose to upload (images, videos, text)
   • API response metadata (post IDs, status codes)

   Not Stored:

   • Comments
   • Likes or engagement metrics
   • Friend lists
   • Messages
   • Personal profile data
   • Sensitive personal data
   • Non-business user activity

   We do not use your connected accounts for analytics, ad targeting, or scraping.

4. How Long We Keep the Data

   Tokens & Metadata

   Kept only while your account remains connected.
   Deleted immediately upon disconnecting.

   Uploaded Content

   Kept only until the content is:

   • Published
   • Scheduled
   • Deleted
   • Or the integration is disconnected

   System Logs

   Minimal metadata may be retained for compliance or security.

5. How to Revoke Permissions

   You may revoke access at any time:

   Within our platform:

   Dashboard > Admin > Service Setup > Disconnect

   This immediately deletes:

   • OAuth tokens
   • Platform metadata
   • Any linked content
   • Posting permissions

   From the platform directly:

   For Facebook/Instagram:
   https://www.facebook.com/settings?tab=business_tools

   For TikTok:
   https://www.tiktok.com/settings/manage-developer-access

   Revoking access disables posting and deletes our ability to communicate with the platform.

6. How We Protect Your Data

   We apply:

   • Encrypted storage of OAuth tokens
   • Secure servers & restricted access
   • Strict internal controls
   • Industry-standard security protocols

   No passwords for third-party platforms are ever collected.

7. Contact Information

   If you have questions about permissions or data usage:

   Email: admin@communitycomm.com
   Address: 61 Pleasant Street, Newburyport, MA 01950