Privacy Policy
Last updated: October 24, 2026
1. Information We Collect
When you connect a social media account (Instagram, Facebook, Threads, YouTube, TikTok, LinkedIn, Pinterest, X, or Bluesky) to Pikvato, we receive your public profile identifiers (account ID, handle, display name), OAuth access and refresh tokens, scheduled post media and metadata you upload, and inbound webhook events (comments, direct messages, and button postbacks) delivered to your connected channels.
2. How We Use Information & Google API Limited Use
We process your connected account data solely to publish content you schedule, evaluate the keyword automation rules you configure in your workspace, and send authorized replies within each platform's policy windows (such as Meta's 24-hour messaging window and 7-day private reply window). We never sell your data or use it to train third-party AI models. Pikvato's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. Token Encryption & Security
All platform OAuth access tokens are encrypted at rest in Cloudflare D1 using AES-GCM (256-bit WebCrypto) with versioned keys (v1:<iv>:<ciphertext>). Inbound webhook deliveries are verified using constant-time HMAC signature checks before any payload is parsed.
4. Data Retention & How to Delete Your Data
Inbound message and comment text is automatically redacted from event logs after 30 days. You can delete your data at any time by: (a) opening Channels in your dashboard (app.pikvato.com/channels) and clicking Disconnect to immediately wipe stored OAuth tokens and pause automations; (b) opening Account Settings (app.pikvato.com/settings) and selecting Delete account to permanently erase your workspace and all associated records; (c) removing Pikvato from your social platform's connected apps settings (which triggers our automated Meta Deauthorize and Data Deletion callbacks at /api/webhooks/instagram/data-deletion); or (d) emailing support@pikvato.com to request manual deletion within 7 business days.
5. Contact
For privacy inquiries, data access requests, or data deletion support, contact us at support@pikvato.com.