Privacy Policy

This policy explains how Outbox handles information. Outbox is a publishing tool for Facebook Pages, owned and operated by Hộ kinh doanh Chu Quang Linh 2004 (“we”, “us”), a household business registered in Vietnam. We decide why and how the data described here is processed, and we are responsible for it. Today Outbox is used by our own team to publish to Facebook Pages that we, or people working with us, manage.

1. Who this policy applies to

• People who connect a Facebook Page to Outbox through Facebook Login.
• People who interact with a connected Page, for example by commenting on one of its posts. They do not use Outbox themselves.
• Visitors to this website and people who contact us.

2. Information we handle

2.1 When you connect a Page

When you sign in with Facebook and approve the request, Outbox receives the following from Meta, limited to the permissions you approve and the Pages you select:

• Your Facebook account ID and name. Stored with each Page you connect, so the team can see which account granted access.
• User access tokens. Used only while the connection is being set up, to obtain Page access tokens. They are held in memory and are never stored.
• A Page access token for each Page you select. Stored in the operating system’s credential store on the computer that runs Outbox. It is not written to the database or to log files.
• Page details: Page ID, name, category, link, follower count, a copy of the profile picture, the permissions granted, when the Page was connected, and when the token was last checked and when it expires.

Outbox does not receive your Facebook password, and it does not read your personal profile, friends list or private messages.

2.2 Content the team publishes

Images, videos, captions, comment text and links that our team prepares in Outbox; the IDs and links Facebook returns for each photo, video, post, Reel and comment; the result of each publishing step; and a history of the actions taken on each post. Images and videos are stored as files on the computer that runs Outbox. If this content shows or names other people, it contains their personal data too.

2.3 Page and post data read from Facebook

• Recent posts of a connected Page, including posts made outside Outbox: their text, link, image address, and counts of comments, reactions and shares. Post images are shown from Facebook’s servers and are not downloaded.
• View and click counts for posts, and summary statistics for the Page, when the read_insights permission was granted.
• Comments on the Page’s posts: the comment text, time, like and reply counts, any attached image address, and, where Facebook provides it, the public name and ID of the person who wrote it. This is used to show comments to the team and to reply to, hide or delete them as the Page.

2.4 Technical records

• Logs. Outbox logs its requests to Facebook to diagnose problems. Access tokens, the app secret and authorization codes are masked before anything is written. A log entry can contain the beginning of Facebook’s response, which may include Page, post or comment data.
• Diagnostic reports saved when we test a feature on a Page, which can contain what Facebook returned.
• Backup copies. When Outbox upgrades its statistics database, it first keeps a copy of the previous version, which can contain the post and comment data described above.

2.5 This website

This website is a set of static pages. It sets no cookies, runs no analytics or advertising scripts, and has no forms. Our hosting provider may process technical data such as IP addresses to deliver the pages and protect the service. If you email or call us, we keep your message and contact details to respond.

3. How we use information

• To publish the posts, Reels and comments our team has prepared and confirmed, to the Page chosen for each post.
• To check whether a publishing step succeeded, so that the same content is not published again by mistake.
• To show the team statistics and comments for the Pages they manage, and to respond to comments as the Page.
• To keep connections working, for example by checking that a Page access token is still valid.
• To diagnose errors and keep the tool secure.

We do not sell personal data, use it for advertising, or build profiles of individuals. We do not use data obtained from Meta for any purpose other than those listed above.

4. Why we may process it

• People who connect a Page do so by approving the permissions in Facebook’s dialog, which links to this policy. We treat that approval as your consent to the processing described here for the Pages you select. We keep a record of which account connected each Page, when, and which permissions it granted. You can withdraw consent at any time (see section 9).
• People who comment on a connected Page have not used Outbox and have not given consent to us; a Page manager’s approval in Facebook’s dialog is not consent on their behalf. We handle their comments only to manage the conversation on Pages we operate, keep only the fields listed in section 2.3, and stop and delete when asked.
• People who contact us: we use what you send to answer your request.

5. Facebook permissions

Permission	Purpose
pages_show_list	List the Pages you manage so you can choose which to connect.
pages_manage_posts	Publish photo posts and Reels to the connected Page.
pages_manage_engagement	Publish comments as the Page; reply to, hide or delete comments on its posts.
pages_read_engagement	Read the Page’s posts and their comment, reaction and share counts.
read_insights	Read view counts for posts and summary statistics for the Page.
pages_read_user_content	Optional, requested only when comment reading is turned on. Read comments people leave on the Page’s posts.

6. Where information is kept and how it is protected

• Outbox currently runs on a computer controlled by the operator in Vietnam. Its database, media files, logs and backups are stored on that computer, not on a public server. Its interface can only be opened from that computer.
• Page access tokens and the app secret are kept in the operating system’s credential store, separate from the database.
• Tokens are sent to Facebook over HTTPS, and are masked in logs and error messages.
• Only the operator and the team members the operator authorizes can use the tool.

Content we publish, and requests we make to Facebook, are processed by Meta on its own servers, which may be outside Vietnam. If we move Outbox to a hosted server, we will update this policy before doing so.

7. Who we share information with

• Meta. Content the team publishes is sent to Facebook through the Graph API, and becomes subject to Meta’s own terms and policies.
• Authorized team members, who see the data needed to do their work.
• Authorities, when the law requires it.

We do not use any outside service provider to process data received from Meta, and we do not share personal data with advertisers, data brokers or other third parties.

8. How long we keep it

• Page access tokens are kept until the Page is disconnected in Outbox or you ask us to delete them. If you remove the app in your Facebook settings, the token stops working straight away; we delete it when you ask us or when we disconnect the Page.
• Cached Page data, post lists, statistics and comments are replaced by fresh data each time they are refreshed.
• Records of published posts (IDs, links, step results, history) and their images and videos are kept as the team’s working record while the team manages that Page. These records are how Outbox tells whether a post was already published.
• Request logs are replaced each time Outbox starts; only the logs of the current and the previous run are kept.
• Diagnostic reports and backup copies are kept until we delete them.
• Messages you send us are kept for as long as we need them to handle your request.

When we stop managing a Page, or when you ask, we delete the data for that Page, including its copies in backups, logs and diagnostic reports, as described on the Data Deletion page.

9. Your choices and rights

• Remove access at any time in your Facebook settings. The Page access tokens Outbox holds stop working when you do.
• Ask us what data we hold about you or your Page, for a copy of it, or for it to be corrected or deleted.
• Withdraw your consent, or ask us to restrict or stop processing. This does not affect processing that took place before your request.
• If you commented on a connected Page, you can delete your comment on Facebook, or ask us to remove the stored copy.
• Complain to us or to the competent authority, or take other steps the law provides.

Send requests in writing, by email, to the address in section 12. We reply within 2 business days to confirm the request and explain the next steps. We then complete it within:

• 10 days for a request to see, receive or correct data;
• 15 days for a request to withdraw consent, or to restrict or stop processing;
• 20 days for a request to delete data.

If a request is complex, we may extend this once, by no more than the same number of days, and we tell you why before the original deadline. If we cannot delete some data for a legitimate reason, for example because the law requires us to keep it, we tell you what is kept and why.

10. Children

Outbox is a work tool for adults and is not directed to children. Comments on a connected Page can come from anyone, and we cannot tell a commenter’s age. If you are a parent or guardian and believe a child’s comment is stored in Outbox, contact us and we will delete it.

11. Changes to this policy

If we change how Outbox handles data, we will update this page and its effective date before the change takes effect.

12. Contact

Hộ kinh doanh Chu Quang Linh 2004
Thôn Thái Hòa, Xã Vật Lại, Thành phố Hà Nội, Việt Nam
Email: chuquanglinhh@gmail.com
Phone: +84 989 507 929