Last updated: 13 July 2026
This Privacy Policy explains how HDM Business Automations ("we", "us", "our"), the operator of HDM SocialDesk (the "Service", available at socialdesk.hdmbusinessautomations.com), collects, uses, stores, shares and deletes your information — including data we access through the Meta platforms (Facebook and Instagram) on your behalf and at your instruction.
HDM SocialDesk is operated by HDM Business Automations, based in Mumbai, India. For any privacy question or request you can reach us at [email protected] or on WhatsApp at +91 91378 68979.
When you sign up we collect your name, email address and a securely hashed password (we never store your password in plain text). We also store your timezone and your posting preferences.
The images, videos and captions you upload to schedule and publish. Your media is stored on our servers so it can be delivered to the platforms you connect. Your media is never sent to any AI provider — captions are generated from text context only (sector, brand, keywords, city).
When you connect a Facebook Page or Instagram account, we access — through Meta's official Graph API and only with your consent — the specific data described in the table below. We request the minimum permissions needed to let you publish to your own accounts.
| Meta permission | Why we request it | Data we access | How long we keep it |
|---|---|---|---|
pages_show_list |
To show you the Facebook Pages you manage so you can choose which one to connect. | Page IDs and names of Pages you manage. | Only the Page you select is retained as part of your connection; the rest is discarded. |
pages_read_engagement |
To read the identity and metadata of the Page you connect so we can publish to it. | Page ID, name and category. | Stored as part of your connection until you disconnect or delete your account. |
pages_manage_posts |
To publish the posts you compose and schedule to your Facebook Page — photos, videos, reels, multi-photo posts and stories — only when you explicitly publish or schedule them. | An encrypted Page access token, plus the post content you create. | The access token is stored encrypted until you disconnect or delete your account. |
instagram_basic |
To read the identity of the Instagram professional account linked to your connected Page. | Instagram Business account ID and username. | Stored as part of your connection until you disconnect or delete your account. |
instagram_content_publish |
To publish the photos, videos (reels), carousels and stories you compose and schedule to your Instagram Business account — only when you explicitly publish or schedule them. | An encrypted access token, plus the media and caption you create. | The access token is stored encrypted until you disconnect or delete your account. |
instagram_manage_comments |
Only if you turn on Comment auto-reply: to receive the comments people leave on your own Instagram posts and reels, so we can spot the keywords you chose (for example “LINK”). Only if you also switch on “Also reply under the comment”: to post one short public reply you chose (for example “Sent you a DM 📩”) under that comment, after the private message was sent. | Comment ID, comment text, the commenter's username and the post ID — for comments on your own media only. | Comments without your keyword are discarded at once. For a matched comment we keep the comment ID, text and username for 90 days as your reply log, then delete it. |
instagram_manage_messages |
Only if you turn on Comment auto-reply: to send one private reply — the message you wrote — to a person who commented your keyword. We never message anyone who did not comment, and never more than once per comment. | The message you wrote and Meta's delivery result. | Kept with the reply log above (90 days). |
pages_manage_metadata |
Only if you turn on Comment auto-reply: to subscribe the Facebook Page linked to your Instagram account to our webhook, which is how Meta delivers new comments to us. | Your Page ID and the subscription status. | The subscription ends when you disconnect, delete your account, or remove HDM SocialDesk from your Facebook business integrations. |
We do not read your private messages or inbox, we do not post without an explicit action by you, we reply to a comment publicly only when you switch that on in Comment auto-reply, and we only ever publish to accounts you own or manage and have connected yourself.
If you connect these platforms, we receive only what is needed to publish the posts you schedule:
youtube.upload and youtube.readonly) — your
channel ID and name, to show which channel is connected; the upload status and privacy setting of the videos
we upload for you, to tell you whether each one went out; and an encrypted access + refresh token. We do not
read your other videos, comments, subscribers or analytics.openid, profile, w_member_social,
and for company Pages w_organization_social and rw_organization_admin) — your
member ID and name, the names of the Pages you administer (so you can choose where to post), and an encrypted
access token.tweet.read, tweet.write, users.read,
media.write, offline.access) — your X user ID and @handle, and an encrypted access
+ refresh token.This data is used only to publish your scheduled posts and show their status in the app. It is stored until you disconnect the platform or delete your account, and it is never sold, shared with advertisers or used to train AI models.
SocialDesk uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service; Google's handling of your data is covered by the Google Privacy Policy. SocialDesk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell your personal data, and we do not use your uploaded media to train any machine-learning or AI model.
We share data only as needed to run the Service:
We do not share your data with advertisers or data brokers.
We keep your data only for as long as your account is active. When you disconnect a platform, its tokens are deleted immediately. When you delete your account, we permanently delete your account, uploaded media, connected-platform tokens, scheduled posts and history. See the Data Deletion page for step-by-step instructions and timelines.
The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect data from children.
We may update this policy from time to time. Material changes will be reflected by the "Last updated" date at the top of this page.
HDM Business Automations, Mumbai, India
Email: [email protected]
WhatsApp: +91 91378 68979