Privacy Policy

KOLab Social Connectors is operated by KOLab Inc. (“KOLab”, “we”, “us”, or “our”). It allows organizations to connect social-media accounts, publish content, and manage supported messages and public replies from one service.

This policy supplements KOLab’s general website privacy policy and applies to the Social Connectors application, its APIs, OAuth connections, webhooks, and related support. We process personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”) and other laws that apply to a particular service relationship.

• Account and organization data: name, email address, login credentials, organization name, team membership, role, preferences, and support communications.
• Social connection data: provider and account identifiers, Page or professional-account names, usernames, profile images, granted permissions, OAuth access and refresh tokens, token expiry, and connection status.
• Publishing data: drafts, captions, media references, schedules, settings, publishing results, public post identifiers, links, comments, and analytics requested by your organization.
• Inbox data: messages sent to or from a connected Facebook Page or Instagram professional account, public Threads replies, sender identifiers, names, usernames, attachments, timestamps, delivery/read states, and internal team notes.
• Technical data: IP address, browser and device information, request metadata, security events, application logs, queue and webhook status, and feature usage.
• Billing data: subscription and transaction records where a paid service applies. Payment-card details are handled by the applicable payment provider rather than stored in full by KOLab.

We receive information from you and your organization, authorized teammates, connected platforms such as Meta, people who communicate with a connected business account, and our infrastructure and security providers. We receive social-platform data only after an authorized user connects an account or when a platform sends an event for that connected account.

• authenticate users and administer organizations and roles;
• connect, refresh, and disconnect social-media integrations;
• publish, schedule, synchronize, and report on social content;
• receive, display, send, and synchronize supported messages;
• prevent duplicate events and recover missed webhook deliveries;
• provide support and notify users of errors or expired access;
• secure, monitor, troubleshoot, and improve the service;
• comply with law and enforce our agreements and platform rules.

We do not use the contents of connected business inboxes to build advertising profiles, and we do not sell personal data.

Depending on the context, we process information to perform our contract with your organization, follow your authorized instructions, comply with legal obligations, protect legitimate security and operational interests, or act with consent where consent is required. A client organization may act as the controller of the business communications it connects to KOLab, while KOLab processes that data to provide the contracted service.

• with connected platforms when your organization asks us to authenticate, publish, retrieve data, or send a response;
• with authorized members of the organization that owns the connected account;
• with hosting, database, storage, email, monitoring, security, and payment vendors acting under appropriate obligations;
• with professional advisers, affiliates, or transaction parties when reasonably necessary and legally permitted;
• when required by law, legal process, or a valid governmental request, or to protect rights, safety, and service integrity.

KOLab and its service providers may process information in Hong Kong and other locations where our infrastructure or vendors operate. We take reasonable steps to protect transferred information and to apply contractual, access-control, and security measures appropriate to the processing.

We keep information for as long as an account or integration is active and as needed to provide the service, satisfy contractual or legal requirements, resolve disputes, prevent abuse, and maintain security records. Retention periods depend on the data and purpose.

Disconnecting or deleting a social integration stops KOLab from using its stored credentials. A verified Meta deletion callback removes or anonymizes the matching credentials, platform identifiers, inbox data, and associated stored publishing data from active systems. Minimal confirmation and audit records may be retained to demonstrate that a request was completed. Isolated backup copies expire through the normal protected backup lifecycle and are not used for ordinary processing.

See our data deletion page for self-service, Meta, and email request options.

We use HTTPS/TLS, access controls, tenant-scoped application queries, signed webhook verification, operational monitoring, restricted production access, and other technical and organizational safeguards. No internet service can guarantee absolute security. Users must protect their login credentials and promptly report suspected misuse.

The application uses cookies and similar storage needed for login, security, organization selection, language, and application preferences. Where configured, analytics tools may measure service usage and reliability. Browser settings can restrict optional cookies, although blocking essential cookies may prevent login or application features from working.

Subject to applicable law, you may ask to access or correct personal data, withdraw consent where processing relies on consent, disconnect a social account, or request deletion. Organization administrators can also manage team access and connected accounts. We may need to verify identity and authority before acting on a request.

PDPO access and correction requests may be sent to contact@kolab-inc.com. We will respond within the period required by applicable law, including the PDPO’s applicable response period.

The service is intended for organizations and authorized business users and is not directed to children under 18. Contact us if you believe a child has provided account information to the service.

We may update this policy as the service, platform requirements, or law changes. We will post the revised policy with a new update date and provide additional notice when a material change requires it.

KOLab Inc.
Hong Kong
Email: contact@kolab-inc.com

You may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong, if you believe your rights under the PDPO have been infringed.