Legal
Privacy Policy
Last updated: October 1, 2026
This Privacy Policy is provided by Meinich Bache Apionics ("we", "us", "our"). It explains how Apionics processes data for the Instagram workspace features available in the product. It also covers connected LinkedIn features, YouTube API Services, and TikTok for Developers Native APIs when a workspace chooses to use them. Separately authorized Facebook Pages, Instagram through Facebook Login, and Google Business Profile features are covered below. Their availability depends on provider access and the permissions actually granted.
1. Data We Collect
We collect only the information necessary to provide the Instagram workspace features you use:
Account data such as workspace user details, connected Instagram Business account identifiers, account labels, status, and connection health
Message content and conversation metadata from connected Instagram accounts, where access has been granted and the inbox feature is used
Comment data retrieved when a workspace user explicitly synchronizes comments, including comment text, commenter identifiers, username and profile image when returned by Instagram, timestamps, related media context, reply records, and moderation state
Publishing data such as post titles, captions, uploaded media, selected destination accounts, scheduling choices, and publishing status
Analytics and account-health data available through the permissions granted for a connected account
Activity data such as sign-in events, account connection changes, publishing workflow events, status updates, and audit log entries
Dashboard sign-in data, including username and hashed password for workspace access
For YouTube API Services: the connected channel ID and title; encrypted Google access and refresh tokens and granted-scope/expiry metadata; and the video ID returned for a successful upload. Upload titles, descriptions, tags, category, privacy choices, and source video files are supplied by the workspace user. Video listings, comments and replies, playlists, and Analytics are fetched on demand and are not stored as database results.
For connected LinkedIn accounts: member identity, selected Company Page identifiers, encrypted authorization tokens and grant/expiry metadata; user-supplied organic posts, comment/reply/edit text, reaction choices, scheduling choices, operation outcomes and media identifiers. Uploaded files, optional English captions and thumbnails are temporarily staged privately for delivery to LinkedIn and removed after the attempt. Profile, post, comment, reaction and analytics results are fetched on demand. Signed Company Page activity notifications retain only identifiers, action and timestamps for up to seven days, not decorated message bodies.
For TikTok for Developers Native APIs: the TikTok creator ID and the identity/profile fields the user authorizes; encrypted TikTok access and refresh tokens, granted TikTok scopes, and token-expiry metadata; current profile and statistics fields; and recent public videos and the current counters TikTok returns. Profile statistics, video listings, and their counters are fetched for the current request and are not stored as database results. When a user prepares a post, Apionics stores the user-supplied caption or title, post settings, scheduled time, consent actor and time, publication status, and any TikTok video identifier returned by TikTok. Selected video or photo files become private staged media in Apionics storage for delivery to TikTok.
The current TikTok connection uses TikTok for Developers Native APIs only. It does not access TikTok API for Business account or advertiser data, comments, mentions, Business Messaging inbox messages, or TikTok One creator-collaboration records.
2. How We Use Your Data
Your data is used to:
Authenticate dashboard and workspace access
Display connected Instagram accounts and the functionality supported by granted permissions
Support manual inbox review and replies for connected Instagram accounts
Support explicit comment synchronization, manual comment replies, and supported hide or unhide moderation actions
Support post preparation, media upload, destination selection, scheduling, and publishing status tracking
Show available analytics, account health, and workspace status
Maintain audit logs, connection status, security records, and operational support records
Use Google authorization to identify the selected YouTube channel and, when a workspace user requests it, list and manage videos, publish uploads, moderate comments, organize playlists, and show available Analytics
Publish and schedule user-selected organic LinkedIn posts and media for an authorized member or Company Page, and support explicitly requested post/comment edits, replies, reactions, available insights and Company Page activity notifications, subject to the actual granted permissions and Page role.
Disconnecting LinkedIn removes the account connection, media references and activity notifications, and cancels unsent schedules. Completed publication history remains in the workspace with the account association cleared. A shared authorization is retained only while another connected account in the same workspace uses it. Disconnect does not remove posts or comments already published on LinkedIn.
Use the TikTok for Developers Native APIs, when the user has granted the relevant scopes, to display creator profile information, current statistics and recent public videos, and to stage, publish, schedule, or hand off user-selected media to TikTok
3. Permission-Based Access
Instagram account access is permission-based. A user chooses which Instagram Business account to connect and grants access through the account connection flow. Apionics only displays workspace functionality supported by the permissions granted for that account. The connection can be removed later through Apionics account controls where available and through the connected account permission controls. Google, LinkedIn, and TikTok connections are separate from Instagram. A TikTok user authorizes requested TikTok for Developers scopes through TikTok; TikTok may let the user grant only a subset of the requested scopes. Apionics uses only scopes actually granted and does not treat a Developer scope as permission for TikTok API for Business, Business Messaging, or TikTok One. Before a workspace member first uses YouTube API-backed features, Apionics displays this policy and requires affirmative acceptance of the current YouTube privacy notice. Acceptance is recorded with the authenticated user, workspace, policy version, and time. Material changes to the covered YouTube data practices can require renewed acceptance. A workspace member can disconnect a provider account in Accounts, or revoke access through that provider.
4. Data Storage & Security
Connected account access tokens are encrypted before storage. Dashboard passwords are hashed, workspace credentials are protected, and the service is provided over HTTPS. We do not sell or rent your data. Instagram access tokens are used only for permission-based features you enable. Google YouTube access and refresh tokens are encrypted and used to perform YouTube operations you request and periodic checks that the authorization remains active. TikTok access and refresh tokens are encrypted and used for TikTok operations requested by workspace users and the applicable authorization lifecycle. TikTok requests send selected profile/video reads or user-selected post media to TikTok; media is not sent until the user has confirmed the exact request. Apionics hosting and infrastructure providers process locally stored data to operate, secure, and support the service. YouTube API data is not sold, used for advertising, or sent to general-purpose AI model training.
GA4 and Search Console authorizations are separate from social-provider connections. Apionics stores encrypted access and refresh tokens, the authorizing Google identifier, granted scopes and expiry, and the property or site you explicitly select for your workspace. Reports, metric definitions, search queries, indexing and sitemap results are fetched for the current request and are not stored as report payloads in the database. Disconnecting this measurement authorization removes its local credentials and connected properties, not data held by Google. It does not revoke other Google product grants. You can revoke Google access in Google Account connections; revoking a shared OAuth client may also affect its other Google grants. These results are not sold, used to train general-purpose AI models, or repurposed for advertising.
Google Merchant Center and Tag Manager authorizations are separate from Analytics, Search Console, YouTube, and social-provider connections. Apionics stores encrypted access and refresh tokens, granted scopes, expiry, and the Merchant account or Tag Manager account selected for the workspace. User-requested product, feed, inventory, promotion, report, tag, trigger, variable, and container operations are sent to Google only for the selected account. For writes, Apionics records the operation type, target resource, status, and a one-way request fingerprint; request bodies and access tokens are not retained in those operation records. A customer loyalty identifier is sent to Google only after the workspace user confirms a lawful basis and customer consent, and the identifier is removed from the response displayed by Apionics. Unresolved operation receipts are retained to prevent an unsafe retry; disconnect clears the local account association and workspace deletion removes the receipts. Removing a connection does not delete resources already held by Google.
If you explicitly request Google Merchant Product Studio, the product text attributes and selected public image URL are sent to Google for that generation request. Google-generated text or image results are shown in your current Apionics browser session and are not stored in Apionics. If you configure Universal Commerce Protocol settings, the selected public UCP profile URL is sent to Google for asynchronous validation; Apionics retains only the provider operation name, status, and request fingerprint while that operation is unresolved.
Chrome UX Report and PageSpeed requests send the public HTTPS URL to Google. Google may fetch and analyze the requested public page as part of PageSpeed. Apionics does not persist the requested URL or report payload; results are held only in the current browser view. Use only public pages you are authorized to analyze.
Google Ads requires a separate advertising authorization and an advertiser you explicitly select. Apionics stores encrypted credentials, granted-scope/expiry metadata, the authorizing Google identifier, and the selected advertiser/manager identifiers, currency and reporting timezone. Campaign, budget and performance results are read on demand and are not stored as report payloads. An explicitly confirmed change records its requested operation, status, returned resource identity and a provider request identifier where available, so an uncertain change is not automatically repeated. Validation-only requests do not change campaigns or spend. Removing a local advertising connection does not delete campaigns held by Google or revoke other Google product grants; unresolved changes must be checked first. Account removal deletes local routing and request receipts; detached operation history can remain until workspace deletion. Disconnecting the full advertising authorization deletes its local accounts, credentials and operation records. Advertising features do not reuse YouTube data or measurement results for targeting.
5. Retention and Data Deletion
Apionics keeps workspace data for as long as it is needed to provide the requested workspace features, support security and auditability, or meet legal and operational requirements. You can request deletion of your workspace data by following the instructions on the Data Deletion page or by emailing [email protected]. YouTube channel ID/title are refreshed with the existing daily authorization check. If the channel identity cannot be refreshed within 30 calendar days, Apionics clears those API-returned identifiers/titles and pauses YouTube tools for that connection. A current Google channel lookup cannot verify continuity with the identity that was erased, so Apionics will not reattach retained publication history to it. The connection owner must remove the expired connection in Accounts and connect again; while any such identity remains unresolved, new YouTube channel connections are paused across workspaces to prevent duplicate ownership. YouTube-returned video IDs are deleted from Apionics after 30 calendar days; video publication history and user-supplied upload metadata are not refreshed from the API for this purpose. Analytics/statistics responses, video listings, comments, replies, and playlists are fetched for the current request and are not persisted in Apionics' database. Temporary upload files are removed after successful upload; stale incomplete files are removed under the upload cleanup schedule. In Accounts, remove the YouTube connection to delete the connected channel's Apionics-stored YouTube records as soon as the request is safely processed. When Google still accepts a stored credential, Apionics requests authorization revocation. If Google has already rejected the stored grant, remove any remaining access in your Google Security Settings. An active or unresolved upload/publication must first be resolved, so that the API result is not lost or replayed. Confirmed invalid Google grants trigger local cleanup. Internal security/audit records and the privacy-acceptance record may remain; they do not contain raw YouTube API payloads. Other workspace deletion requests are handled as soon as possible and within 30 days where technically and legally possible. For TikTok, profile statistics and recent public video results are fetched for the current request and are not stored as database results. Staged media that has never been submitted and is not associated with a publication is automatically deleted after 24 hours without upload or publish activity. Media associated with a draft or publication follows its existing lifecycle: it is retained while a schedule or unresolved result requires it, then removed after successful publication or draft transfer, a final failure, schedule cancellation, or creator disconnection. If a publication result is unresolved, staged files are retained until the result is resolved so Apionics can preserve its state and avoid blindly repeating a send. TikTok publication metadata, returned video IDs, settings, and consent/audit records may remain in workspace history after disconnection, with the account association cleared. Verified TikTok events update publication status and retain only event types, native publish/post identifiers, event timestamps, a delivery fingerprint and a limited failure category for the connected account. Raw webhook bodies and tokens are not retained. These event records are removed with account or workspace deletion. A TikTok authorization-removal event clears the matching credentials, cancels unsent schedules, requires reconnection and disables existing staged-media links; it does not resend unresolved publications or delete TikTok content. Removing a TikTok connection cancels its unsent schedules, removes its local credentials and staged media files, and requests TikTok authorization revocation. A schedule or publication with an unresolved send result must be resolved first; ambiguous sends are not automatically repeated. TikTok video identifiers, publication status, user-supplied settings, and consent/audit records may remain in workspace history after the connection is removed, with the account association cleared. Removing Apionics records does not delete videos or other content held on TikTok. Delete or manage that content directly through TikTok or an authorized API client. Removing data stored by Apionics does not delete videos or other content held on the YouTube channel. Delete or manage that content directly through YouTube or an authorized API client.
Facebook, Instagram interactions and Google Business Profile
For Facebook Pages, Apionics stores the selected Page identity, encrypted Page authorization, granted permissions and expiry, and the app-scoped identity of the person who authorized the Page. This person-to-grant mapping allows Meta's signed deauthorization and deletion requests to affect the correct records. Explicit publishing and Page-management actions store user-supplied content, result identifiers, status and an audit trail. Inbox refresh retrieves and stores supported Page conversations, participant identity, message text, native message identifiers and timestamps, including your manual replies, as account-scoped workspace history. Facebook conversations remain separate from Instagram conversations and do not enable automated replies. Page posts, comments and insights are retrieved on demand rather than stored as provider response payloads.
Facebook event receipts contain account associations, event types, provider identifiers and timestamps, not message text. Instagram interaction records also retain a limited comment excerpt and sender identity supplied with supported mentions and comments, so you can inspect and respond to the interaction. Neither stores raw webhook bodies or authorization tokens. These records are retained for up to 30 days. Instagram accounts connected through Facebook Login use separate account bindings and an encrypted Facebook User authorization; those credentials are not substituted into an existing Instagram Login connection.
For Google Business Profile, Apionics stores encrypted Google authorization, the authorizing identity, granted scopes and expiry, and selected business/location routing identifiers. The workspace supplies a location label. Profiles, reviews, media, posts, performance and management results are fetched on demand, with Google attribution preserved, and are not stored as response payloads. Google Pub/Sub notification receipts contain an event category, a hashed delivery identity, the local account association and receipt time, not the notification body or review text; receipts expire after seven days.
Google-returned location routing identifiers and related local result identifiers are removed after 29 days without a verified location selection or profile refresh. A local retention task runs hourly, and location tools also check expiry before use. You must select the location again after expiry. If an action had an uncertain result, Apionics retains a non-reversible, keyed location safety marker and the owning workspace ID to prevent blindly repeating it; workspace deletion removes that marker. Google API results are not used to train general-purpose AI models, sold, or repurposed for advertising.
GBP location creation and business-account changes also retain keyed request fingerprints, attempt identifiers, status and timestamps to prevent repeating an uncertain write after disconnect. These safety records do not contain the listing address, name, administrator email, verification PIN or provider response. Creation requires an owner request and Google validation before the explicit write; Apionics does not fabricate or automatically verify listings. Administrative changes require the operator to acknowledge a separate owner notice and send the actual result notice within 48 hours; Apionics records that acknowledgement but does not claim to have sent an email.
These tools act only on resources you are authorized to manage. Publishing, review replies, moderation and profile changes require explicit user actions. A notification does not authorize an automatic reply or profile change. Google Business Profile notifications use Google Cloud Pub/Sub; other changes can require a manual refresh, and delivery is not guaranteed to cover every field. Google Business Profile scheduling, where available, is a user-confirmed native Google schedule, not an unattended Apionics script.
Disconnecting a Google Business Profile grant clears its local credentials and selected location records, including when an earlier operation has an uncertain result; only the non-reversible safety marker described above remains. You can also revoke Apionics through Google Account connections; revoking a shared Google authorization may affect other Google features. Facebook Inbox history remains in the workspace until account/workspace deletion or a verified Meta deletion request. Removing a Facebook or Facebook-Login Instagram account clears its local account data, including Facebook conversations and messages; a shared authorization is retained only while another explicitly connected account still uses it. Meta deauthorization clears mapped credentials. A verified Meta deletion callback removes the associated local accounts, operation/event records, conversations, messages and credentials and returns a deletion-status receipt. None of these actions deletes your business listing, reviews, posts or messages held by Google, Facebook or Instagram. Active or uncertain Meta operations must be resolved before an ordinary account removal to avoid duplicate writes; signed Meta lifecycle requests still remove mapped access.
6. Third-Party Services
We connect to Instagram through permission-based access using permissions you explicitly grant. Your use of Instagram is also governed by Instagram's Privacy Policy and Terms of Service. Connected YouTube features use YouTube API Services and are subject to the YouTube API Services Terms of Service, the YouTube API Services Developer Policies, and the YouTube Terms of Service. Apionics's use of information received through Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You may revoke Apionics access in your Google security settings. See the Google Privacy Policy for Google's own processing. Connected LinkedIn use is governed by LinkedIn's terms and privacy policy. TikTok for Developers Native API use is governed by TikTok's applicable terms, Community Guidelines, Developer Terms, and developer policies. TikTok for Developers scopes do not grant access to its separate API for Business, Business Messaging, or TikTok One products. Connected YouTube features use YouTube API Services and are subject to the YouTube API Services Terms of Service, the YouTube API Services Developer Policies, and the YouTube Terms of Service. Apionics's use of information received through Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You may revoke Apionics access in your Google security settings. See the Google Privacy Policy for Google's own processing. Connected LinkedIn use is governed by LinkedIn's terms and privacy policy.
7. Contact Us
If you have any questions about this Privacy Policy or your data, please contact Meinich Bache Apionics at [email protected].
Also see our Terms of Service and Data Deletion instructions.