Privacy Policy

REASEY Uploader is a dedicated publishing utility developed by ADSolution to facilitate content publishing, media distribution, and post scheduling to Facebook Pages. This policy governs the data processed by REASEY Uploader and applies to authorized operators granted access to the tool.

The Application operates as an authenticated business tool connecting directly to the official Meta Graph API. It does not harvest public user data, operate ad networks, or trade in personal data.

REASEY Uploader uses official Meta Login (OAuth 2.0) to authenticate authorized users. During OAuth authorization, the Application requests only the following specific permissions:

• pages_show_list: Allows the Application to retrieve the list of Facebook Pages that the authenticated operator administers or edits.
• pages_read_engagement: Enables the Application to verify Page status and publishing prerequisites for reliable delivery.
• pages_manage_posts: Grants authorization to create, schedule, and publish posts, photos, and video content directly to authorized Facebook Pages on your behalf.

Additionally, standard operator identity information (such as name, Facebook App-Scoped User ID, and contact email) is provided through the default Meta Login dialog to display the authenticated session within the application.

The Application does not request access to personal feeds, friend lists, direct messages, or personal timeline posting permissions.

Data is stored in a PostgreSQL database using Prisma ORM. The Application processes and stores the following categories of information:

• Operator Profile Data: Operator name, contact email, and Facebook App-Scoped User ID (ASID) returned during authentication.
• Facebook Page Metadata: Facebook Page IDs, Page names, categories, Page avatar URLs, and active status toggles.
• Encrypted Access Tokens: User access tokens and Page access tokens obtained from Meta, protected via application-layer encryption.
• Publishing Jobs & Captions: Post captions, scheduled publishing timestamps, time zone configurations, order indexes, delivery statuses, retry counts, error messages, and returned Facebook Post IDs.
• Media Asset Metadata & Files: File names, file sizes, MIME types, and staging storage keys for uploaded images and videos. Uploaded media files are staged on protected server storage.

Access tokens granted via Meta OAuth represent authenticated authorization to communicate with Meta Graph API endpoints. We implement rigorous protection mechanisms in application code:

• Application-Layer AES-256-GCM Encryption: Both user access tokens and Page access tokens are encrypted in application code using AES-256-GCM with a unique 12-byte initialization vector (IV) and a 16-byte authentication tag before being persisted in PostgreSQL.
• No Plaintext Storage: Tokens are never stored in plaintext within the database or logged to server stdout/stderr.
• Excluded from Client Responses: Server API routes explicitly exclude token fields from JSON payloads sent to browser clients. Plaintext tokens exist in memory only temporarily when dispatching authorized API calls to Meta.
• Encrypted Transmission: All communications with Meta Graph API and client web sessions use encrypted HTTPS (TLS) connections.
• Strict Usage Scope: Tokens are used exclusively to execute authorized publishing actions on behalf of the designated Page, and are never shared or sold.

Information processed by REASEY Uploader is strictly utilized to:

• Authenticate the authorized operator session.
• Display authorized Facebook Pages in the publishing interface.
• Format, queue, and dispatch media content to official Meta Graph API endpoints.
• Reconcile publishing status and provide audit feedback to the operator.
• Diagnose operational API errors, rate-limit warnings, or network timeouts.
• Comply with Meta Platform Policies and applicable legal standards.

We do not sell, rent, monetize, or trade any operator or Page data. Data is shared only with the following external services required to operate the workflow:

• Meta Platforms, Inc. (Graph API): Publishing operations, media uploads, and token verifications communicate directly with official Meta Graph API endpoints (`graph.facebook.com`). All interactions with Meta are governed by the Meta Privacy Policy and Meta Platform Terms.
• Hosting & Database Infrastructure: Server hosting and PostgreSQL database services utilized for running the application and storing encrypted records under strict confidentiality.

Under the current application implementation:

• Encrypted Access Tokens: Retained in PostgreSQL during the active operational period or until replaced during re-authentication or manually removed upon request.
• Uploaded Media Files: Media files uploaded by operators are staged on server storage and remain stored unless manually deleted through administrative maintenance. Deleting an individual publishing job removes only the queue record; it does not delete the associated media asset or unlink the file from disk.
• Publishing Records: Completed or failed publishing job records remain in the database for operational reporting and error auditing until manually cleared.

Because the application does not have an automated account-deletion or media-deletion API, complete purging of stored data requires submitting a request to the operator for manual administrative processing. For details, see our Data Deletion Instructions.

The Application does not include an in-app Facebook disconnect button or token deletion endpoint. You maintain full self-service control to revoke REASEY Uploader's access directly through your Facebook account:

1. Log in to Facebook and open Settings & Privacy > Settings.
2. In the navigation menu, select Apps and Websites (or Business Integrations).
3. Locate REASEY Uploader in your list of connected applications.
4. Click Remove and confirm. Meta will immediately invalidate all user and Page access tokens granted to the application.

To request that previously stored database records, encrypted tokens, and uploaded media files be completely removed from the application server, please submit an administrative request as outlined below.

If you have questions regarding this Privacy Policy, wish to exercise your data protection rights, or need assistance regarding token revocation or data erasure, please contact: