Social Media CoPilot
App privacy policy
What the Social Media CoPilot app receives when you connect a LinkedIn, Facebook, Instagram or X account, what it does with it, who else sees it, how long it is kept, and how to have it deleted. Short version: it acts only on what people asked it to do, and it never sells data or uses it to profile anyone.
Last updated ·
What the app is
Social Media CoPilot is a publishing and engagement tool I build and operate. It connects to LinkedIn, Facebook, Instagram and X through their official APIs so that I, and the businesses I work with, can schedule and publish posts, answer the comments and messages those posts receive, and see how they perform.
It is not open to the public and has no sign-up: I create every account myself, for my own brands and for clients under a service agreement. This page covers the app only. The website bak-dev.com has its own privacy policy.
Who is responsible
The app is operated by Akram Bakhouche, freelance software engineer (bak-dev.com), who is responsible for the data it processes. When I run it for a client, I use that client's accounts only on their instructions. For anything about your data, write to me@bak-dev.com.
LinkedIn data
You connect a LinkedIn account by signing in on LinkedIn's own consent screen, which lists every permission the app asks for. The app never sees your LinkedIn password. Depending on the features in use, it receives:
| LinkedIn permission | What the app receives | What it is used for |
|---|---|---|
| Sign In with LinkedIn using OpenID Connect (openid, profile, email) | Your name, profile photo, LinkedIn member ID and email address | Knowing which LinkedIn account is connected, and labelling it in the dashboard |
| Share on LinkedIn (w_member_social) | Only the ID of each post the app creates | Publishing the posts you wrote or approved to your profile, at the time you chose |
| Community Management API (r_organization_admin, w_organization_social, r_organization_social) | The LinkedIn Pages you administer (name, logo, ID), the posts on them, and their comments, reactions and statistics | Publishing to the Pages you choose, showing how posts perform, and reading and answering comments from the dashboard |
| All of the above | An access token, and a refresh token when LinkedIn issues one | Making the calls above on your behalf. Tokens are encrypted before they are stored |
The app does not ask for, and never receives, your connections, your feed, your private messages, or any member's profile other than yours. What it never does with LinkedIn data:
- Post on its own initiative. It publishes only what you wrote or approved, or what a tool you explicitly authorised for that account sent it.
- Sell, rent, license or hand it to anyone, including advertisers and data brokers.
- Use it for advertising, to profile or track LinkedIn members, or to build lead lists.
- Combine it with data from other sources, or use it to train AI models.
- Reach LinkedIn any other way than through its official API, within LinkedIn's API Terms of Use.
Facebook, Instagram and X data
The same rules apply to the other platforms. When you connect them, the app receives:
- Facebook: the Pages you manage (name, ID), permission to publish on them, and the comments, reactions and Messenger conversations they receive. If you connect an ad account: the ads it runs and the comments on them. The app creates an ad only from a proposal a person approved, and the ad starts paused until a person activates it.
- Instagram: the professional account linked to your Page, its posts and statistics, and the comments, mentions and direct messages it receives.
- X: your handle and user ID, the replies and mentions your posts receive, and your direct messages.
Each platform's own privacy policy applies to what you publish there: LinkedIn, Meta, X.
If you comment on or message a connected account
If you comment on, react to, mention or message a Page or account managed with the app, the app receives what the platform sends about that interaction: your public name, username or ID, profile picture, what you wrote, and when. Only the people who manage that Page or account see it, so they can answer you. It is used for nothing else, and it is deleted with the account's data as described below.
Why data is processed
| Purpose | Legal basis (GDPR) |
|---|---|
| Publishing, showing statistics and answering comments for the accounts you connect | Performing the service you asked for (Art. 6(1)(b)) |
| Handling comments and messages from people who contact a connected account | The account owner's legitimate interest in answering them (Art. 6(1)(f)) |
| Keeping the app secure: access logs, rate limits, and a log of who did what | Legitimate interest in protecting the service and your accounts (Art. 6(1)(f)) |
There is no automated decision-making with legal or similar effects on anyone, and no data is sent to an AI service. If that changes, this page changes before the app does.
Where data is stored and how it is protected
- Everything is stored in a database on a server I operate myself. No third-party cloud, analytics or advertising service stores or reads it.
- The app is reachable only over HTTPS, at api.bak-dev.com.
- Access and refresh tokens are encrypted with AES-256-GCM before they are stored, and decrypted only in memory, for the call that needs them.
- Only people I give an account to can sign in, and each of them sees only the accounts of their own organisation.
- Images and videos uploaded for a post are stored on the same server, at an unguessable address the platforms fetch when they publish.
How long data is kept
| Data | Kept until |
|---|---|
| Tokens and the connected account's profile | You disconnect the account. They are deleted at once |
| Posts published to an account, and the comments, messages and statistics it received | You disconnect the account. They are deleted at once, with it |
| Everything held for a client | 30 days after our service agreement ends |
| Server access logs (IP address, time, request) | 90 days |
| Database backups | 30 days. A deleted record disappears from backups when they expire |
Disconnecting and deleting your data
You can remove the app's access, and your data, at any time:
- In the app: Accounts → Disconnect. The token and everything tied to that account are deleted immediately.
- On the platform: revoke the app in LinkedIn's permitted services, Facebook's business integrations or X's connected apps. The stored token stops working at once; to have the rest deleted too, email me.
- By email: write to me@bak-dev.com and say which account it is. Everything is deleted within 30 days, and I confirm when it is done.
Who else receives data
- The platforms you publish to receive what you publish, under their own policies.
- The client a Page or account belongs to, and the people they authorise, see that account's data. No client sees another client's data.
- The company that hosts my server, as a technical provider only.
No one else. I do not sell, rent or share the data, and no third-party analytics, advertising or AI service is built into the app. I would disclose data only if the law required it.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format. Write to me@bak-dev.com. I answer within one month. If you are not satisfied, you can complain to your data protection authority — in France, the CNIL.
Children
The app is a business tool and is not meant for anyone under 16.
Changes
When this policy changes, the date at the top changes with it. If a change widens what the app does with your data, the people who use it hear about it before it takes effect.