Privacy Policy

Fidus Social (reply.fidus.media) is a dashboard that restaurants and local businesses, and Fidus Media itself, use to plan, preview, schedule and publish their own short videos and photo posts to their own Instagram professional account, Facebook Page and TikTok account. It also offers Instagram comment-to-DM automation: when someone comments a keyword you choose, Fidus Social sends them a private reply with a link. Access is invite-only for Fidus Media customers.

The data controller is FIDUS S.R.L., Via Filippo Corridoni 25, 00195 Roma (RM), Italia, P.IVA 18535911004 (“Fidus”, “we”, “us”). For any privacy question or request, write to privacy@fidus.media.

When a business uses Fidus Social to handle the personal data of people who comment on its Instagram posts, that business decides why the data is used, and we process it on the business’s behalf to provide the service.

• Account data: the email address you sign in with, your name if you add it, sign-in sessions, and the one-time sign-in links (magic links) we email to you. We do not use passwords.
• Workspace data: workspace name, members and their roles, invitations (the invited email address), your settings such as posting time slots and alert email, and your content calendar.
• Instagram and Facebook data: described in section 5.
• TikTok data: described in section 4.
• Content files: the videos, photos and cover images you upload, the captions you write, and the schedule and settings you choose for each post.
• Logs: technical records such as IP address, browser user agent, timestamps, requests, errors, and publishing and delivery logs.

We use only the cookies that are strictly necessary to sign you in and keep you signed in. We do not use advertising cookies.

• To sign you in and keep your account secure.
• To connect the accounts you authorize and keep those connections working.
• To store, preview, schedule and publish the posts you create, only to the accounts and at the times you choose.
• To run the Instagram comment-to-DM campaigns you set up: find your keyword in comments on your posts, send one private reply through the Instagram API, and avoid sending duplicates.
• To show you post status, links to published posts, delivery logs and statistics for your own Instagram posts.
• To send service emails: sign-in links, invitations and the alerts you turn on.
• To keep the service secure, prevent abuse and fix problems.

We do not sell personal data, and we do not use it for advertising.

Fidus Social connects to TikTok only through TikTok Login Kit and the TikTok Content Posting API. We ask TikTok for these permissions (scopes):

• user.info.basic — to identify the connected TikTok account and show its display name and avatar.
• video.upload — to send a video to your TikTok inbox as a draft, only when you choose that option.
• video.publish — to post a video to your TikTok account when you press Post to TikTok or approve a time slot.

What we receive and store

• From Login Kit: your TikTok open_id, display name, avatar URL and the scopes you granted, plus an access token and a refresh token. Tokens are encrypted at rest (AES-256-GCM) and are used only on our servers, never in your browser.
• At posting time: we ask TikTok’s creator_info endpoint for the creator nickname and avatar, the privacy options your account allows, whether comments, Duet or Stitch are turned off in your account, and the maximum video duration. We use this only to show the posting screen and enforce those limits. We keep only the nickname, next to the post record.
• For each post: the video file you chose (already uploaded by you to Fidus Social), the caption you wrote or edited, the settings you selected, and the publish_id, status and post ID that TikTok returns, so we can show you the status of the post.

We do not read your existing TikTok videos, followers, messages or analytics.

How posting to TikTok works

Nothing is ever posted to TikTok without your explicit action for that specific post. On the TikTok posting screen you see the video preview and your TikTok nickname and avatar, and you edit the caption. You choose who can view the video (there is no preselected option), whether to allow comments, Duet and Stitch, and you declare commercial content (“Your brand” or “Branded content”) when it applies. You see TikTok’s Music Usage Confirmation, and its Branded Content Policy when relevant. Then you press Post to TikTok, or approve the post for a specific time slot. After posting we show the status; TikTok may take a few minutes to process the video.

Disconnecting TikTok

You can disconnect TikTok at any time from the TikTok page or Social settings in the dashboard. We then revoke the access token with TikTok and delete your TikTok tokens from our database immediately. You can also remove access from the TikTok app: Settings and privacy → Security → Manage app permissions.

Fidus Social connects to Instagram with the Instagram API with Instagram Login, and to Facebook Pages with Facebook Login for Business. We store:

• the ID and username of your connected Instagram professional account, and the IDs and names of the Facebook Pages you connect;
• Instagram and Facebook access tokens, encrypted at rest (AES-256-GCM);
• your comment-to-DM campaign settings: posts, keywords, replies and links;
• the comment data Meta sends us (by webhook or when we check your posts) that we need to process your keyword campaigns, such as the commenter’s ID and name and the comment text;
• delivery logs of private replies, and click records for links sent in them (time, a hashed IP address, browser user agent and referrer);
• publishing status and permalinks of the posts you publish, and the follower count and post insights (such as views, reach, likes, comments, saves and shares) of your own Instagram account, shown on the statistics page.

You can disconnect Instagram and Facebook at any time from the dashboard settings. Meta users can also ask us to delete their data by following the instructions on our Data deletion page.

All access to Instagram, Facebook and TikTok goes through their official OAuth sign-in and APIs. We never ask for or store your platform passwords, we never scrape, and we never use browser automation on your accounts.

• Contract (GDPR art. 6(1)(b)): to provide Fidus Social to you and your business, including signing in, connecting accounts, publishing the posts you choose and running your campaigns.
• Legitimate interest (GDPR art. 6(1)(f)): to keep the service secure, prevent abuse, keep logs and fix problems.

We share personal data only as needed to run Fidus Social:

• TikTok and Meta (Instagram, Facebook) receive data only to perform the actions you request, such as publishing a post or sending a private reply. They handle it under their own terms and privacy policies.
• Hetzner Online GmbH hosts our servers in its EU data centres, where our application, PostgreSQL database and Redis queue run and your files are stored.
• Resend delivers our transactional emails, such as sign-in links and invitations.

We may also disclose data when the law requires it. We do not sell personal data.

We store your data on servers in the European Union. When you publish to TikTok, Instagram or Facebook, the content and data needed for that action are sent to those platforms, which may process them outside the European Economic Area under their own safeguards. If one of our providers processes personal data outside the European Economic Area, we rely on safeguards recognised by the GDPR, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

• Platform tokens are deleted as soon as you disconnect the account from Fidus Social.
• Account and workspace data, including content files and post records, are kept while your account is active and deleted within 30 days of a request to privacy@fidus.media.
• Operational logs are kept for up to 90 days.
• TikTok: disconnect from the TikTok page or Social settings to delete your tokens immediately, or revoke access in the TikTok app (Settings and privacy → Security → Manage app permissions).

See the Data deletion page for step-by-step instructions.

Under the GDPR you can ask us for access to your personal data, and for its rectification, erasure or portability. You can object to processing based on legitimate interest. Write to privacy@fidus.media; we may ask you to confirm that you control the email address or account concerned.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

Platform access tokens are encrypted at rest with AES-256-GCM and are used only on our servers. All traffic to Fidus Social uses HTTPS. Sign-in uses one-time email links, so there are no passwords to leak. Access to production systems is limited to the people who need it to run the service.

FIDUS S.R.L., Via Filippo Corridoni 25, 00195 Roma (RM), Italia — P.IVA 18535911004.

Privacy and data requests: privacy@fidus.media. General questions: hello@fidus.media.

We may update this policy. When we do, we change the date at the top of this page and, for important changes, tell you by email.