Privacy Policy

Last updated: 26/10/2026

Weboost - Agência de Marketing, Unipessoal Lda ("Weboost", "we") provides social media management services to its clients. This policy explains what data we process when connecting and managing our clients' Facebook, Instagram (Meta), LinkedIn and TikTok accounts, and the rights our clients have. It applies to the Weboost platform and to the Client Portal.

1. Data controller

Weboost - Agência de Marketing, Unipessoal Lda. Privacy contact: [email protected].

2. Data we collect

Connection data: access tokens (stored encrypted), the identifier of the authorising account, the Facebook Page ID, the Instagram Business account ID, the LinkedIn organisation ID and the TikTok account identifier (open_id), plus the connected account's name and profile picture.
Content and metrics: posts the client creates or approves, their status, and the insights and comments of the posts we manage.
Portal account data: the client's name and portal credentials (the password is stored only as a hash, never in plain text).

3. Meta permissions we request, and why

We request only the permissions the service needs. Each one is used for:

Permission	Purpose
`public_profile`	Identify the account authorising the connection.
`business_management`	Access the business assets (Pages and Instagram accounts) the client manages.
`pages_show_list`	List the client's Facebook Pages so they can choose which one to connect.
`pages_read_engagement`	Read the Page's content and performance to show metrics to the client.
`read_insights`	Obtain metrics and statistics for the Page's posts.
`pages_manage_posts`	Publish and schedule posts on the Page, on the client's behalf and with their approval.
`pages_manage_metadata`	Manage the settings needed to publish and to keep the Page connected.
`instagram_basic`	Access the associated Instagram Business account (profile and media).
`instagram_content_publish`	Publish content to Instagram on the client's behalf, with their approval.
`instagram_manage_insights`	Show the client the metrics of their Instagram posts.

4. LinkedIn permissions we request, and why

Scope	Purpose
`r_organization_social`	Read the client's company page posts and their engagement.
`w_organization_social`	Publish and schedule posts on the client's company page, with their approval.
`rw_organization_admin`	Read the page's follower and view statistics, and the settings needed to publish.

TikTok permissions we request, and why

Scope	Purpose
`user.info.basic`	Show which TikTok account is connected (display name and avatar).
`video.upload`	Send a video to the creator's TikTok inbox as a draft, when the client chooses that option.
`video.publish`	Publish a video the client approved directly to their TikTok profile, with the privacy and interaction settings they chose.

We never publish to TikTok without the client choosing the privacy level and interaction settings for that video. We do not read the client's other TikTok videos, followers or messages.

5. How we use the data

Publish and schedule content on the client's accounts, with their authorisation and approval.
Show the client the status of their posts and their performance metrics.
Manage comments and interactions when the client asks us to.

We do not use this data for our own advertising or profiling, and we do not sell it.

6. Legal basis (GDPR)

We process data on the basis of performance of the service contract and the consent the client gives when connecting an account via OAuth.

7. Data sharing

We share data only with Meta Platforms (Graph API), LinkedIn (Marketing and Share APIs) and TikTok (Login Kit and Content Posting API), to the extent needed to deliver the service. We do not share data with third parties for marketing purposes and we do not sell it.

8. Retention

We keep the data for as long as the account is connected and the service is active. Disconnecting the account or removing the app deletes the stored access tokens.

9. Data deletion

Clients can delete their data at any time — see the deletion instructions. We process deletion requests sent by Meta (Data Deletion Request) automatically. Disconnecting TikTok revokes the access token with TikTok and deletes it from our database.

10. Your rights (GDPR)

You have the right to access, correct, delete and restrict the processing of your data, and to withdraw consent. To exercise these rights, contact [email protected].

11. Security

Access tokens are stored encrypted and portal passwords as a hash. All communication happens over HTTPS.

12. Platform compliance

We comply with the Meta Platform Terms and Developer Policies, and with the LinkedIn API Terms of Use and the TikTok Developer Terms of Service. Data obtained from these platforms is used solely for the purposes above and for the benefit of the client who owns the account.

13. Changes

We may update this policy; the date at the top shows the last revision.