HumanLab Social

Privacy Policy

Service: social — a social media operations console · Operated by HumanLabAI · Contact: humanlabai@naver.com · 한국어로 읽기

1. About the service

social is an operations console that HumanLabAI runs on behalf of client businesses. It publishes posts to their Instagram accounts and Facebook Pages, brings their comments and direct messages (DMs) into one inbox, and has AI write reply drafts that are sent only after a person approves them. HumanLabAI acts as a Tech Provider on the Meta platform and processes data under each client's instructions and contract.

2. Data we collect and process

  • Profile and media metadata of the connected Facebook Pages and Instagram business accounts (name, username, profile picture, follower count, posts).
  • The text of comments and DMs received by those Pages and accounts, the sender's display information (name / username), and attachment URLs.
  • Posts the client writes and publishes in this service (text, images, videos) and the publishing result (the post's address, or why it failed).
  • Access tokens needed to operate the Pages and accounts (stored encrypted).
  • The text of replies that were approved and sent, kept to improve later drafts.

3. Why we use it

  • To publish the client's posts to the connected Pages and accounts (now or on a schedule).
  • To read and answer comments and DMs in one inbox.
  • To write reply drafts grounded in the client's own knowledge documents (sent only after a person approves).
  • To learn from past replies and improve response quality.

4. Third-party processing (sub-processors)

  • Amazon Web Services (AWS, Seoul region) — hosts the application and the database. Comments, DMs and (encrypted) access tokens are stored here.
  • Cloudflare (R2) — stores and serves the image and video files a client uploads to attach to posts.
  • Google (Gemini API) — writes reply drafts and text embeddings. Message text is sent only for that purpose.
  • Meta Platforms — publishing posts and sending / receiving comments and DMs through the Graph API.
  • Resend — sends sign-up verification and password-reset emails to the operator's account (only the operator's email address is shared; no comments or DMs).
  • Kie.ai — generates images, videos and voice for posts when a client asks for them (only the client's production brief and reference images they uploaded are sent; no comments, DMs or account information).
  • Only when a client connects YouTube, X or TikTok, posts are published and comments exchanged through that platform's API.

5. Security

Sensitive data such as access tokens is stored encrypted with AES-256-GCM, and data in transit is protected with HTTPS (TLS). Data is isolated per client (tenant) and one client cannot reach another's.

6. Retention and deletion

We keep data until the purpose of the service is fulfilled or the client's contract ends, and delete it without delay afterwards. You can ask for your data to be deleted as described below.

7. Requesting deletion

To have data about you deleted, follow the steps on the data deletion page or write to humanlabai@naver.com. Removing the app in Facebook disconnects it through the deauthorization callback.

8. Contact

HumanLabAI · humanlabai@naver.com