Privacy Policy
Privacy Policy
Cistemics LLC · Effective 9/29/2026 · Last updated 9/29/2026
This Privacy Policy explains what information [APP NAME] (the "Service") collects, how we use it, who we share it with, and how you can control or delete it. The Service is a private tool, built on the n8n workflow platform, that schedules and publishes social media posts for businesses we have onboarded. It publishes to Facebook Pages, Instagram professional accounts and X accounts that those businesses own or manage. It should be read together with our Terms of Service.
1. Who we are
Cistemics LLC ("we", "us", "our") operates the Service and is responsible for the information described here. You can contact us at [email protected] or 101 Woodwinds Industrial Ct, Cary, North Carolina 27511.
2. Information we collect
We collect only what is needed to prepare, publish and confirm the posts a business has approved.
| Category | What it includes | Where it comes from |
|---|---|---|
| Post content | Post topics, key points, draft and approved text, images, hashtags, links, calls to action, scheduled times, and approval status | Entered by the business in its content calendar, or generated as a draft by the Service |
| Facebook data | Facebook Page ID and name, and the Page access token Meta issues when you authorize the Service | Meta, through Facebook Login |
| Instagram data | Instagram professional account ID and username, and published media IDs and permalinks | Meta, through the Instagram Graph API |
| X data | X account ID and username, OAuth access and refresh tokens, and published post IDs | X, through OAuth 2.0 |
| Publish results | Post IDs, permalinks, publish timestamps, number of attempts, error messages, and workflow run IDs | Returned by Meta and X when we publish |
| Business contact details | Names and email addresses of the people at each business who use or manage the Service | Provided during onboarding |
What we don't collect: the Service does not access your followers, friends, direct messages, comments, likes, insights or analytics. It does not access other users' profiles, personal ad accounts, or your personal Facebook profile data beyond what Facebook Login needs to list the Pages you manage. The Service does not use cookies, tracking pixels or analytics on end users.
3. How we use information
We use the information above only to:
- generate draft post text and header images for a person at the business to review;
- publish posts that a person at the business has approved, at the scheduled time, to the accounts that business has connected;
- record whether each post was published, with its link or the reason it failed, so it can be checked and retried;
- prevent the same post from being published twice;
- keep the Service secure, fix problems, and meet our legal obligations.
We do not sell or rent personal information or platform data. We do not use it for advertising, profiling, or building audiences. We do not combine it with data from other sources, and we do not use it to train AI models.
4. Data from Meta and X
Data we receive through the Meta and X APIs is used only to provide the Service to the business that connected the account, as described in section 3, and only in line with the Meta Platform Terms and the X Developer Agreement and Policy. We request only these permissions:
- Meta: pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic and instagram_content_publish.
- X: tweet.read, tweet.write, users.read and offline.access.
We don't transfer platform data to data brokers, advertising networks or any other third party, except the service providers listed in section 5 that host or process it on our behalf.
5. Who we share information with
We share information only with the service providers the Service needs to run, and only for that purpose:
- n8n runs the workflows and stores access tokens encrypted in its credential store.
- Airtable stores the content calendar, post records, images and publish results.
- OpenRouter, and the AI model providers it routes requests to, receive the post topic, key points and brand guidelines so they can generate draft text and images. They don't receive access tokens, account IDs or any data from Meta or X.
- Meta and X receive the approved post text and images when we publish them to your accounts.
We may also disclose information if the law requires it, to protect the rights or safety of our users or others, or as part of a merger or acquisition. In an acquisition, this policy would continue to apply to the information.
6. How long we keep information
- Access tokens and account IDs: kept while an account is connected. We delete them within 30 days after the account is disconnected, access is revoked, or you ask us to delete them.
- Post records and publish results: kept for as long as the business uses the Service, so it has a record of what was published. We delete them within 30 days of a deletion request or of the business leaving the Service.
- Workflow execution logs: kept in n8n for troubleshooting and deleted on a regular schedule, and in any case within 90 days.
Posts already published on Facebook, Instagram or X stay on those platforms until you delete them there.
7. How to delete your data
You can disconnect the Service and ask us to delete your data at any time. Step-by-step instructions are on our Data Deletion Instructions page. You can also email [CONTACT EMAIL].
8. Security
We protect information with encrypted connections (HTTPS/TLS) to every provider and encrypted storage of access tokens in n8n. Access is limited to authorized staff with individual accounts. We request only the permissions the Service needs. No system is completely secure. If a breach affects your information, we will notify you and the relevant authorities where the law requires it.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information. You may also have the right to object to or restrict how we process it, or to withdraw consent. California residents have the rights provided by the CCPA/CPRA, including the right to know and the right to delete. We do not sell or share personal information for cross-context behavioral advertising. People in the EU, UK and similar regions can also complain to their local data protection authority. To use any of these rights, email [CONTACT EMAIL]. We respond within 30 days and won't treat you differently for making a request.
If you are in the EU or UK, we process your information to perform our contract with your business, for our legitimate interest in operating and securing the Service, and to meet legal obligations.
10. International transfers
The Service is operated from the United States, and our service providers may process information in the United States and other countries. Where the law requires it, these transfers rely on appropriate safeguards such as the providers' Standard Contractual Clauses.
11. Children
The Service is for businesses and is not directed at anyone under 18. We don't knowingly collect information from children.
12. Changes to this policy
We will post any changes on this page with a new "Last updated" date. We will also email onboarded businesses about material changes before they take effect.
13. Contact
Cistemics LLC
101 Woodwinds Industrial Ct,
Cary, NC 27511