Privacy Policy

1. Who We Are

Blynkx is a social media operations platform that helps teams publish content, manage approval workflows, schedule posts, and monitor publishing operations across multiple social media channels.

Data Fiduciary: Blynkx (blynkx.com)
Grievance / Privacy Contact: privacy@blynkx.com

2. Personal Data We Collect

a) Account and Authentication Data

• Email address and hashed password (if using email/password sign-in)
• Name and profile details you provide
• Session tokens and sign-in timestamps
• IP address and user-agent (for security logging)

b) Social Account Connection Data

• OAuth access and refresh tokens for connected social platforms (e.g. Twitter/X, Facebook, LinkedIn, Instagram)
• Provider account name, profile picture URL, and provider account ID
• Connection status and last authorisation timestamps

c) Post and Content Data

• Post text, title, and scheduling details you create within the platform
• Target social accounts and publishing status
• Approval workflow history (who submitted, approved, or rejected a post)
• When you select a connected account in Post history: available post text, dates, links, IDs, platform-hosted thumbnail URLs and available numeric engagement and view counts (such as views, reach or impressions, where the platform provides them). Older pages load as you scroll. This viewing does not create a saved import; results remain in the open page's memory and are discarded when you leave or reload.
• If a workspace account manager chooses to import history: available published post text, original publication dates, post links, and social-account/post IDs, including posts published before joining Blynkx
• For history imports: the requesting user ID, confirmation time, import position, progress, and safe error messages. History import does not collect comments, audience profiles, or media files.

d) Media Data

• Files (images, videos) you upload for use in posts
• File metadata: name, size, MIME type, upload timestamp, uploader identity
• Images generated in AI Studio, including images sent for an automated visible-text review when you request wording in the design

e) Usage and Operational Data

• Action logs for audit purposes (actor ID, action type, request ID, timestamps)
• Error and performance telemetry (no post content included in system logs)
• Feature usage patterns to improve the platform

We do not sell your personal data to third parties, and we do not use post content for advertising profiling.

3. How We Use Your Data

4. Data Sharing and Sub-Processors

We share personal data only as necessary to operate the platform. Our current sub-processors include:

• Cloud infrastructure (AWS) — for hosting, database, and media storage
• Social platform APIs (Twitter/X, Facebook/Meta, LinkedIn, Instagram, YouTube) — to connect your accounts and fulfil the publishing, reporting, and optional post-history requests you make. LinkedIn personal-profile history is not imported.
• Identity provider (Keycloak, self-hosted) — for SSO authentication, operated by us
• Google Gemini API and fal.ai — for AI design assistance, confirmed image generation, and automated wording checks described below

We do not share your personal data with marketing partners, data brokers, or analytics providers beyond what is necessary for platform operations. Provider agreements, processing terms, retention, and transfer safeguards must be verified before general availability.

AI-assisted design features

If you use AI Studio, your messages, saved design conversation, selected reference images, and approved wording are sent to Google Gemini to help prepare a design. After you confirm image creation, the approved image prompt and selected reference images are sent to fal.ai to generate the image. When your design includes wording and the Gemini provider budget is available, Blynkx may also send each generated image to Google Gemini for an automated visible-text check. The check can miss errors; review the image before publishing. AI processing, applicable provider terms, retention, transfer safeguards, and the lawful basis for this processing remain subject to privacy/legal review before general availability.

5. Data Retention

• Account and profile data: Retained for the duration of your active account, plus a grace period post-deletion request.
• Social account tokens: Retained until you disconnect the account or the token expires/is revoked.
• Post content and media: Retained for the duration of your account unless you delete individual items.
• Imported social-post copies: Expire 90 days after their last retrieval, not 90 days after the original post date. The history worker removes expired copies and import records inactive for 90 days. An account manager can remove imported history and cancel its import sooner; disconnecting the social account also removes its imported copies. These actions do not delete posts on the social platform or posts created in Blynkx.
• On-demand Post history: Account selection and scrolling read posts without saving imported copies. Results are held in the mounted page's memory, with a five-minute freshness window for reuse, and discarded when you leave or reload. Thumbnails load directly from social-platform CDNs. The older imported-copy retention rule above still applies to any previously saved imports.
• Session tokens: Expire after 8 hours of inactivity (cookie-based, not server-stored).
• Audit and system logs: Retained for up to 90 days on a rolling basis. Logs contain only operational identifiers — no post content.

Specific retention windows will be published in an updated version of this policy prior to general availability.

6. Your Rights as a Data Principal (DPDP Act 2023)

Under the Digital Personal Data Protection Act 2023, you have the following rights:

• Right to information — Know what personal data we process and the purposes for which it is used.
• Right of access — Request a summary of your personal data held by us.
• Right of correction and erasure — Request correction of inaccurate data or erasure of data we no longer need.
• Right to withdraw consent — Withdraw consent for optional processing at any time (e.g. disconnect a social account, delete posts). Withdrawal does not affect lawfulness of processing prior to withdrawal.
• Right to grievance redressal — Raise a grievance with our Grievance Officer (see Section 8).
• Right to nominate — Nominate another individual to exercise rights on your behalf in case of death or incapacity.

To exercise any of these rights, contact us at privacy@blynkx.com. We will acknowledge your request within 72 hours and respond within 30 days.

7. Cookies and Tracking

We use a minimal set of cookies necessary to operate the platform:

• Session cookie (blynks-session) — Stores your encrypted session after sign-in. Expires in 8 hours. HttpOnly, Secure, SameSite=Lax.
• OAuth state cookie (blynks-oauth-state) — Short-lived token used only during the social account connection flow. Deleted on completion. HttpOnly, Secure, SameSite=Lax.

We do not use third-party tracking cookies, advertising pixels, or behavioural analytics cookies.

8. Grievance Officer

If you have a complaint about how we handle your personal data, you can raise it with our Grievance Officer:

9. Data Security

We implement technical and organisational measures to protect your personal data, including:

• Encrypted storage of passwords using bcrypt
• HTTPS-only transport for all data in transit
• Session tokens stored as signed, HttpOnly cookies — never accessible to browser scripts
• OAuth tokens stored server-side only, never exposed to the client
• Role-based access controls (RBAC) limiting data access to authorised users and roles
• Audit logging for sensitive operations

In the event of a personal data breach that is likely to result in harm to you, we will notify you and the Data Protection Board of India in accordance with the DPDP Act 2023.

10. Cross-Border Data Transfers

Your data may be processed on infrastructure located outside India (including AWS regions). Where personal data is transferred cross-border, we apply appropriate safeguards in accordance with the DPDP Act 2023. We will update this section with confirmed data residency details prior to general availability.

11. Children's Privacy

Blynkx is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us at privacy@blynkx.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top and, where changes are material, notify registered users by email or in-app notification at least 15 days in advance. Your continued use of Blynkx after the effective date constitutes acceptance of the updated policy.