Your data, handled with care.

We collect user data in three categories. We only collect what is needed to run EduVerse and we never sell it.

Legal basis (GDPR): performance of contract (provide EduVerse), legitimate interest (security, prevent abuse), and consent (Meta connection, AI chat). You can request access/export or deletion at hello@eduverse.app.

When you connect Facebook and linked Instagram accounts, connect Instagram directly, or connect Threads, you are sent to Meta's consent screen. Meta shows exactly which permissions EduVerse is requesting — you must approve before any token is issued.

We do not request passwords, private messages, or permissions beyond those listed. If Meta adds a permission, it appears explicitly on the consent screen before it is granted.

Sandbox alternative: Not ready to connect? Use Explore the sample demo — a read-only mock dashboard with simulated data. No OAuth, no tokens stored.

After you approve on Meta, Meta redirects back with a short-lived code. EduVerse exchanges that code server-side for a long-lived (30-day) User Access Token, then immediately enumerates your Pages and linked Instagram Business accounts. Only the resulting page-scoped tokens are retained.

• Encryption at rest — AES-256-GCM with a random 12-byte IV and auth tag. Stored as iv.tag.ciphertext (base64url). Key material is derived via SHA-256(ENCRYPTION_KEY) and never leaves the server.
• Transport — tokens travel only in Authorization: Bearer … headers over HTTPS. They are never placed in URLs or logged (see CSP & logging practices below).
• Scope isolation — every row in social_accounts is gated by Supabase Row-Level Security (RLS) via is_workspace_member(workspace_id). One workspace cannot read another's tokens.
• CSRF & state — OAuth state is stored in an HttpOnly, SameSite=Lax cookie (1,800s for Facebook/Instagram, 600s for Threads) and verified on callback. Mismatched state is rejected.

Security posture: Nonce-based CSP in production (script-src 'nonce-…' 'strict-dynamic'), HSTS 30 days, X-Frame-Options DENY, COOP/CORP, and a minimal Permissions-Policy. Media URLs for publishing are validated to be public HTTPS (localhost/private IPs are rejected).

We use AI (artificial intelligence) to provide the EduVerse Assistant in Dashboard > Chat and related content suggestions. Our provider is Google via the @google/genai SDK, model gemini-3.8-flash (configurable via GEMINI_MODEL).

• What is sent: your last up to 20 chat messages (text + optional base64 images, each truncated to 4 MB), plus a live workspace context snapshot: connected Meta account names/handles, follower counts, aggregated metrics, and recent post summaries from fetchMetaAnalytics(). System instructions from lib/ai/eduverse-prompt.ts are also included.
• What is not sent: raw Meta access tokens, your password, or other workspaces' data. Tokens never leave our server except to call the Meta Graph API directly.
• Purpose & retention: solely to generate the assistant's reply for your request. Google's API processes the prompt transiently under its API terms; we do not allow training on your prompts without your explicit consent. Your chat history is stored in Supabase (chat_messages) so you can revisit conversations — delete via Settings or by emailing hello@eduverse.app.
• Human review & accuracy: AI output may be inaccurate or hallucinated. Do not rely on it for definitive analytics — the dashboard's live Meta metrics are the source of truth. We never claim a post was published or analyzed unless the Graph API returned that result.
• How to opt out: simply do not use Dashboard > Chat. All other features (analytics, scheduling, publishing) work without calling the AI provider. Contact hello@eduverse.app to request deletion of stored chat history.

Provider docs: Google Gemini API Terms · Model and key are server-side only (GEMINI_API_KEY never exposed to the browser).

We share data with third parties only as listed below and only to provide EduVerse. We do not sell your data or share it for advertising.

All processors are bound by their terms and, where required, a DPA. Subprocessors may change; material changes will be noted in the version history below and, for active users, via email or in-app notice.

• social_accounts — workspace_id, platform, external_id, display_name / username, avatar_url, encrypted_token (nullable on disconnect), token_expires_at, status, parent_account_id (links Instagram → Page).
• analytics_cache — today's aggregated Graph insights per (social_account_id, metric_date), cached for one day and refreshable via ?refresh=1. Only successful, non-error snapshots are cached.
• scheduled_posts / publishing_attempts — captions, media URLs, and publish status (idempotent by key user:platform:externalId:ISO:caption). Retried at most 4 times with jittered backoff.
• profiles / workspaces / workspace_members — your display name, role, and bio.

All tables are protected by RLS. Data is stored in Supabase Postgres; uploaded media for publishing goes to the post-media Storage bucket (private by default, owner-scoped read/write: foldername(name)[1] = auth.uid(); media is shared with Meta only via time-limited signed URLs, not public bucket listing).

• Page tokens expire after 30 days. EduVerse flags them as “Token expiring soon” 7 days before expiry and “Expired” after.
• Analytics cache is per-day; yesterday's rows remain readable until superseded but are never used to fabricate metrics.
• Scheduled posts remain until published/cancelled, then archived with attempts for audit.

You are in control at every layer:

For full erasure (GDPR Art. 17), disconnect first, then email hello@eduverse.app with your workspace email. We delete workspace rows, storage objects, and revoke any lingering tokens. Backups age out within 30 days.

• We do not sell or rent your data, and we do not share it with third parties beyond the five listed in Third parties we share data with (Supabase, Meta, Google Gemini, Vercel, Upstash).
• We do not post without your explicit Publish / Schedule action.
• We do not log raw tokens or place them in URLs, analytics, or error reports.
• We do not invent metrics when Meta returns none — the dashboard shows an explicit empty state.
• We do not train AI models on your content without explicit consent.

Questions, access/export requests, or deletion: hello@eduverse.app · +1-555-012-3456

Address: 548 Market Street, Suite 41220, San Francisco, CA 94104, US.

This notice supplements our Terms. Meta's own Data Policy and Platform Terms also apply when you authorize access.