01 Who we are
X-OPP SMM ("the Service") is a social media management app available at x-oppsmm.com. X-OPP SMM is operated by DELEMONTECHNOLOGY FOR MARKETING AND PR, a company registered in the United Arab Emirates, which is the data controller for the purposes of this policy. It lets an organisation manage several client brands and publish content to their connected social media accounts from one place.
In data protection terms, we act as the data controller for the account information of people who sign up to the Service, and as a data processor for the client brand information and post content that you choose to store in it.
The short version. We collect what is needed to run the service and nothing more. We never sell your data, never use it for advertising, and never post to your accounts unless you explicitly tell us to.
02 What we collect
Everything below is data you enter or authorise. We do not buy data or scrape it from elsewhere.
| Category | What it includes | Why |
|---|---|---|
| Account | Email address, first and last name, hashed password, role (admin, editor, viewer), sign-up date | To create your login and control what you can do |
| Organisation | Organisation name, initials, subscription plan | To group your team and clients together |
| Client brands | Brand name, industry, brand colour, initials | To organise posts by the client they belong to |
| Connected accounts | Platform name, handle or username, page or channel ID, public profile URL, access and refresh tokens | To publish on your behalf to the accounts you connect |
| Content | Post text, uploaded images, scheduled and published times | To compose, schedule and deliver your posts |
| Delivery records | Per-platform post ID, success or failure status, error messages, reach figures | To show you what published successfully and what did not |
| Technical | Server logs containing IP address, browser user agent, and timestamps | Security, debugging and abuse prevention |
We do not collect payment card details on our servers, and we do not use advertising trackers, analytics pixels, or third-party cookies anywhere in the application.
04 How we use your information
- To authenticate you and keep your session active
- To publish the posts you create to the accounts you have selected
- To show delivery results, error messages and reach figures on your dashboard
- To keep connections working by refreshing expiring tokens
- To diagnose faults, prevent abuse and keep the service secure
- To contact you about service issues or account matters
We do not use your content or connected account data to train machine learning models, to build advertising profiles, or for any purpose you have not asked for.
06 How we protect it
- Encryption in transit. All traffic is served over HTTPS with a valid TLS certificate.
- Encryption at rest for tokens. Social media tokens are Fernet-encrypted before storage, as described above.
- Password hashing. Passwords are stored using Django's PBKDF2 hashing with a per-user salt. They are never recoverable, even by us.
- Scoped access. Every API request is authenticated with a short-lived signed token, and every query is restricted to your own organisation's records.
- Session expiry. Access tokens expire after 8 hours; refresh tokens after 7 days, and are rotated and blacklisted on use.
No system is perfectly secure. If we ever become aware of a breach affecting your data, we will notify you without undue delay.
07 How long we keep it
- Account and organisation data — for as long as your account is open.
- Connected account tokens — until you disconnect the account, at which point the token is erased immediately.
- Posts and delivery records — retained as your publishing history until you delete them or close your account.
- Server logs — kept for a short period for security and debugging, then rotated out.
Note that content already published to a social platform lives on that platform and is governed by its rules. Deleting a post from the Service does not remove it from Facebook, Instagram, or anywhere else — you will need to delete it there too.
08 Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Have your data deleted
- Receive a copy in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time by disconnecting an account
To exercise any of these, email us using the address in the Contact section. We will respond within 30 days.
09 Deleting your data
Disconnect a single account
Open Clients, expand the client, and press the disconnect icon next to the account. Its stored token, handle and page ID are cleared from our database straight away. We recommend also revoking the Service from that platform's own app settings.
Delete everything
Email us from the address on your account asking for deletion, and we will erase your account, your organisation's clients, all stored tokens, and your posting history.
Facebook data deletion requests
If you connected through Facebook, you can also request deletion from Facebook directly, under Settings & Privacy → Settings → Apps and Websites. Facebook will notify our callback endpoint and we will remove the associated data:
https://x-oppsmm.com/api/oauth/facebook/data-deletion/
10 Cookies and browser storage
The Service does not use advertising or tracking cookies. We store two items in your browser's
localStorage — a short-lived access token and a refresh token — purely to keep you
signed in between page loads. Clearing your browser storage signs you out and removes them.
11 Children
The Service is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will delete it.
12 Changes to this policy
We may update this policy as the service evolves. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will notify you in the application or by email before it takes effect.
13 Contact us
Questions about this policy, or want to exercise any of your rights? Get in touch.
Data controller
DELEMONTECHNOLOGY FOR MARKETING AND PR
Service
X-OPP SMM
Website
03 Social media accounts you connect
The Service can connect to the platforms below. Connecting is always initiated by you, one account at a time, and can be undone at any moment from the Clients page.
What we ask each platform for
We request only the permissions needed to list the pages you manage and publish content to them. For Facebook and Instagram, that is the ability to see the Pages you administer, read basic engagement figures, and publish posts. We do not request access to your private messages, friends list, contacts, or advertising accounts.
What we store
When you complete a connection, we store the account handle, its public profile URL, its page or channel identifier, and the access token the platform issues. Some platforms (Reddit, YouTube, X, TikTok) issue tokens that expire quickly, so we also store a refresh token to keep the connection alive without asking you to log in again.
Tokens are encrypted at rest. Access and refresh tokens are never written to our database in readable form. Each one is encrypted with AES-128 in CBC mode with an HMAC-SHA256 signature (the Fernet scheme) before it is saved, using a key held only in server configuration and never stored alongside the data. They are decrypted in memory only at the moment a post is published, and they are never sent to your browser or exposed through our API.
We never see or store your social media passwords. Authorisation happens on the platform's own website, and we only ever receive a revocable token.