Privacy Policy

1. What this policy covers

MOON Post is a service that writes blog articles and social media posts for businesses with the help of artificial intelligence. The business owner reviews every post in our dashboard, and approved posts are published to the business's own blog, Facebook Page and Instagram professional account. This policy explains what data we process through the moonpost.ro website and the MOON Post service, why, who we share it with and what rights you have.

For the data we process on behalf of our customers (the content published on their accounts and the access keys to those accounts), we act as a data processor, and the customer remains the controller.

2. Visitors of this website

• Contact form: name, company, website address, email, phone, the selected topic and the message. We use them to answer your request and, if you become a customer, to prepare an offer. Legal basis: our legitimate interest in answering a business request and, later, the performance of the contract.
• Technical data: IP address, browser type and pages visited, processed by the infrastructure that serves the website, for operation and security.
• Marketing cookies: loaded only if you click “Accept all”. The details are in our cookie policy.

3. Customers of the service

• Account and billing data: company name, tax identification data, contact person, email, phone. Legal basis: performance of the contract and tax obligations.
• Access keys to the customer's blog, Meta accounts and, for online stores, product catalog. They are entered in the dashboard, cannot be read back from the interface and are used only to publish approved content and to sync the catalog.
• Generated content: drafts, articles, social media texts, images, topic history, approval status and publishing date.
• Catalog data for online stores: product name, price, stock, categories, image and link. This is public business data from the customer's website. It isn't personal data.
• Public pages of the customer's website, read so the service learns what to write about. They are overwritten every time the site is read again.
• Usage data: the number of posts generated and published and the related generation usage, for billing and statistics.

We do not collect or process data about the visitors of our customers' websites. MOON Post publishes content; it does not track readers.

4. Data received from Facebook and Instagram

A customer can connect their Facebook Page and the Instagram professional account linked to it from the MOON Post dashboard, with the “Connect Facebook + Instagram” button (Facebook Login for Business, through our app on the Meta platform). Alternatively, an access token can be entered manually in the dashboard. FELIX ONLINE CONCEPT SRL processes this data only to publish on the customer's behalf and on their instructions.

What we receive and keep

• the Page access token of the selected Page; if Facebook does not issue one, we keep the long-lived user access token, valid for 60 days;
• the Facebook Page ID and the ID of the linked Instagram account;
• the Page name and the Instagram username, together with the connection date;
• the links to the posts MOON Post published on the Page and the Instagram account;
• the daily totals of reactions, comments and shares of the posts MOON Post published;
• the profile picture of the Page or Instagram account, only if the customer presses the dashboard button that takes the logo from there.

If you manage several Pages, Facebook sends us the list of Pages you granted us access to (name, ID, token, linked Instagram account) so you can pick one. The list is kept on our server for at most 10 minutes and deleted after you choose; we keep only the chosen Page.

For the posts MOON Post published, we read their totals once a day (reactions, comments and shares on Facebook; likes and comments on Instagram; reach, when the access you granted allows it) to show the customer how each post performed. We read only these numbers. We don't read the text of comments, who reacted, followers or messages, and we receive no other data about the people who interact with the Page. We do not access friend lists, ad accounts or other Business Manager data. We never edit or delete existing posts and we never publish on anyone's personal profile.

How we use it

• to publish to the Facebook Page and Instagram account only the posts the customer approved in the dashboard;
• to show the connected Page and Instagram account in the dashboard and check that the connection works (the “Test” button and an automatic daily connection check);
• to show a link to each published post next to it;
• when the customer asks, to use the profile picture as the logo on the images we generate for them.

Legal basis: performance of the contract with the customer. We do not use this data for advertising, we do not sell it and we do not share it with other companies; it is only sent to Meta, in the publishing calls.

Where it is stored

The token, IDs, names and links are stored in the customer account configuration, in the service database hosted by Cloudflare; a logo taken from Facebook or Instagram is stored in Cloudflare storage. The token never reaches the browser: the dashboard shows it masked and it cannot be read back. Only our server uses it, in calls to the Meta Graph API.

How long

For as long as the Page stays connected to the customer account. A new connection replaces the old token. The token is deleted when the contract ends or as soon as you ask; the other data is deleted together with the customer account, at the latest 60 days after the contract ends, or within 30 days of a deletion request.

How to revoke access

• On Facebook: Settings & privacy → Settings → Business Integrations → THE MOON Agency (the app MOON Post uses) → Remove. From that moment the token stops working and we can no longer publish anything.
• Through us: write to contact@moonpost.ro and we disconnect the Page from your account, deleting the token and the IDs.

Removing the app on Facebook stops access but does not delete the data we have already stored. To have it deleted, also send a deletion request.

How to request deletion

Follow the steps in our Data Deletion Instructions. Posts already published stay on your Page and Instagram account; you can delete them at any time from Facebook or Instagram.

5. Who we share data with

We use providers that process data on our behalf, strictly to run the service:

• Cloudflare: hosting of the website, the dashboard, the database and the generated images.
• Google (Gemini models) and OpenAI: generation of text and images. We send them the topic and the content instructions only. We don't send them your billing data or your access keys.
• Meta Platforms: publishing to the customer's Facebook Page and Instagram account (see section 4).
• The customer's blog platform (WordPress): publishing the article.
• Telegram: a notice that a new draft is ready, if this option is turned on.
• GitHub: the infrastructure that triggers scheduled generation.
• Our transactional email provider and invoicing platform, for notifications and tax documents.

We do not sell personal data and do not share it for third-party marketing. Some providers may process data outside the European Economic Area, based on the European Commission's standard contractual clauses.

6. How long we keep data

• Contact form messages: 24 months after the last communication.
• Account data and generated content: for the duration of the contract and 60 days after it ends.
• Access keys, including the Facebook/Instagram token: deleted when the contract ends or as soon as you ask.
• Facebook Page and Instagram account IDs and names: while they are connected, then together with the account data.
• Tax documents: 10 years, as required by law.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent where processing is based on it. Write to contact@moonpost.ro and we will answer within 30 days. For deletion, follow the steps in our Data Deletion Instructions.

If you are not satisfied with our answer, you can contact the Romanian data protection authority (ANSPDCP), dataprotection.ro.

8. Security

Dashboard passwords are stored as cryptographic hashes and never in plain text. Customer access keys cannot be read back from the interface. Access to the dashboard is role-based, and permissions are checked on the server as well as in the browser.

9. Automatically generated content

Content is generated by artificial intelligence models and must be approved by the customer before it is published. We make no automated decisions with legal effect on any person and we do no profiling.

10. Changes

We may update this policy. The version in force is the one published here, with the update date shown at the top. Active customers are notified of important changes by email.