Privacy Policy

PresenceHub (“PresenceHub”, “we”, “us”, or “our”) is a social media planning and publishing service based in Porbandar, Gujarat, India. It lets you connect your social accounts, compose and schedule posts, and publish them to your connected channels. This Privacy Policy explains what personal data we collect when you use PresenceHub, why we collect it, how we use and share it, and the choices and rights you have.

For the purposes of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), PresenceHub is the data fiduciary for the personal data described in this policy.

If you connect a Facebook Page or Instagram account, see Facebook and Instagram Data for exactly what we receive from Meta and how we handle it. To delete your data, see How to Delete Your Data or our data deletion instructions.

Questions about this policy or your data can be sent to privacy@presencehub.app.

Account information

When you register, we collect your name, email address, and a password. Your password is stored only in hashed form — we never store or have access to your plain-text password. We also record whether your email address has been verified.

Session and device information

When you sign in, we record the IP address and browser user agent associated with your session. We use this information for security and to keep you signed in.

Content and media

We store the content you create in PresenceHub, including post drafts, captions, scheduled posts, and the images and videos you upload. For uploaded media we also store technical metadata such as the original filename, file type, file size, dimensions, and video duration, along with any edits you apply (such as crop or trim settings).

Connected social accounts

When you connect a social media account (such as a Facebook Page or Instagram account), we store the account identifiers, handles, and profile details the platform shares with us, together with the access tokens the platform issues so that we can publish on your behalf. We never receive or store your social media passwords. The Facebook and Instagram Data section describes the data we receive from Meta in detail.

Workspace and team data

We store the workspaces you create or join, your role within each workspace, and the membership of your teams.

Activity logs

We keep logs of actions taken in your account (for example, creating or publishing a post, or connecting a channel), as well as records of publishing attempts and their outcomes, so that we can provide the service reliably, troubleshoot problems, and maintain an audit trail.

Usage and diagnostic data

When you use PresenceHub, our hosting and network providers record standard request logs, such as your IP address, browser user agent, the page or API endpoint requested, and the time of the request. We also use your IP address and a one-way hash of the email you submit on sign-in and password flows to limit repeated attempts (short-lived counters, typically about one minute). When something goes wrong or runs slowly, our monitoring tools record error and performance reports, which may include your account and workspace identifiers, your browser and device type, and details of the page or request that failed. We use this data only to operate, secure, and improve the reliability of PresenceHub.

We do not use advertising trackers or marketing analytics tools, and we do not build profiles of you for advertising.

Communications with us

If you email us — for example to ask for support or exercise your privacy rights — we keep your email address and the content of your messages so that we can respond and keep a record of your request.

We use the data described above to:

• Provide and operate the service — create and maintain your account, store your drafts and media, and run your workspaces.
• Publish on your instruction — deliver your posts and media to the social platforms you have connected, at the times you schedule.
• Send transactional email — such as email verification and password reset messages. We do not send marketing email without your consent.
• Keep the service secure and reliable — authenticate your sessions, detect misuse, maintain audit logs, and diagnose errors and performance problems.
• Support you — investigate and resolve issues you report and respond to your requests.
• Show you analytics — display performance metrics for the channels you connect and the posts you publish through PresenceHub.

Legal basis

We process your personal data on the basis of your consent, which you give when you create an account and when you choose to connect a social account. You can withdraw your consent at any time by revoking a connection or asking us to delete your account (see How to Delete Your Data). Withdrawing consent does not affect processing that took place before you withdrew it, but we will no longer be able to provide the parts of the service that depend on that data.

We also process limited data for legitimate uses permitted by law, such as complying with legal obligations, responding to lawful requests from authorities, and protecting the security of PresenceHub and its users.

We do not sell your personal data, and we do not use your data for advertising.

This section applies when you connect a Facebook Page or an Instagram professional account to PresenceHub. It describes the data we receive from Meta Platforms (“Meta”) through its APIs (“Meta platform data”), and how we use, keep, share, protect, and delete it. We access Meta platform data only with the permissions you grant when you connect, and only to provide the features described here.

What we receive from Meta

• Account and Page identifiers — the ID Meta assigns to you for PresenceHub, the IDs of the Facebook Pages, businesses, and Instagram accounts you choose to make available, and which Pages and permissions you approved. Pages in your business that you did not share may be listed as unavailable, so you can see why they can’t be connected; we do not keep their access tokens.
• Profile details — your name as it appears on Facebook or your Instagram username, Page names and links, Instagram account type, profile picture link, and your role or permitted tasks on each Page (used to check that you are allowed to publish to it).
• Access tokens — the credentials Meta issues so that PresenceHub can act on your behalf. We never receive your Facebook or Instagram password.
• Post data — the IDs Meta assigns to posts you publish through PresenceHub, and Meta’s responses when we publish them (for example, success or error details).
• Insights — performance metrics for your connected Pages and accounts (such as daily views and follower counts) and for posts you publish through PresenceHub (such as views, reach, reactions, comment counts, shares, and saves). Comment and reaction counts on your Page posts: to produce these, PresenceHub requests permission to read Page comments and reactions, but stores only the totals. We do not store the names of people who commented or reacted, or the text of their comments.

How we use it

• Identifiers, profile details, and access tokens — to show you which Pages and accounts you can connect, to display them in your workspace, and to publish the posts you create or schedule to the channels you choose.
• Post data — to confirm that a post was published, link it to its insights, and help you troubleshoot failed posts.
• Insights — to show analytics for your channels and posts inside your PresenceHub workspace, including reaction and comment totals for your posts.

We do not use Meta platform data for advertising, to build profiles of you or your audience, or for any purpose other than providing PresenceHub to you.

How long we keep it

• While connected — we keep Meta platform data for as long as the connection is active, and refresh insights regularly so your analytics stay up to date.
• When you disconnect a channel — we stop publishing to that Page or account and stop collecting its insights.
• When you stop sharing a Page — you can stop sharing a connected Page by leaving it out when you reconnect Facebook, or in your Facebook “Business integrations” settings. The next time PresenceHub checks which Pages you share (when you reconnect, or open that connection’s channel list), we pause the channel, stop publishing to it, and delete its access token. Scheduled posts for that channel will not be published unless you share the Page again.
• When you revoke a connection — we delete the stored access tokens for that connection and all of its channels, and stop publishing and collecting insights. For a Facebook connection, we also ask Meta to remove the permissions you granted PresenceHub. For an Instagram connection, you can also remove PresenceHub from your Instagram settings (see Remove PresenceHub from Facebook or Instagram). Scheduled posts for those channels will not be published unless you reconnect.
• When you remove PresenceHub on Facebook or Instagram — Meta notifies us, and we mark the connection as revoked, delete the stored access tokens for that connection and all of its channels, and stop publishing and collecting insights. Scheduled posts for those channels will not be published unless you reconnect.
• Everything else — identifiers, profile details, post data, and insights already collected stay in your workspace history until you delete them using one of the options in How to Delete Your Data, or until your account is deleted.

Who we share it with

We do not sell, rent, license, or resell Meta platform data, and we do not share it with advertisers, data brokers, or analytics providers. Meta platform data is shared only:

• With Meta — when we publish posts and request insights on your behalf.
• With our infrastructure providers — Amazon Web Services (in Mumbai, India), which runs the servers and databases where PresenceHub stores data, and Vercel, which hosts the PresenceHub web app. Both act only on our instructions. Media files you upload are stored with Cloudflare R2. See Subprocessors.
• With Sentry — our error and performance monitoring provider. API error reports can include account and workspace identifiers (public UUIDs) needed to diagnose failures. See Subprocessors.
• With members of your workspace — who can see the channels, posts, and analytics in workspaces you share with them.
• When required by law — if we are legally required to disclose it.

How we protect it

Access tokens are encrypted at rest using AES-256 encryption, are never sent to your browser, and are used only by PresenceHub’s servers to call Meta’s APIs. All data is transmitted over encrypted (HTTPS) connections. Access to production systems and to the internal administration dashboard is limited to authorized PresenceHub staff. See Security for more detail.

We use a small number of service providers (“subprocessors”) to run PresenceHub. They process personal data only on our instructions and only as needed to provide their service to us:

• Amazon Web Services (Mumbai, India region) — application servers, databases, automated database backups (Amazon RDS), and our primary provider for transactional email (Amazon SES).
• Resend — standby provider for transactional email (for example verification and password-reset messages) if Amazon SES is unavailable. Resend may process recipient email, name, and message content; that processing may occur outside India.
• Vercel — hosts the PresenceHub website and web app; server-side functions run in Mumbai, India.
• Cloudflare — DNS, content delivery, reverse proxy and security (TLS termination, DDoS protection) for our API, and Cloudflare R2 storage for uploaded media and off-AWS database backup copies.
• Google Workspace — our email for support and privacy requests.
• Sentry — error and performance monitoring for the PresenceHub web app and API servers. Production projects send data to Sentry’s EU region (Germany), so this monitoring data is stored in the European Union (EU).

When you connect a social account and publish, your post content and media are also sent to that platform — Meta Platforms (Facebook and Instagram) — at your direction. Meta’s handling of that data is governed by Meta’s own terms and privacy policy. See Facebook and Instagram Data.

Some of these providers may process data outside India. Where they do, we rely on their contractual commitments to protect it, and we do not transfer data to any country restricted by the Government of India under the DPDP Act.

We do not share your data with advertisers or data brokers. We may disclose information if required to do so by law or to protect the rights, safety, or security of PresenceHub or its users.

PresenceHub uses only strictly functional cookies that are required to keep you signed in. We do not use advertising, analytics, or tracking cookies.

• __Host-ph_session (production) / ph_session (local) — your authentication token, used to keep you signed in. Host-only, HTTP-only, Secure in production. Expires after 1 week.
• ph_user — a snapshot of your basic profile (name, email, verification status) so the app can display it without extra requests. Expires after 1 week.
• ph_workspace — remembers which workspace you are currently working in. Expires after 1 week.

These cookies are set as HTTP-only and, in production, are only transmitted over secure (HTTPS) connections. Because they are essential to the operation of the service, they cannot be disabled while using PresenceHub.

• Account data and workspace content — kept for as long as your account is active. When you ask us to delete your account, we delete it within 30 days of verifying your request.
• Facebook and Instagram data — kept as described in Facebook and Instagram Data.
• Backups — database backups on Amazon RDS (Mumbai) and off-AWS copies on Cloudflare R2 are each kept for up to 30 days, so deleted data is removed from those backups within 30 days of deletion.
• Usage and diagnostic data — request logs and error reports are kept for a limited period, typically no longer than 90 days, unless needed to investigate a security incident.
• Records we must keep — we may keep limited records for longer where required by law, or to resolve disputes and enforce our agreements.

How to Delete Your Data explains how to ask us to delete your data.

You can delete the data we hold about your Facebook and Instagram accounts, or your whole PresenceHub account, in any of these ways. Step-by-step instructions are also available on our data deletion page.

Option 1: Revoke the connection in PresenceHub

Sign in, open Accounts from the sidebar, find the Facebook or Instagram connection, and choose Revoke connection. We immediately delete the stored access tokens for that connection and its channels. For a Facebook connection, we also ask Meta to remove the permissions you granted PresenceHub; for an Instagram connection, remove PresenceHub from your Instagram settings as described in Remove PresenceHub from Facebook or Instagram. To also delete the rest of the data for that connection, remove PresenceHub on Facebook or Instagram and request deletion, or email us.

Option 2: Remove PresenceHub from Facebook or Instagram

You can remove PresenceHub from your Facebook or Instagram settings at any time, for example under the “Business integrations” or “Apps and websites” settings. When you do, Meta tells us, and we immediately stop using your access and delete the stored access tokens for that connection and its channels. If you also ask for your data to be deleted, Meta sends us a deletion request and we then delete, automatically:

• the access tokens for that Facebook or Instagram account;
• the Page and account identifiers, names, usernames, profile details, and profile picture links we received;
• the insights we collected for those channels and posts;
• the post IDs and publishing responses we received from Meta; and
• Meta identifiers in our activity and audit logs.

You will receive a confirmation code and a link to a page where you can check the status of your request. We keep a record of the request itself (including the Meta-assigned ID and confirmation code) so that the status page keeps working and repeat requests are handled correctly. Posts, drafts, and media you created in your PresenceHub workspace are your workspace content and are not removed by this request; you can delete them yourself in PresenceHub, or email us.

If you connect the same Facebook or Instagram account to PresenceHub again later, it is treated as a new connection. The insights and post links we deleted are not restored, and posts you published before the deletion will no longer show insights.

Option 3: Email us

Email privacy@presencehub.app from the address you use to sign in to PresenceHub, and tell us whether you want us to delete your Facebook and Instagram data or your entire PresenceHub account. We will confirm your request and complete it within 30 days, except where we are required by law to keep certain records.

Subject to applicable law, including the DPDP Act, you have the right to:

• Access information — get a summary of the personal data we process about you, how we process it, and who we have shared it with.
• Correct and update — have inaccurate or incomplete data corrected, completed, or updated. You can update most account details yourself in PresenceHub.
• Erase — have your personal data deleted when it is no longer needed for the purpose it was collected, or when you withdraw consent.
• Withdraw consent — at any time, as easily as you gave it (see Legal basis).
• Nominate — name another person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — raise a complaint about how we handle your personal data and have it resolved.

To exercise any of these rights, email privacy@presencehub.app from the address you use to sign in to PresenceHub. We may ask you to confirm your identity before acting on your request. We aim to respond within 30 days.

Grievance Officer

If you have a concern or complaint about how we process your personal data, contact our Grievance Officer:

• Name: Mayur Shingrakhiya
• Email: privacy@presencehub.app
• Location: Porbandar, Gujarat, India

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

We take reasonable technical and organizational measures to protect your data, including:

• Passwords stored using industry-standard hashing (bcrypt).
• Social platform access tokens encrypted at rest using AES-256 encryption and never exposed to your browser.
• Session cookies set as HTTP-only and secure in production, limiting exposure to scripts and insecure connections.
• Data transmitted over encrypted (HTTPS) connections.
• Rate limiting on authentication endpoints to deter abuse.

Uploaded images and videos are served from unlisted links. These links are not published or indexed, but anyone who has a link can open the file — this is how Facebook and Instagram fetch your media when we publish a post. Do not share media links you want to keep private.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

A limited number of PresenceHub staff can access user and workspace data through an internal administration dashboard, solely for operating the service, providing support, and investigating problems or abuse. Staff access is restricted to what is necessary for those purposes.

PresenceHub is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account or provided us with personal data, please contact us at privacy@presencehub.app and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through the service. Your continued use of PresenceHub after changes take effect constitutes acceptance of the updated policy.

For questions about this Privacy Policy or how we handle your data, contact us at privacy@presencehub.app. For general support, email support@presencehub.app.

PresenceHub, Porbandar, Gujarat, India.

You can also review the terms that govern your use of the service in our Terms of Use, and how to delete your data on our data deletion page.