Plainly, how to have your data deleted

What we hold

When an account is connected to the portal, we keep:

The account connection. The account or Page name and ID, the handle, which permissions were granted, when it was connected, and when the connection expires.

The access token the platform gives us for that account. It is stored encrypted. It is used only to publish what a person has approved and to read results for those posts.

Drafts and queued posts. The caption text, images and links we prepared for that account, held in private storage until a post goes out, plus our own working copies of the same drafts.

Publish records. For each post we published: which account, which platform, when, the platform’s post ID and link, and whether it worked.

Results. Counts for those posts, such as likes, comments and reach, used in reports to the account’s owner.

We never see or store your Instagram, Facebook or LinkedIn password: you sign in on the platform’s own screen. We do not ask for access to your private messages. We store counts of likes and comments, not the names of the people who left them.

We do not use any of this to advertise to anyone, and we do not sell it. It is shared only with the account’s owner, with the platform it came from, and with the hosting and database providers that store it for us and may use it for nothing else.

Three ways to remove it

Switch our access off yourself, right now. This does not depend on us. In the platform’s own settings, find the list of apps and websites you have connected and remove “Studio Lucky Bamboo Loop”. On Facebook that is Settings & Privacy, then Settings, then Apps and Websites. On Instagram, look in your account’s settings under Apps and Websites. On LinkedIn, look in your settings for the list of services you have given access to. The token we hold stops working, and we cannot publish to or read from that account again unless you reconnect it.

Ask us to disconnect it. Email us and we will remove the connection and delete the stored token, the same business day we confirm your request.

Ask us to delete everything. Email us a deletion request, described below. Removing us in the platform’s settings does not by itself delete what we have stored, so if you want the stored data gone as well, please also send the request.

How to send a deletion request

Email jammy.phan@studioluckybamboo.com with the subject “Data deletion request”. Please include:

Your name and your business name.

The platform (Instagram, Facebook or LinkedIn) and the account, Page or handle.

Whether you want everything deleted, or only the connection and token.

We may ask you to confirm that the request really comes from the person who controls the account, for example by writing from the email address we already have for your business. That is so nobody can delete a client’s records by pretending to be them.

You do not need to be a client to ask. If something about you is in our records because a client’s account shared it with us, for example your name appears in a post we prepared, email the same address, tell us which account and post, and we will remove it and let the account’s owner know.

What happens next, and how to check

Within 5 business days we reply to confirm we have your request and, if needed, ask you to confirm who you are.

Within 30 days of confirming, the deletion described below is done.

We email you when it is finished.

To check on a request at any point, reply to our confirmation email. A person answers in plain words: what has been deleted, what is still to do, and anything we are keeping and why.

What we delete, and what we keep

On a full deletion request we delete the connection record, the stored token, the drafts, queued posts and stored images and captions for that account, the publish records, the results counts tied to it, and our own working copies of the same material. If you only asked us to cut the connection, we delete the connection and the token and keep the rest until you tell us otherwise.

What we cannot or may not delete:

Posts already published stay where they are. They live on Instagram, Facebook or LinkedIn, not with us, and we have no way to remove them from there. You can delete any of them yourself from the platform.

Ordinary business records. An invoice, a payment record or a signed agreement with us may be kept for as long as tax and accounting rules require. These hold your business name and contact details. They do not hold platform tokens or platform data.

Routine backups. Our database provider keeps routine backups that may still contain the data until they expire on the provider’s normal schedule. We do not restore deleted data from a backup.

If we ever have to refuse part of a request, our reply says exactly which part and the legitimate reason.

Instagram and Facebook data

This is the data that comes to us from Meta, which runs Instagram and Facebook. For an Instagram professional account, we ask for permission to see the account’s ID and username and to publish a post you have approved. For a Facebook Page, we ask for permission to list the Pages you manage, publish an approved post to the Page you choose, and read the engagement counts for those posts. We store the IDs, the name or handle, the encrypted token, what we published and the counts, and use them only to publish and to report to you.

You can remove us in Facebook at Settings & Privacy, then Settings, then Apps and Websites, and Facebook also lets you send us a data deletion request from that same page. When you do, Meta passes the request to us through our app dashboard, and we delete whatever we hold from any connection made with that Facebook login, the same as if you had emailed us. We check that list regularly. You can still email us any time, and we will answer within the same timelines above.

Questions

Email jammy.phan@studioluckybamboo.com and a person answers. Our general privacy page is at studioluckybamboo.com/privacy/, and the terms for the portal are at studioluckybamboo.com/terms/.