01 Who we are
X-OPP SMM is a social media management app available at x-oppsmm.com. X-OPP SMM is operated by DELEMONTECHNOLOGY FOR MARKETING AND PR, a company registered in the United Arab Emirates, which is the data controller for the purposes of this policy. It lets an organisation manage several client brands and publish content to their connected social media accounts from one place.
In data protection terms, we act as the data controller for the account information of people who sign up to X-OPP SMM, and as a data processor for the client brand information and post content that you choose to store in it.
The short version. We collect what is needed to run X-OPP SMM and nothing more. We never sell your data, never use it for advertising, and never post to your accounts unless you explicitly tell us to.
02 What we collect
Everything below is data you enter or authorise. We do not buy data or scrape it from elsewhere.
| Category | What it includes | Why |
|---|---|---|
| Account | Email address, first and last name, hashed password, role (admin, editor, viewer), sign-up date | To create your login and control what you can do |
| Organisation | Organisation name, initials, subscription plan | To group your team and clients together |
| Client brands | Brand name, industry, brand colour, initials, and the optional brand kit (voice, signature, preferred hashtags, banned words) | To organise posts by the brand they belong to, and to keep posts on-brand |
| Connected accounts | Platform name, handle or username, page or channel ID, public profile URL, access and refresh tokens | To publish on your behalf to the accounts you connect |
| Content | Post text, uploaded images and videos, video cover images, scheduled and published times | To compose, schedule and deliver your posts |
| Delivery records | Per-platform post ID, success or failure status, error messages, reach figures | To show you what published successfully and what did not |
| Approvals | The name and note typed by whoever opens an approval link you share, their decision, and when they made it | So your client can approve a post or ask for changes without an account |
| Inbox (only if turned on) | Private messages sent to the account and the account's replies, comments and replies on posts published through X-OPP SMM, with the sender's name or username and the time | To show those conversations in one place, send the replies you write, and send the automatic replies you set up |
| Automatic replies (only if you set them up) | The rules you create (their text, keywords and working hours) and a record of each automatic reply: which rule, which conversation, when, and whether it was delivered | To send the replies you wrote at the right moment, and never twice to the same message |
| AI assistant usage | Who made each request, what kind it was, which provider handled it, and when | To apply the workspace's monthly limit (the text itself is not kept) |
| Technical | Server logs containing IP address, browser user agent, and timestamps | Security, debugging and abuse prevention |
We do not collect payment card details on our servers, and we do not use advertising trackers, analytics pixels, or third-party cookies anywhere in the application.
04 How we use your information
- To authenticate you and keep your session active
- To publish the posts you create to the accounts you have selected
- To show delivery results, error messages and reach figures on your dashboard
- To keep connections working by refreshing expiring tokens
- To diagnose faults, prevent abuse and keep X-OPP SMM secure
- To contact you about service issues or account matters
We do not use your content or connected account data to train machine learning models, to build advertising profiles, or for any purpose you have not asked for. The only time post text or inbox messages go to an AI service is when someone in your workspace uses the optional AI assistant, described in Who we share it with.
06 How we protect it
- Encryption in transit. All traffic is served over HTTPS with a valid TLS certificate.
- Encryption at rest for tokens. Social media tokens are Fernet-encrypted before storage, as described above.
- Password hashing. Passwords are stored using Django's PBKDF2 hashing with a per-user salt. They are never recoverable, even by us.
- Scoped access. Every API request is authenticated with a short-lived signed token, and every query is restricted to your own organisation's records.
- Session expiry. Access tokens expire after 8 hours; refresh tokens after 7 days, and are rotated and blacklisted on use.
No system is perfectly secure. If we ever become aware of a breach affecting your data, we will notify you without undue delay.
07 How long we keep it
- Account and organisation data — for as long as your account is open.
- Connected account tokens — until you disconnect the account, at which point the token is erased immediately.
- Posts and delivery records — retained as your publishing history until you delete them or close your account. Uploaded images and cover images are kept with them.
- Inbox messages and comments — kept while the inbox is on for that account; erased straight away when you disconnect the account, or when you or the platform ask us to delete your data.
- Uploaded videos — deleted from our server automatically a few days after upload, once no scheduled or unsent post still needs them.
- Server logs — kept for a short period for security and debugging, then rotated out.
Note that content already published to a social platform lives on that platform and is governed by its rules. When you delete a post from X-OPP SMM, you can choose to delete it from Facebook, Threads, LinkedIn, Pinterest and Tumblr at the same time. On every other platform, and whenever you don't choose that, the post stays up and you will need to delete it there yourself.
08 Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Have your data deleted
- Receive a copy in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time by disconnecting an account
To exercise any of these, email us using the address in the Contact section. We will respond within 30 days.
09 Deleting your data
Disconnect a single account
Open the brand on the Brands page and press Disconnect on the account. Its stored tokens, handle, page ID and profile details are erased from our database straight away. We recommend also revoking X-OPP SMM from that platform's own app settings.
Delete everything
Email us from the address on your account asking for deletion, and we will erase your account, your organisation's brands, all stored tokens, and your posting history.
Facebook data deletion requests
If you connected through Facebook, you can also request deletion from Facebook directly, under Settings & Privacy → Settings → Apps and Websites. Facebook will notify our callback endpoint and we will remove the associated data:
https://x-oppsmm.com/api/oauth/facebook/data-deletion/
Threads
If you connected a Threads profile, you can remove X-OPP SMM from inside Threads, under Settings → Account → Website permissions. Threads notifies our callback endpoints, and we immediately disconnect that profile and erase its stored token:
https://x-oppsmm.com/api/oauth/threads/uninstall/
https://x-oppsmm.com/api/oauth/threads/delete/
YouTube
Disconnecting a YouTube channel in X-OPP SMM erases its stored tokens straight away. You can also revoke X-OPP SMM's access from your Google Account at myaccount.google.com/permissions; the next time X-OPP SMM tries to use the channel (at the latest within a day, when we check every connection), the connection is marked as needing to be reconnected and nothing more is uploaded. Press Disconnect, or ask us, and its stored data is erased straight away.
10 Cookies and browser storage
X-OPP SMM does not use advertising or tracking cookies. We store two items in your browser's
localStorage — a short-lived access token and a refresh token — purely to keep you
signed in between page loads. Clearing your browser storage signs you out and removes them.
11 Children
X-OPP SMM is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will delete it.
12 Changes to this policy
We may update this policy as X-OPP SMM evolves. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will notify you in the application or by email before it takes effect.
13 Contact us
Questions about this policy, or want to exercise any of your rights? Get in touch.
Data controller
DELEMONTECHNOLOGY FOR MARKETING AND PR
Service
X-OPP SMM
Website
03 Social media accounts you connect
X-OPP SMM can connect to the platforms below. Connecting is always initiated by you, one account at a time, and can be undone at any moment from the Brands page.
Coming soon: X (Twitter), Reddit and Snapchat. They cannot be connected yet, and this policy will describe them before they can.
What we ask each platform for
We request only the permissions needed to list the pages you manage and publish content to them. For Facebook and Instagram, that is the ability to see the Pages you administer (Meta's
business_managementpermission is needed to list Pages owned by a Business Portfolio; we use it for nothing else), read basic engagement figures, and publish posts. For LinkedIn, it is publishing to and reading the posts of the Company Pages you administer. For Pinterest, it is your profile name, your boards and pins, and creating pins. For Tumblr, it is your blog list and posting. For TikTok, it is your basic profile — account ID, display name and avatar (user.info.basic) — and publishing the photos and videos you choose, with the privacy setting you pick (video.publish); TikTok posts cannot be deleted through X-OPP SMM. When Snapchat opens, it will be your Public Profile's ID and name and posting the Stories and Spotlight videos you choose (snapchat-profile-api). For Threads, it is your Threads username and profile picture, and the ability to publish posts to your profile and delete the ones published through X-OPP SMM. For YouTube, it is your channel's name and ID (youtube.readonly) and the ability to upload the videos you choose to your channel (youtube.upload); we do not read, edit or delete your existing videos, comments or analytics. We do not request access to your private messages, friends list or contacts, and we never read or manage your advertising accounts. The one exception is the optional inbox (in early testing, not yet available to all workspaces): only if you turn it on for a Facebook Page, Instagram or Threads account do we also ask that platform for permission to read and answer that account's private messages and the comments or replies on posts published through X-OPP SMM. If you connect a WhatsApp Business number, WhatsApp sends us the messages your customers write to it (with their WhatsApp name and phone number or WhatsApp user ID) and their delivery and read receipts, and we send the replies you write. WhatsApp charges the number's owner for messages directly; we never see payment details.What we store
When you complete a connection, we store the account handle, its public profile URL, its page or channel identifier, and the access token the platform issues. Most platforms (including YouTube, TikTok, Pinterest and Tumblr) issue tokens that expire, so we also store a refresh token to keep the connection alive without asking you to log in again.
Tokens are encrypted at rest. Access and refresh tokens are never written to our database in readable form. Each one is encrypted with AES-128 in CBC mode with an HMAC-SHA256 signature (the Fernet scheme) before it is saved, using a key held only in server configuration and never stored alongside the data. They are decrypted in memory only at the moment a post is published, and they are never sent to your browser or exposed through our API.
We never see or store your social media passwords. Authorisation happens on the platform's own website, and we only ever receive a revocable token.
YouTube and Google user data
X-OPP SMM uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's own handling of your data is described in the Google Privacy Policy.
youtube.readonly), to show which channel is connected, and permission to upload videos and set their thumbnails (throughyoutube.upload). We do not read your existing videos, comments, subscribers, analytics or any other Google account data. We do not create aggregated or anonymised data sets from Google user data.X-OPP SMM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.