Privacy Policy & Data Governance
AI Social Manager, operated by Digital Skill Africa Unlimited, is engineered on three immutable privacy covenants:
Your proprietary Brand Brain and social content are never used to train global foundational AI models.
Every workspace is cryptographically separated. Sensitive OAuth tokens are encrypted at rest with AES-GCM-256.
Instant channel disconnection permanently shreds tokens in real-time. Full data deletion guaranteed within 30 days.
01. Operating Entity & Jurisdictional Scope
This Privacy Policy governs the collection, processing, storage, and transfer of personal and organizational data by Digital Skill Africa Unlimited (“Company”, “we”, “us”, or “our”), operating the AI Social Manager platform and digital employee Yakubu Ishaku.
Our governance framework is architected to comply with leading international statutory regulations:
- Nigeria Data Protection Act (NDPA 2023) and the Nigeria Data Protection Regulation (NDPR).
- General Data Protection Regulation (EU GDPR) and the UK Data Protection Act 2018 (UK GDPR).
- Protection of Personal Information Act (POPIA) of South Africa.
- California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
- Kenya Data Protection Act (2019) and Pan-African data sovereignty standards.
- Meta Platform Terms and Developer Data Protection Assessment standards.
02. Information We Collect & Data Minimization
We collect only the minimum necessary data required to deliver high-performance AI social management services:
Full name, business email address, encrypted password hashes (handled via modern cryptographic PBKDF2/Argon2 algorithms), profile avatar, and organization role assignments (Owner, Admin, Member).
Brand positioning statements, target audience personas, tonal guidelines, product catalogs, content pillars, approved hashtags, and localized cultural dialect preferences provided directly by your workspace team.
Public Page identifiers, account display names, avatars, granted permission scopes, and OAuth access tokens. Tokens are immediately encrypted at rest in our dedicated token vault using AES-GCM-256 encryption.
Subscription tiers, billing cycles, invoice records, and payment gateway references. All financial transactions are processed through PCI-DSS Level 1 compliant gateways (Paystack, Flutterwave, Stripe). We never store raw debit or credit card numbers.
03. Meta Platform Data Compliance & API Usage
In compliance with Section 4 of the Meta Platform Terms and Developer Data Protection Assessment, our integration with the Meta Graph API is strictly bounded by the following operational guarantees:
pages_show_list: Used solely to discover the Facebook Pages managed by the authenticated user and present them for explicit customer selection.pages_read_engagement: Used strictly to verify Page connection health, retrieve feed status, and confirm post delivery during deterministic reconciliation.pages_manage_posts: Used exclusively to publish human-approved posts and updates to the user’s selected Facebook Page feed.
Meta Platform Data (including Page posts, engagement metrics, usernames, and Page IDs) is NEVER used to train, fine-tune, retrain, or validate foundational artificial intelligence or machine learning models. Meta data is consumed purely at runtime for execution, verification, and workspace analytics display.
We do not sell, rent, license, or transfer Meta Platform Data to any third-party data brokers, advertising networks, or unauthorized third parties. All platform data is partitioned strictly within the subscribing customer’s tenant.
04. Cryptographic Security & Token Vault Architecture
We implement defense-in-depth technical safeguards to protect client data against unauthorized access, loss, or leakage:
- AES-GCM-256 Vault Encryption: All sensitive access tokens are encrypted with authenticated AES-GCM-256 before insertion into our database. Each token is stored with a unique initialization vector (IV) and key version identifier.
- Automated Key Rotation: We support controlled cryptographic key rotation to re-encrypt stored credentials under upgraded master keys without service interruption.
- Single-Use Anti-CSRF States: All OAuth handshakes utilize cryptographically secure, single-use state tokens with an automated 15-minute time-to-live (TTL) to prevent cross-site request forgery and replay attacks.
- Edge Compute Isolation: The platform runs on Cloudflare Workers edge compute with TLS 1.3 encryption in transit and strictly scoped database bindings.
05. Digital Employee Agency & Human-in-the-Loop Governance
In compliance with the EU Artificial Intelligence Act and global consumer safety frameworks:
- Mandatory Human Approval: Yakubu Ishaku generates recommendations, strategic learnings, and draft copy. The platform cannot publish any content autonomously without prior affirmative human approval by an authorized workspace user.
- Deterministic Idempotency: All publishing jobs are bound to compound idempotency keys (
postId + targetAccountId), strictly preventing duplicate posts or race conditions. - Deterministic Post Reconciliation: When network timeouts or ambiguous provider responses occur, our reconciliation engine verifies Page feed state with strict temporal bounding before marking jobs as published or retry-eligible.
06. Data Retention & Automatic Erasure Schedules
We adhere to strict data retention schedules to ensure data is retained only for the duration of active service:
| Data Class | Retention Period | Purge Mechanism |
|---|---|---|
| OAuth Tokens & Credentials | Duration of connected channel | Hard-deleted immediately upon disconnect |
| OAuth State Records | 15 Minutes | TTL auto-expiration & burn on consume |
| Publishing Audit Logs | 90 Days | Automated rolling purge |
| Brand Brain Context | Duration of workspace subscription | Purged upon workspace cancellation |
| Statutory Billing Invoices | 7 Years | Statutory tax compliance archive |
07. User Data Rights & Deletion Instructions
Under GDPR (Articles 15–22), NDPA 2023, and CCPA/CPRA, you possess comprehensive rights regarding your personal data:
- Right of Access & Portability: Request a complete export of your workspace Brand Brain, drafts, and analytics in JSON/CSV format.
- Right to Rectification: Edit or correct any inaccurate workspace or profile details directly in account settings.
- Right to Erasure (“Right to be Forgotten”): Demand permanent deletion of your account and all associated tokens.
- Right to Restrict or Object to Processing: Disconnect any social channel at any time without terminating your account.
For complete instructions on disconnecting channels, revoking Facebook permissions, or initiating complete workspace erasure, please visit our dedicated instructions page:
View User Data Deletion Instructions08. International Data Transfers & Sub-processors
Where personal data is transferred internationally, we implement Standard Contractual Clauses (SCCs) and statutory cross-border safeguards approved by the European Commission and the Nigeria Data Protection Commission (NDPC).
Our core authorized sub-processors include:
09. Children’s Online Privacy Protection
AI Social Manager is an enterprise business-to-business (B2B) SaaS application intended exclusively for use by businesses, creators, and authorized professionals. We do not knowingly market to, collect, or process information from individuals under 18 years of age.
10. Data Protection Officer & Regulatory Inquiries
If you have inquiries regarding this Privacy Policy, wish to exercise statutory data rights, or require data deletion assistance, contact our Data Protection Officer:
© 2026 Digital Skill Africa Unlimited • All Rights Reserved