Privacy Policy

This policy applies to everyone who uses the Fullscreens website and platform. It explains why, how, and when we process personal data, and the choices you have.

Throughout this policy we distinguish between three groups, because our responsibilities differ:

• You, our customer — the business and the individuals at that business who register and log in. For this data we are the controller.
• Your connected accounts — the Instagram professional accounts, LinkedIn Pages and profiles, and X accounts you connect to Fullscreens. Here we act as a processor, on your instructions.
• People who interact with your accounts — someone who comments on your post, sends your account a message, or mentions you. We process this data only so that you can manage that specific account, and we act as a processor for you.

If you are in the third group and want your data removed, see section 08.6.

Our platform links to and integrates third-party services. We do not control how those third parties process data, and their practices are governed by their own policies.

We may update this policy to reflect legal changes or product changes. The latest version is always at fullscreens.in/privacy and the “last updated” date shows when it changed. If a change materially affects how we use data you have already given us, we will notify you by email before it takes effect.

Data you give us directly

• Contact and account data — name, email address, email verification status, and your account identifier. Passwords are handled by our identity provider and we never see or store them in readable form.
• Billing data — business name, billing address, and tax identifiers. Card payments are processed entirely by our payment provider; we receive only a transaction reference, the last four digits, and the payment status. We never receive or store full card details.
• Content data — the briefs, prompts, captions, images, video, and brand guidelines you create or upload, and the posts you schedule.
• Communication data — support requests, contact form submissions, and correspondence with us.

Data generated automatically when you use Fullscreens

• Traffic and device data — IP address, browser and device type, operating system, and access times.
• Usage data — authentication and session events, feature usage, and plan consumption metrics.
• Log data — application and API logs including timestamps, request paths, your account identifier, and error traces.
• Consent records — the date, time, IP address, and browser of your acceptance of our Terms and this policy, kept as proof of consent.

We do not use advertising cookies or cross-site tracking pixels.

We receive this data only after you complete the platform's own authorisation screen and grant permission. We request the minimum access needed for the features you use, and you can disconnect any account at any time.

How we act as a Meta Tech Provider

When a business connects its Instagram professional account to Fullscreens, we access Instagram (Meta) Platform Data as a Tech Provider. That means we Process that data only on behalf of, and at the direction of, that business (our Client) — to help them publish, analyse, and reply on their own Instagram account. We do not Process Instagram Platform Data for our own purposes, or for another Client.

• On the Client’s instructions only — we publish, reply, and retrieve analytics only as that Client configures in Fullscreens.
• Separated by Client — each Client’s Instagram data is stored in a database dedicated to that Client and is never mixed with another Client’s data.
• Not sold and not reused — we do not sell, licence, or purchase Instagram Platform Data. We do not use it to advertise, to train AI models, or to build or enrich profiles of people.
• Shared only as Meta allows — with that Client; with our service providers solely as needed to deliver that Client’s service; where the law requires it; or with a service provider the Client expressly directs us to use.
• Deleted when asked, or when the Client leaves — if the Client or a User asks us to delete Instagram Platform Data, or if the Client closes their Fullscreens account, we delete it on the timeline in section 08.
• We will pass on Meta notices — if Meta contacts us about a User’s request concerning their Instagram data, we notify the relevant Client promptly.

Instagram

Fullscreens connects to Instagram professional accounts (Business or Creator) using Business Login for Instagram. A linked Facebook Page is not required, and we do not connect to Facebook Pages.

If you connect an Instagram professional account, we access: profile image, display name, username and account ID, account type, follower and media counts, access and refresh tokens, and your existing and published media including captions. Depending on the features you enable, we also access:

• Analytics — reach, impressions, likes, saves, shares, profile views, website clicks, and aggregate follower demographics for your account and posts. Demographic data is aggregated and does not identify individuals.
• Comments — comments and replies on your posts, including the commenting account's username, account ID, the comment text, and the timestamp. We use this so you can read, reply to, hide, or delete comments on your own posts, and so the Reply Intelligence and DM Intelligence you set up can answer them. We read comments from Instagram when you open them and do not keep a copy; the only comment data we store is your intelligences' activity log (see section 06).
• Direct messages — when you open Messages in Fullscreens, or when an Inbox Intelligence you set up receives a new message, we read that conversation (the sender's username and account ID, message text, and timestamps) from Instagram, and send the replies you or your Inbox Intelligence write. We do not keep a copy of your conversations; the only message text we store is the activity log (see section 06).
• Private replies — if you turn on DM Intelligence, we send one private message to a person who commented on your post, as Instagram allows.

Access we request: your profile and media; the ability to publish content; account and media analytics; the ability to read, reply to, hide and delete comments on your own posts; and the ability to read and reply to direct messages people send your account, including a private reply to someone who commented. We request only the access the features you enable actually require, and we operate within whatever Meta approves and you grant — never more.

LinkedIn

Fullscreens connects to LinkedIn Pages you administer and, where you choose, to your personal LinkedIn profile. We access LinkedIn data through LinkedIn's official Community Management API, only after you authorise it.

LinkedIn data we collect

• Member and account identifiers — your LinkedIn member ID, name, profile image, and email address, used to identify you and the account you authorised.
• Page information — the LinkedIn Pages you administer, each Page's profile data, and your administrative role on each Page.
• Content — the posts published through Fullscreens or read back from your Page or profile, including text, media, and links.
• Engagement data — comments and reactions on your posts, including the commenting member's name, headline, profile image, and comment text.
• Analytics — post, Page, follower, and visitor metrics such as impressions, reactions, comments, shares, follower counts, and visitor counts.
• OAuth credentials — the access token and refresh token LinkedIn issues when you authorise Fullscreens. We never receive your LinkedIn password.

Why we use LinkedIn data

We use LinkedIn data for these purposes only, all of which exist to deliver functionality you asked for:

• To connect and manage the LinkedIn Pages and profile you authorise, and to confirm your admin role on them.
• To publish and schedule content that you have created and approved, to your Page or your profile.
• To retrieve analytics on that content and your Page, and show them to you.
• To show you comments and reactions on your posts, and to publish the replies and reactions you approve.
• To keep the integration working — refreshing tokens, handling API errors, and enforcing LinkedIn's retention limits.
• To keep the platform secure — detecting abuse, and meeting our legal obligations.

Access we request: the ability to sign you in and identify you; to see which Pages you administer and your role on each; to read and publish posts for those Pages and, where you choose, your profile; to read and publish comments and reactions on those posts; and to read Page, post, and follower analytics. We request only the access the features you enable actually require, and we operate within whatever LinkedIn approves and you grant — never more.

LinkedIn member data and real-time processing

We do not maintain a persistent record of individual LinkedIn members who comment on or react to your posts. When this information is required for a Community Management feature, Fullscreens retrieves it from LinkedIn through the official API and processes it in real time for the requested functionality.

For automated or real-time workflows, the relevant LinkedIn data is retrieved when the workflow is triggered, processed to determine the action configured by the customer, and the authorised action is then performed through LinkedIn. We do not retain the member's profile or activity as a permanent record for the purpose of operating these workflows.

If transient technical processing results in temporary retention, LinkedIn's applicable data-storage limits are enforced as hard ceilings. The full limits are set out in section 06. LinkedIn member data is not made available for export or download from Fullscreens.

X (formerly Twitter)

If you connect an X account, we access: profile image, display name, handle and user ID, access and refresh tokens, your posts and their content, replies and mentions directed at your account, and post metrics including impressions, likes, reposts, replies, and link clicks. Where you choose to respond, we publish posts and replies as your account.

Access we request: your profile; the ability to read your posts and the replies and mentions directed at your account; the ability to publish posts, replies, and media as your account; and a refresh token so the connection keeps working without asking you to sign in repeatedly. We request only the access the features you enable actually require.

We do not request access to your X Direct Messages, and we do not offer automated liking on X.

How we store and protect your access tokens

Connecting an account gives Fullscreens an access token and, on most platforms, a refresh token. These are the keys to your account, and we treat them as secrets:

• We never receive your password. Every connection uses the platform's own authorisation screen. Your credentials are never sent to us.
• Tokens are encrypted at rest, and encrypted a second time at the application layer with keys held in a managed key service — so they cannot be read even by someone with direct database access.
• Tokens are never exposed to you, to other customers, or to third parties. They are never displayed in our interface, never included in analytics or logs, never sent to our AI providers, and never shared with anyone outside the platform they belong to.
• Tokens are used server-side only, to make the specific API calls needed for the features you enabled, and are transmitted only over TLS 1.2 or higher.
• Tokens are scoped to your account alone. A token from one customer is never used to access another customer's account or data.
• Access is least-privilege. Only authorised personnel who need it to operate the platform can reach the systems that hold tokens, and every platform API call is audit-logged and attributed.

What happens when you disconnect

You can disconnect any account at any time. Whenever any of the following happens, we revoke the authorisation with the platform and delete the stored access and refresh tokens immediately, and we stop every scheduled post and automated action for that account at the same moment:

• You disconnect the account inside Fullscreens.
• You revoke Fullscreens' authorisation on the platform itself — in your Instagram settings, in LinkedIn's permitted-services settings, or in your X connected apps.
• The access or refresh token expires, or the platform invalidates it.
• You close your Fullscreens account, or your subscription ends.
• You ask us to delete your data.
• The platform withdraws our access, or we stop operating the integration.

Where the platform provides a revocation endpoint, we call it, so the grant is withdrawn on the platform's side and not merely deleted on ours. Once revoked, Fullscreens has no further ability to read from or publish to that account — regaining access requires you to authorise it again from scratch.

We then delete the data we obtained from that account — posts, comments, messages, analytics, and cached profile data — within 48 hours, and sooner where a platform's own retention limit requires it. Content you created inside Fullscreens stays in your library unless you ask us to delete it. The full timeline, and how to ask, is in section 08.

What we never do

We never ask for, receive, or store your social media password for any platform — every connection uses the platform's official authorisation flow. We never request permissions beyond those listed above. We never obtain platform content by scraping, crawling, or any means outside the official APIs.

Artificial intelligence

We use third-party AI models to generate captions, images, video, and suggested replies. When you use these features, the prompt and the brand context you supplied are sent to the AI providers we use so the output can be produced and returned to you. When one of your Social Intelligences (Reply, DM or Inbox Intelligence) writes a reply with AI, the comment it is answering together with the earlier messages of that comment thread, or the recent messages of the conversation it is answering (you choose how many, or turn this memory off), the person's username, and the text of the documents you attached to it are also sent — only to write that one reply, or the draft you asked for. When a document you attach is a scan or an image, it is sent to an AI model once, when you upload it, so its text can be read; only that text is kept.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

Things we will never do with your data

We will never use it to discriminate against people on the basis of race, ethnicity, national origin, religion, age, sex, sexual orientation, gender identity, disability, or any other protected characteristic. We will never derive or store inferences about a person's health, financial status, political affiliation, religious beliefs, sexual orientation, trade union membership, or criminal history. We will never use it for surveillance, background checks, individual profiling, or decisions about credit, insurance, employment, or housing. We will never combine it with other sources to build profiles or generate sales leads, and we will never use it for advertising or ad targeting.

We share data only with service providers that help us run Fullscreens, and only as much as each one needs. Each is bound by a written contract requiring confidentiality and appropriate security, and each may process the data only on our instructions. Those providers fall into these categories:

• Cloud hosting and infrastructure — application servers, databases, file storage, and content delivery
• Identity and authentication
• Caching and background job processing
• AI model providers — for the content generation described in section 04
• Payment processing and invoicing
• Transactional email
• The social media platforms themselves — Instagram (Meta), LinkedIn, and X receive the content you instruct us to publish and the API requests we make on your behalf

Our current named service providers, and where each is located, are listed at fullscreens.in/subprocessors. We keep that page up to date and will notify customers before adding a provider that processes personal data.

We may also disclose data where the law requires it — in response to a valid legal process, a court order, or a lawful request from a public authority, handled under our Law Enforcement & Legal Requests guidelines at fullscreens.in/legal-requests — or where necessary to establish or defend legal claims, prevent fraud, or protect the safety of any person. If we sell or transfer our business, data may transfer as part of that transaction, and the acquirer remains bound by this policy.

Keeping customers separate

Each customer's data is stored in a database dedicated to that customer. Data belonging to one customer is never placed anywhere another customer or a third party can reach, and data about a connected account is only ever shown to people associated with that account.

We keep personal data no longer than we need it for the purposes described above, and no longer than the law allows.

Limits the platforms require us to apply

The social media platforms impose their own maximum retention periods, which are shorter than ours. Where they are shorter, theirs apply, and we enforce them automatically by expiring the data in our database. Where two limits overlap, the shortest applies.

LinkedIn: Fullscreens generally does not persist or cache LinkedIn member profile data or member social activity. When LinkedIn member information is needed to provide Community Management functionality, we retrieve it through LinkedIn's official API and process it in real time for the specific action or display requested by the customer.

For example, when a customer monitors or responds to a comment on a LinkedIn Page, Fullscreens retrieves the relevant information from LinkedIn when required, processes it to provide the requested functionality, and, where applicable, sends the customer's approved response back through LinkedIn. We do not maintain a permanent database of the individual LinkedIn members who comment on or react to customer content.

Where transient technical processing — such as an in-memory operation, queue, cache, or error-handling mechanism — temporarily causes LinkedIn member data to be retained, such data is automatically expired or deleted within the limits required by LinkedIn. We never intentionally retain LinkedIn member profile data or member social activity beyond the periods permitted by LinkedIn.

LinkedIn's applicable limits are currently 24 hours for member profile data and 48 hours for member social activity, including posts, comments, likes, and mentions. Where we do not need to retain such information, our normal practice is to process it in real time and not store it persistently.

Data about your own organisation is treated separately: your organisation's social activity is kept up to 6 months, its profile data up to 8 weeks, and aggregate Page reporting data, which contains no member-level information, up to 1 year.

We do not export LinkedIn member data, make it available as a downloadable dataset, combine it with other data to build or enrich profiles, or use it for advertising, ad targeting, sales prospecting, lead generation, CRM enrichment, recruiting, or audience building.

X: if content we hold is deleted, made private or protected, or removed on X, or if X or the account owner asks us to remove it, we delete or update our copy within 24 hours. If our X API access ends, we delete all X data within 10 business days. X only makes private post metrics available for 30 days, so any longer analytics history comes from aggregate snapshots we took while the data was available.

Instagram (Meta): we delete data obtained from Instagram when you request deletion, when you disconnect the account, when you remove Fullscreens in your Instagram settings, or when your subscription ends. Comments, messages, posts and analytics are read from Instagram when you view them rather than copied, so deletions and edits made on Instagram show up straight away.

Because this is the part of Fullscreens that affects other people, we describe it plainly.

Publishing

You create or approve the content, choose the account, and choose the time. Before you confirm, we show you exactly what will be published, to which account, at what time, and what location information if any will be attached. We then deliver that approved content at the scheduled moment. Nothing is published to your accounts that a person at your organisation has not reviewed and approved, and we keep a record of who approved what.

Automated replies

Social Intelligence in Fullscreens — Reply Intelligence, DM Intelligence and Inbox Intelligence — answers comments on your own Instagram posts and direct messages people send your account. They work within limits we enforce in software:

• They only answer people who commented on your posts or messaged your account first. They never contact anyone based on keyword searches, hashtags or trending topics, or because they follow you.
• You choose which posts they watch and, if you like, which words trigger them.
• Each comment gets at most one public reply and at most one private message. The private message is the single private reply Instagram allows within 7 days of a comment; we send no follow-up messages to commenters.
• Direct messages are answered only within Instagram's 24-hour window after the person's last message, with one reply per message. If Inbox Intelligence isn't sure, or the person seems to want a human, it leaves the conversation for you. You can switch it off for any conversation, and when you reply yourself it stays out of that conversation for 12 hours.
• Replies are either text you wrote or written by AI in the voice, with the facts and from the documents you gave it. You can see everything it did in its activity log, and pause or delete it at any time.
• We never reply to your own comments, and we never use a platform's “human agent” exception for automated messages.
• On LinkedIn we do not post automated comments or reactions at all. Comments and reactions require a person to approve and send them. On X, we do not offer automated liking or keyword-triggered replies.

Your consent to automation

Authorising Fullscreens through a platform's login screen is not by itself your consent for us to act automatically on your account. Nothing is answered automatically until you set up a Reply, DM or Inbox Intelligence for a specific account, and each one shows what it will do before you turn it on. You can pause or delete it, email grievance@fullscreens.in, or disconnect the account at any time, which stops all automated activity immediately. If we materially change what our automation does, we will ask you again.

You have the right to have your data deleted. This section tells you exactly how.

8.1 How to send us a request

Both of those are requests, not conditions. If you email from a different address or use a different subject line, we will still act on your request — we may simply ask a question or two to confirm your identity first, because deleting the wrong account is worse than a short delay. If you cannot access your registered email address, tell us and we will verify you another way.

You do not need to give a reason. Deletion is free, and we will not treat you differently for asking.

8.2 What we delete, and when

We keep only what the law requires — principally billing, invoice, and tax records under Indian law. When we confirm completion, we will tell you specifically what was kept and why.

8.3 Deleting data for one connected account, without closing your Fullscreens account

Email grievance@fullscreens.in with the subject “Disconnect Account” and tell us which social account it concerns. We revoke and delete that account's tokens immediately, stop all scheduled and automated activity for it, and delete the platform data we hold for it within 48 hours. Content you created inside Fullscreens stays in your library unless you ask us to delete it.

8.4 Deleting your entire Fullscreens account

Email grievance@fullscreens.in with the subject “Data Deletion Request”, as described in 8.1. We will acknowledge within 72 hours, immediately revoke every token and stop all automated activity, then delete your dedicated database, all content, media, analytics, comments and messages, your files from our storage and content delivery network, and your account record — all within 15 days — and confirm to you when it is done.

8.5 If you removed Fullscreens from your Instagram settings

Removing Fullscreens from the apps and websites section of your Instagram settings immediately ends our access to that account: Instagram tells us, and we delete the token and the Instagram data we hold for that account automatically. If you ask Meta to have your data deleted, Meta passes the request to us; we delete everything we hold for that Instagram account and give you a confirmation code with a page where you can check the status. You can also email grievance@fullscreens.in with the subject “Data Deletion Request” and tell us which Instagram account it concerns; we will acknowledge within 72 hours and delete it on the timeline in section 8.2.

8.6 If you are not a Fullscreens customer

If you commented on, messaged, or mentioned an account managed with Fullscreens and want your data deleted, email grievance@fullscreens.in. That data is processed on behalf of the business whose account you interacted with. We will confirm receipt of your request, notify that business where appropriate, and help process your request in accordance with applicable law and platform requirements. In most cases the platforms' own retention limits mean the data is already deleted automatically within 24 to 48 hours.

• Encryption in transit — TLS 1.2 or higher on every connection, including to our databases and to every platform API.
• Encryption at rest — all stored data is encrypted. Social media access and refresh tokens are encrypted again at the application layer with keys held in a managed key service, so they cannot be read even with direct database access.
• Access control — role-based access on least privilege, multi-factor authentication for administrative access, and short-lived credentials.
• Separation — a dedicated database for each customer.
• Monitoring — centralised audit logging of every platform API call, attributed to the account and person that caused it.
• Vulnerability management — a documented written process, dependency scanning, and security testing at least every 12 months.
• Incident response — a documented procedure. We notify affected customers and the relevant authorities without undue delay, and we notify the affected platform within any period it requires, including within 24 hours where Meta or LinkedIn require it.

Only authorised personnel who need access to operate the platform have it, and they are bound by confidentiality obligations.

No system is completely secure, but if something happens that affects your data we will tell you promptly and honestly. Report a security concern to security@fullscreens.in.

You can contact us at any time to exercise these rights:

• Access — obtain confirmation of what personal data we hold and a copy of it
• Rectification — have inaccurate or out-of-date data corrected
• Erasure — have your data deleted (section 08)
• Restriction — have processing paused while a dispute about accuracy or lawfulness is resolved
• Portability — receive your data in a machine-readable format, or have it sent to another provider
• Objection — object to processing based on our legitimate interests
• Withdraw consent — for marketing, or for automated actions on your accounts
• Complain — to your data protection authority

To exercise any of these rights, email grievance@fullscreens.in. For a copy of your data, email us with the subject “Data Access Request” and we will send the copy to your registered email address. We acknowledge every request within 72 hours and complete it within 15 days. There is no charge, and we will not treat you differently for asking.

If you are in India: you may exercise your rights under the Digital Personal Data Protection Act, 2023, including access, correction, erasure, grievance redressal, and nomination. Our Grievance Officer can be reached at grievance@fullscreens.in or by post at the registered address below.

If you are in the EEA, UK, or Switzerland: the legal bases for our processing are in the table in section 04. You may lodge a complaint with your local supervisory authority.

If you are in California: you have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You may use an authorised agent.

We operate from India and our infrastructure is hosted in India and Europe, with content delivery and some processing in Singapore and the United States. This means your data may be transferred to and processed in countries other than your own.

Where personal data is transferred out of the EEA, UK, or Switzerland, we do so only where permitted and with appropriate safeguards — Standard Contractual Clauses approved by the European Commission, or an adequacy decision where one applies, together with technical measures including encryption and access controls. We review these safeguards on an ongoing basis. You can request details of the mechanism that applies to a particular transfer at grievance@fullscreens.in.

Fullscreens is a business platform and is not intended for anyone under 18. We do not knowingly process personal data of children. If we learn that we have, we will delete it. If you believe a child has given us personal data, contact grievance@fullscreens.in.

Fullscreens integrates with Instagram (Meta Platforms, Inc.), LinkedIn (LinkedIn Corporation), and X (X Corp.). Fullscreens is an independent product and is not an official product of, endorsed by, sponsored by, or affiliated with any of them. Their names and logos are their property and we use them only to identify which platform a feature relates to.

For Instagram, we apply as a Meta Tech Provider: we access another business’s Instagram data only to provide that business the Fullscreens service they subscribed to. Nothing in this policy supersedes, modifies, or conflicts with the Meta Platform Terms or Developer Policies. Where those terms are more restrictive, they apply.

Your use of those platforms remains governed by their own terms and privacy policies:

• Meta — Privacy Policy and Terms of Service
• LinkedIn — Privacy Policy and User Agreement
• X — Privacy Policy and Terms of Service

Nothing in this policy supersedes, modifies, or conflicts with those platforms' terms or their policies on platform data. Where our practices are more protective, ours apply. Where theirs are more restrictive, theirs apply.