Privacy Policy

Welcome to AMS, operated by AGHRBA TECHNOLOGICAL SOLUTIONS ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our agency and business workspace, social media tools, websites, and related services (collectively, the "Service").

This notice explains our data practices. Your organization may also provide its own privacy notice for information it collects or manages using AMS, including information submitted through its forms or messaging accounts.

1. Information We Collect

1.1 Information You Provide Directly

We collect information that you voluntarily provide to us when you:

• Create an account: Name, email address, password, organization/business name, profile information
• Connect social media accounts: OAuth authorization tokens, social media account IDs, usernames, profile data
• Create and schedule content: Text, images, videos, links, captions, hashtags, and other content you create or upload
• Manage work and clients: Organization and team details, invitations, clients, brands, leads, contact details, CRM notes, projects, tasks, comments, approvals, time entries, files, documents, and shared links
• Manage financial work: Quotes, contracts, invoices, expenses, payment references, billing contacts, amounts, and other information entered into financial records
• Submit or manage forms: Submitted field values and attachments, contact information, submission time, and technical metadata such as IP address, browser information, and referring page where collected
• Use AI features: Prompts, conversation history, attachments, generated responses, agent instructions, knowledge sources, tool requests and results, feedback, and usage information. Provider credentials are collected when you configure your own connection.
• Use our services: Workspace settings, scheduling preferences, and notification preferences
• Contact us: Support inquiries, feedback, correspondence

1.2 Information Collected Through Social Media Integrations

When you connect your social media accounts to our Service using OAuth authorization, we collect and store:

• Access tokens and refresh tokens to authenticate and authorize posting on your behalf. Tokens are encrypted at rest.
• Account information: Username, profile name, profile picture, follower count, account statistics
• Permissions granted: Specific permissions you authorize (e.g., posting, reading insights, managing comments, messaging)
• Posted content: Copies of content you post through our Service
• Native post content: For platforms where supported (currently Facebook Pages), we read posts you published directly on the platform (not via our Service) so that comments on those posts appear in your unified inbox. We do not store the post content itself — only the platform's post ID and minimal metadata needed to associate the comments.
• Comments and replies: The text, author display name, author profile picture URL, timestamp, like count, and reply count for comments on your posts. Includes comments on both AMS-published posts and (for Facebook) native page posts.
• Direct messages (messaging-enabled platforms): When you grant the messaging permission for a platform (e.g., Facebook Messenger, Instagram DMs, LinkedIn messages, WhatsApp, Telegram), we sync conversation threads and individual messages so they appear in your unified inbox. This includes participant display names, profile pictures, message text, attachments, and timestamps. To populate participant names that the platform's bulk endpoints leave empty (common with Meta Messenger), we may make targeted per-user identity lookups using the platform-issued user ID (PSID for Messenger). We never read messages from conversations the platform has not exposed to your connected page/account.
• Partner / Business Manager accounts: If you grant Business Manager access (e.g., the business_management Meta permission), we enumerate Pages and Instagram accounts shared with your business so you can connect partner-managed brands. We only access accounts your Business Manager role permits.
• Real-time updates: If you enable real-time notifications, we subscribe your connected Page/account to the platform's webhooks (e.g., the Meta pages_manage_metadata permission) to receive new comments and messages for your connected account. Delivery and available controls depend on the platform and connection.
• Advertising and campaigns: Connected advertising account identifiers, campaigns, creatives, budgets, delivery settings, performance metrics, and lead or conversion data used by the advertising features you enable
• Analytics data: Engagement metrics, impressions, reach, likes, comments, shares, follower growth (as provided by the social media platform's API)

Platforms We Integrate With:

• Facebook (Meta) — Pages, comments, Messenger, insights
• Instagram (Meta) — Business / Creator accounts via Facebook Page, including partner Business Manager accounts; also standalone Instagram Login accounts
• Threads (Meta)
• LinkedIn — Personal profile and Company Pages (where you are an Admin)
• X / Twitter
• TikTok — Personal and TikTok Ads
• YouTube — Channels you own under a Google account, including Brand Accounts
• Pinterest — Boards and pins
• Reddit
• Tumblr
• Telegram — Bot API and personal sessions
• WhatsApp — Business platform connections and, where enabled, personal sessions; messages, contacts, media, and form responses are processed in your AMS workspace

1.3 Information Collected Automatically

When you use our Service, we automatically collect certain information:

• Usage data: Actions and activity records, feature usage, and service performance information
• Device information: Browser and device information included in requests to the Service
• Log data: IP address, access times, error logs, API calls
• Browser storage: Authentication state, language, theme, and other preferences stored using browser storage and, where used, cookies

2. How We Use Your Information

2.1 To Provide and Maintain the Service

• Create and manage your account and organization workspace
• Organize client relationships, projects, tasks, documents, financial records, and team collaboration
• Receive form submissions and route them to the organization operating the form
• Manage campaigns and advertising through the connected accounts and permissions you select
• Generate AI responses and run configured agents and authorized tools using relevant workspace context
• Authenticate your identity
• Enable you to connect social media accounts via OAuth
• Post content to your social media accounts on your behalf
• Schedule and publish posts at your specified times
• Retrieve and display analytics from your social media accounts
• Process your transactions and send related information
• Provide customer support and respond to your inquiries

2.2 To Improve and Optimize the Service

• Analyze usage patterns and trends
• Develop new features and functionality
• Improve user experience
• Perform testing and troubleshooting
• Monitor and analyze Service performance

2.3 For Security and Legal Compliance

• Protect against fraud, abuse, and unauthorized access
• Enforce our Terms of Service
• Comply with legal obligations and government requests
• Protect our rights, property, and safety, and that of our users and the public
• Detect and prevent security incidents

3. How We Share Your Information

We do not sell your personal information.

3.1 With Social Media Platforms

We share content (text, images, videos) with social media platforms on your behalf when you schedule and publish posts. We transmit access tokens to social media platform APIs to authenticate and authorize actions. This sharing is necessary to perform the core functionality of the Service.

3.2 With Service Providers

We may share your information with third-party service providers who perform services on our behalf:

• Cloud hosting providers for data storage and processing
• Analytics providers to analyze usage and improve the Service
• Email service providers to send notifications and communications
• Payment processors to process transactions
• Customer support tools to provide support services
• AI providers to process the inputs and context needed for AI features, as described below

The providers involved depend on the services and connections in use. Their applicable terms and privacy notices also govern their processing. Contact us for information about providers involved in your workspace.

3.3 With Your Team Members

If you invite team members to your organization within the Service, they may have access to content created and scheduled within your organization, social media accounts connected to your organization, analytics and reporting data, and organization settings and preferences. Access levels are controlled by role-based permissions you configure.

3.4 AI Features and Connected Tools

When you use an AI assistant, or your organization enables an AI agent, AMS sends the relevant prompt, conversation context, attachments, instructions, and tool results to the configured AI provider. An agent connected to an inbox may process incoming messages and related customer or workspace context to generate replies or perform configured actions. Provider selection may include an organization-configured fallback. Using your own provider credentials does not mean the data stays only in AMS.

AI inputs, outputs, and activity records may be stored in your workspace for conversation history and operation of the feature. The external provider's retention and data-use terms depend on the provider and account configuration; this policy does not promise a universal provider retention period or model-training setting. Only include information you are authorized to share.

3.5 Forms, Shared Content, and Organization Access

Organizations choose the content they enter, forms they publish, recipients they contact, and access they grant. A form submission is made available to the organization operating that form and may be used in its client or lead workflows. Content shared through a public link may be accessible to anyone with that link, depending on its access settings. Contact the relevant organization about its use of your information; you can also contact AMS for assistance identifying or handling a privacy request.

4. Data Storage and Security

4.1 Data Storage

• AMS stores workspace records and files in the infrastructure used to operate the Service
• Social media access tokens are encrypted at rest using AES-256 encryption
• Connected services process information on their own infrastructure; locations and retention may differ by provider

4.2 Security Measures

We implement appropriate technical and organizational measures to protect your information:

• Encryption: The public Service uses HTTPS. Social connection tokens and configured AI provider credentials are encrypted at rest.
• Access controls: Organization, role, and resource permissions govern access to workspace features and records
• Operational records: Service and security logs support troubleshooting and abuse investigation
• Account protection: Authentication and available account security settings help control access

4.3 Data Retention and Erasure Requests

Workspace records are retained while needed to provide the Service and for applicable legal, billing, and security purposes. Some removal actions archive or hide records rather than permanently erase them. Cancelling a subscription, removing a member, or disconnecting an integration is not confirmation that all related stored data has been erased.

To request erasure of personal information or an account, follow the Account & Data Deletion instructions. Support handles the request, including the scope of organization-shared records and any legally required retention. We aim to respond within 30 days, or sooner where applicable requirements require it. This response target does not replace the earlier published commitments to delete personal information within 90 days after account deletion, limit backup persistence to 90 days after deletion, or delete connection tokens immediately on disconnection wherever those commitments apply. The account-deletion page also preserves its earlier request-handling commitments. Missing automation does not waive an applicable deadline. Specific Google and YouTube requirements are described in section 6.4.

However, please note that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Your Rights and Choices

5.1 Access and Portability

• Right to access: Request a copy of the personal information we hold about you
• Right to data portability: Receive your data in a structured, machine-readable format

5.2 Correction and Deletion

• Right to correction: Update or correct inaccurate or incomplete information
• Right to deletion: Request deletion of your personal information (subject to legal retention requirements)

5.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: [email protected]

We will respond to your request within 30 days (or as required by applicable law). To request deletion of all your data, see our Account & Data Deletion page.

5.4 Account Management

You can directly manage many aspects of your information through your account settings:

• Update profile information
• Connect or disconnect social media accounts
• Delete content and posts
• Manage team member access
• Request account or personal-data deletion through support

6. Social Media OAuth and Data Access

6.1 OAuth Authorization

When you connect a social media account to our Service, you authorize us to access your account information as specified in the OAuth consent screen, post content to your account on your behalf, retrieve analytics and engagement data, and perform other actions based on the permissions you grant. You understand that you can revoke these permissions at any time.

6.2 Token Security

• Access tokens are encrypted using industry-standard encryption (AES-256)
• Token refresh is handled automatically and securely
• You can disconnect an account in AMS and revoke permissions directly with the provider

6.3 Revoking Access

You can disconnect any social media account at any time through:

• In the Service: Open the relevant social integration and use its disconnect action, subject to your workspace permissions
• On the social media platform: Revoke app access in your platform's app permissions settings

Disconnecting an integration stops its use in AMS. To revoke the provider authorization itself, also use that platform’s app permissions settings. Disconnecting does not remove content already published on the platform. Manage that content on the platform, or through an authorized feature that supports its deletion. For erasure of data stored by AMS, send a deletion request as described on our Account & Data Deletion page.

6.4 Google API Services and YouTube Data

AMS uses Google API Services and YouTube API Services to let you connect and manage the YouTube channels you own or administer. By connecting a YouTube channel and using these features, you agree to be bound by the YouTube Terms of Service, and you acknowledge the Google Privacy Policy.

Depending on the permissions you grant on Google's OAuth consent screen, we access:

• Google account identity (userinfo.profile, userinfo.email) — to identify the Google account authorizing the connection.
• Your YouTube account and channel details (youtube.readonly) — to identify the channels you can publish to and display them inside AMS.
• Uploading and managing your videos (youtube.upload, youtube.force-ssl) — to publish, schedule, edit, and manage videos and their metadata, and related comments and captions, only on the channels you connect and only when you ask us to.
• YouTube channel analytics (yt-analytics.readonly) — to show the channel performance information available to your authorized account.

We use Google and YouTube data solely to provide the channel-management, scheduling, publishing, analytics, and engagement features you request. We do not use it for advertising, we do not sell it, and we do not transfer it to third parties except as needed to deliver the feature (for example, sending your video to YouTube for publishing) or as required by law. Google and YouTube authorization tokens are encrypted at rest. You can review or revoke AMS's access at any time from your Google Account permissions page.

AMS's use of information received from YouTube API Services is also subject to the YouTube API Services Developer Policies.

To request deletion of Google or YouTube data held by AMS, email [email protected] with the subject “YouTube Data Deletion” and identify the connected channel and AMS account. YouTube's rules require deletion within 7 calendar days of a user's stored-data deletion request or revocation through an API client, and within 30 calendar days of revocation through Google's permissions page. These requirements take priority over general retention periods. Deleting AMS-held data does not delete content on YouTube.

6.5 Limited Use Disclosure

AMS's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Regional Privacy Rights

Depending on your location and the law that applies to the processing, including applicable European and UK data-protection law, you may have the rights described below. Availability and exceptions depend on the request and applicable law.

7.1 Legal Basis for Processing

We process your personal data based on:

• Performance of a contract: To provide the Service you requested
• Legitimate interests: To improve the Service, prevent fraud, ensure security
• Consent: For marketing communications and non-essential cookies (where required)
• Legal obligation: To comply with applicable laws

7.2 Your Privacy Rights

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

8. Cookies and Tracking Technologies

8.1 Browser Storage and Embedded Services

AMS uses browser storage for authentication state and preferences such as language and theme. Connected payment services, embedded content, and organization-published pages may use their own cookies or similar technologies. The organization operating a published page is responsible for explaining any tracking it configures and obtaining consent where required.

8.2 Your Controls

Your browser settings let you inspect or clear stored data and control cookies. Clearing authentication or preference storage can sign you out or reset settings. Review the relevant provider's notice when you use embedded or connected services.

9. Children's Privacy

Our Service is not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at [email protected]. We will promptly delete such information from our systems.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will provide prominent notice (email notification, in-app notification, or notice on our website)
• Where required, we will seek consent before processing information for a new purpose

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

AGHRBA TECHNOLOGICAL SOLUTIONS

• Email: [email protected]
• Website: https://ams.aghrba.com

Response Time: We aim to respond to all privacy inquiries within 30 days.

For privacy requests, contact [email protected]. For information collected by an organization using AMS, also consult that organization’s privacy notice.

Last Updated: October 17, 2026 | Version: 1.2