Privacy Policy & Data Processing Agreement
This Privacy Policy governs the manner in which OmniSocial Pro ("we", "us", or "our"), available at https://medisolf.online, collects, accesses, processes, stores, and protects data gathered through official third-party social media integrations, including the Meta Graph API (Facebook & Instagram), Meta Webhooks, WhatsApp Cloud API, and the TikTok Commercial Content Posting API.
Scope & Core Architecture
OmniSocial Pro is an enterprise omnichannel social media CRM, inbox aggregator, and automated post scheduler built for multi-tenant businesses, marketing teams, and customer support desks.
Our application acts as a secure intermediary between your authorized social media accounts and your private workspace database. We strictly adhere to the principle of Data Minimization: we only request permissions and process data that are directly necessary to execute actions explicitly initiated by you (e.g., publishing a scheduled post, receiving incoming customer support messages, or updating page engagement metrics).
Meta Graph API (Facebook & Instagram) Integration
When you authenticate your Facebook Page or linked Instagram Professional Account via Meta OAuth 2.0 (/v20.0/dialog/oauth), our platform exchanges the authorization code for short-lived and long-lived Page Access Tokens.
Specific Meta Permissions & Usage Justification:
Used to discover and display the list of Facebook Pages you own or administer, enabling you to select which specific pages you wish to manage inside OmniSocial Pro.
Used to retrieve follower counts, post engagement metrics, reactions, and page status to populate your real-time analytics dashboard.
Used to create, publish, and schedule feed posts, media updates, and announcements directly to your Facebook Page according to your configured schedule.
Used to receive inbound customer inquiries from Facebook Messenger and Instagram Direct in real-time, route conversations to assigned support agents, and send replies directly from the unified inbox desk.
All Access Tokens retrieved from Meta are encrypted and stored in your dedicated MySQL database table channel_credentials. Tokens are never exposed to public frontend interfaces.
Real-Time Webhook Processing & Security
OmniSocial Pro maintains an active webhook ingestion endpoint (/includes/webhook.php) configured under Meta App Webhooks for the page and instagram topics.
Security & Signature Verification:
Every incoming HTTP POST request received at our webhook endpoint is cryptographically verified against the Meta App Secret using the standard X-Hub-Signature-256 HMAC-SHA256 protocol. Payloads with missing or mismatched cryptographic signatures are rejected immediately with HTTP 403 Forbidden to prevent spoofing or unauthorized injection.
Webhook Ingestion Lifecycle:
- Sender-Scoped IDs (PSID/IGSID): Meta provides anonymized, page-scoped user IDs. We do not obtain personal Facebook profile links, phone numbers, or email addresses unless the customer explicitly sends them in their message text.
- Thread Association: Inbound messages are matched against existing conversation records in the
conversationstable or created as new customer support tickets. - Automated Responses: If keyword automation is configured in the
automationstable, our engine dispatches an immediate automated response via the official Send API.
TikTok API & Content Posting
For TikTok integrations, OmniSocial Pro leverages the official TikTok Content Posting API (v2) and Commercial Business API.
- Account Authorization: We use official TikTok OAuth 2.0 to obtain access tokens. We do not store or prompt for your raw TikTok username or login passwords.
- Content Publishing: When you schedule a video or post for TikTok, video assets and captions are transmitted securely to TikTok's upload endpoints according to TikTok's developer guidelines.
- Compliance: All data collected from TikTok is processed in accordance with TikTok's Developer Terms of Service and Privacy Policy.
WhatsApp Cloud API Handling
WhatsApp communications are conducted exclusively through the official Meta-hosted WhatsApp Cloud API.
We store the Phone Number ID, WhatsApp Business Account (WABA) ID, and Permanent System User Access Token in your isolated MySQL database. Customer conversations are maintained strictly for customer service resolution within the 24-hour customer service window mandated by WhatsApp Business policies.
Data Storage, Encryption & MySQL Security
Data collected through official APIs is stored in dedicated, relational MySQL database tables designed with strict integrity constraints:
Data Retention & Automatic Expiry
- Access Tokens: Retained only as long as the social channel remains in a "Connected" state. When you click "Disconnect Channel", tokens are immediately purged from MySQL.
- Scheduled Posts: Kept in the database until dispatched to the respective social platform or deleted by an authorized administrator.
- Conversation Records: Maintained for CRM customer history until deleted manually via the Database Manager Studio or requested by the user.
User Rights & Data Deletion Instructions (Meta Compliance)
In accordance with Meta Platform Terms (Section 4.a), GDPR (Article 17 Right to Erasure), and CCPA, users have full rights to request the immediate deletion of all data associated with their accounts.
🛡️ Option A: Revoke Permissions via Facebook Settings
You can remove OmniSocial Pro access at any time through your personal Facebook account:
- Log into your Facebook account and go to Settings & Privacy ➔ Settings.
- Navigate to Apps and Websites in the left sidebar menu.
- Locate OmniSocial Pro in the list of active apps.
- Click Remove. You may also check the box to request deletion of all posts and interactions created by this app.
⚡ Option B: Automated User Data Deletion Callback URL
We provide an official automated Meta User Data Deletion endpoint that handles deletion requests and generates a verifiable confirmation code:
📧 Option C: Direct Manual Deletion Request
To request the complete erasure of your business credentials, customer messaging logs, or scheduled posts from our database, send an email to privacy@medisolf.online with your Facebook Page Name or Business ID. Our engineering team processes all deletion requests within 48 hours and provides written verification.
Contact Information & Data Protection Officer
If you have questions, concerns, or regulatory compliance inquiries regarding this Privacy Policy or our API data processing practices, please contact our Data Protection Officer: