Social Media Connector
Privacy Policy
Social Media Connector is operated by The Network Ltd, a New Zealand company ("we", "us", "our"). This policy explains what information Social Media Connector accesses when you connect a social media account or a mailbox, why we access it, how we protect it, who we share it with, and how you can have it deleted.
If you have a question about this policy, email support@thenetwork.co.nz.
1. What Social Media Connector is
Social Media Connector is the part of our customer relationship management (CRM) platform that links third-party accounts to your CRM workspace. You can connect Facebook, Instagram, TikTok and LinkedIn accounts, and a Gmail or Outlook mailbox. Once an account is connected you can publish posts, run adverts, read results, reply to comments and messages, and send and receive email from inside the CRM.
You decide which accounts to connect. Every connection goes through the provider's own sign-in and permission screen. We never see or store the password of a connected account.
2. Information we collect
Information you give us
- Account details: your name, email address, phone number, organisation and role, given when you or your organisation create your CRM account.
- Content you create: the posts, images, videos, adverts, emails and replies you write in the CRM.
- Support requests: the messages you send us when you ask for help.
Information from accounts you connect
When you connect an account, the provider gives us an access token and the data listed in the section for that provider below. We only receive the data covered by the permissions you approve on the provider's permission screen.
Information collected automatically
- Usage and device data: IP address, browser type, pages opened and the time of each request, kept in server logs to run and secure the service.
- Error reports: technical details of faults, used to fix them.
3. Facebook and Instagram (Meta)
If you connect a Facebook or Instagram account, we access:
- Your public profile (name, profile picture and account ID), to identify the connected account and show it to you.
- The Facebook Pages you manage and the Instagram professional accounts linked to them, so you can choose where to publish.
- Posts, photos and videos on those Pages and accounts, and their engagement figures (reach, impressions, views, likes, comments and shares), to publish the content you create and show you how it performs.
- Comments and messages sent to those Pages and accounts, including the name and profile picture of the person who wrote them, so you can read and answer them in the CRM.
- Your ad accounts, business assets, campaigns, ad sets, adverts and their results, to create and manage the advertising campaigns you set up and report on them.
We do not access your personal Facebook timeline, your friends list or your private messages with friends. We do not post anything you have not written or approved.
You can remove Social Media Connector's access in your Facebook settings under Business integrations, or in Instagram under Settings → Website permissions → Apps and websites.
4. TikTok
If you connect a TikTok account, we access:
- Your basic profile (display name, username, profile picture and an account ID), to identify the connected account and show it to you.
- Publishing access, to upload and publish the videos and photos you create or schedule in the CRM to your TikTok account.
- Your own videos and their figures (views, likes, comments and shares), to show you how your content performs.
- Comments on your own videos, including the name and profile picture of the person who wrote them, so you can read and answer them in the CRM.
- Your TikTok advertiser accounts, campaigns and their results, if you connect one, to create and manage the campaigns you set up and report on them.
We do not access the videos of other TikTok users, your following list or your private messages. You can remove access in the TikTok app under Settings and privacy → Security and permissions → Manage app permissions.
5. LinkedIn
If you connect a LinkedIn account, we access:
- Your basic profile (name, profile picture, email address and member ID), to identify the connected account and show it to you.
- The company pages you administer, so you can choose where to publish.
- Publishing access, to publish the posts, images and videos you create or schedule in the CRM to your profile or to those company pages.
- Your own posts, their figures and their comments (impressions, reactions, comments and shares), to show you how your content performs and let you answer comments in the CRM.
- Your LinkedIn ad accounts, campaigns and their results, if you connect one, to create and manage the campaigns you set up and report on them.
We do not access your connections list or your private LinkedIn messages, and we do not use LinkedIn data to build profiles of other members. You can remove access in LinkedIn under Settings → Data privacy → Permitted services.
6. Google user data (Gmail and Google Calendar)
If you connect a Google account to Social Media Connector, you choose to give Social Media Connector access to some of your Google account data. This section explains what we access, why, and what we do with it.
What we access and why
- Your Google account email address and name. Used to identify the connected mailbox and show it to you in Social Media Connector.
-
Your Gmail messages, labels, drafts and attachments (Gmail "modify"
access).
Used to:
- show your mailbox inside Social Media Connector, so you can read, reply to, forward, draft, label, star, archive and move messages to Trash;
- send the emails you write in Social Media Connector, and the emails sent by automations you set up, from your own Gmail address;
- link emails with the contacts and other records in your CRM, and show them on those records' timelines;
- only if you turn these features on: bring supplier invoices that arrive in your mailbox into Accounting, and turn enquiry notification emails from lead-source websites into leads.
- Your Google Calendar events (if you allow Calendar access). Used to show your calendar in Social Media Connector, and to create, update and cancel the appointments you book in Social Media Connector (for example client meetings).
- Your free/busy times (if you allow Calendar access). Used so your booking links only offer times when you are free. We read only busy and free times, not event details, for this.
Who can see it
Your Google data is visible only to you, and to colleagues in your organisation you choose to share your mailbox with. Our staff do not read your email or calendar except:
- when you ask us to, for a specific message, to help with a support request;
- when it is needed for security (for example to investigate abuse);
- when it is needed to comply with the law.
How we store and protect it
- Your Google access tokens are encrypted (AES-256) before they are stored.
- All data is stored in Amazon Web Services data centres in Sydney, Australia, encrypted at rest.
- All data is encrypted in transit (TLS).
- Copies of email message content that we keep so the inbox loads quickly are deleted after 30 days, and fetched from Gmail again when you open the message.
Sharing and transfer
We do not sell your Google data. We do not use it for advertising, and we do not use it to train artificial-intelligence or machine-learning models. We share it only with the service providers listed in section 10, and only to provide the features described above.
AI features
Your email is not processed by AI unless you choose a feature that does so. Today the only one is invoice scanning in Accounting, which reads invoice attachments to fill in your bills. Such features are off by default and are clearly labelled when you turn them on.
Disconnecting and deletion
You can disconnect your Google account at any time in Settings → Integrations. When you do, we revoke Social Media Connector's access at Google and delete the email, labels and calendar events we synced from that account.
You can also remove Social Media Connector's access from your Google Account at myaccount.google.com/connections. If we cannot reach your account for 30 days after that, we delete the synced data automatically.
What stays after you disconnect:
- Email records already linked to your contacts' timelines, and invoices or leads you chose to import. These are part of your CRM records. You can delete them in the CRM, and they are deleted when your account or organisation is deleted.
- Backups, which are kept for up to 30 days.
Limited Use. Social Media Connector's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
7. Microsoft (Outlook and Microsoft 365)
If you connect a Microsoft account, we access:
- Your basic profile (name and email address), to identify the connected mailbox and show it to you.
- Your mail (messages, folders, drafts and attachments), to show your mailbox inside the CRM, to send the emails you write and the emails sent by automations you set up from your own address, and to link emails with your CRM contacts and show them on those records' timelines.
- Your calendar, to show your events in the CRM, to create, update and cancel the appointments you book, and so booking links only offer times when you are free.
- Offline access, so the connection keeps working without asking you to sign in each time.
The optional invoice and enquiry-email features described in the Google section work the same way for a Microsoft mailbox, and are also off until you turn them on. Microsoft data is stored, protected, shared and deleted in the same way as Google data. You can remove access at account.microsoft.com/privacy/app-access or, for a work account, at myapps.microsoft.com.
8. How we use information
We use the information described above only to:
- provide the features you use, as described for each provider;
- keep your account and the service secure, and prevent abuse;
- fix faults and answer your support requests;
- send you service messages (for example when a connection needs renewing);
- meet our legal obligations.
We do not:
- sell information from your connected accounts;
- use it for our own advertising, or give it to advertisers or data brokers;
- use it to train artificial-intelligence or machine-learning models;
- use it to assess creditworthiness, or to monitor or profile individuals.
9. Who can see it
Information from a connected account is visible to you and to the people in your organisation who have been given access to that connection in the CRM. Organisation administrators control those permissions. Our staff only access it when you ask for help, when it is needed for security, or when the law requires it.
10. Sharing and transfer
We share information only with:
| Who | Why |
|---|---|
| The provider of the account you connected (Meta, TikTok, LinkedIn, Google or Microsoft) | To carry out what you ask for: publishing your post, sending your email, creating your advert or posting your reply. |
| Amazon Web Services | Hosting and storage, in Sydney, Australia. |
| Google (Gemini AI service) | Only if you turn on automatic invoice reading. It receives the invoice attachments, not your other email. |
| Sentry | Error monitoring. It is configured not to receive the content of your email. |
| Authorities and advisers | When the law requires it, or to protect our legal rights. |
| A buyer of our business | If the business is sold or merged, under commitments at least as protective as this policy. We will tell you first. |
11. Storage and security
- Data is stored in Amazon Web Services data centres in Sydney, Australia, and is encrypted at rest.
- Data is encrypted in transit (TLS).
- Access tokens for connected accounts are encrypted (AES-256) before they are stored.
- Access by our staff is limited to those who need it, is protected by individual accounts, and is logged.
Because we are based in New Zealand and host in Australia, your information may be transferred to and processed in those countries, and in the countries where the service providers above operate. No system is perfectly secure. If a breach is likely to cause you serious harm, we will tell you and the Privacy Commissioner as the law requires.
12. Retention
- Access tokens: until you disconnect the account, the provider revokes them, or your CRM account is deleted.
- Data synced from a connected account: while the account is connected. Cached copies of email content are deleted after 30 days.
- Records you created in the CRM (posts, campaigns, emails linked to contacts, imported invoices and leads): until you delete them or your organisation's account is deleted. Accounting records may be kept longer where tax law requires it.
- Backups: up to 30 days.
13. Disconnecting and deletion
You can disconnect any account at any time in the CRM under Settings → Integrations. When you do, we delete the access token and stop accessing that account, and we delete the data we synced from it. You can also remove access from the provider's own settings, using the links in each section above.
To have all of your data deleted, follow the steps on our data deletion page or email support@thenetwork.co.nz. We will confirm and complete the deletion within 30 days.
14. Your rights
Under the New Zealand Privacy Act 2020 you can ask us for a copy of the personal information we hold about you and ask us to correct it. Depending on where you live, you may also have the right to have your information deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent. To use any of these rights, email support@thenetwork.co.nz. We answer within 20 working days.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner in New Zealand, or to the data protection authority where you live.
If your CRM account was set up by your employer or another organisation, that organisation decides how its workspace is used. We may refer your request to it.
15. Cookies
This website does not set cookies. The CRM uses cookies that are strictly necessary to keep you signed in and to keep your session secure. It does not use advertising cookies.
16. Children
Social Media Connector is a business tool. It is not intended for anyone under 18, and we do not knowingly collect information from children.
17. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change affects how we use data from your connected accounts, we will tell you in the CRM or by email before it takes effect and, where required, ask for your consent again.
18. Contact us
The Network Ltd, New Zealand
Email: support@thenetwork.co.nz