Social Director Privacy Notice

Last updated September 3, 2026

Scope and information handled

The Social Director is an internal, restricted tool operated by The Maidens to manage The Maidens’ Facebook Pages and Instagram professional accounts. This notice applies only to that tool and its managed-account activity, not to Meta’s own platform services or to the public website services described in the general Privacy policy.

For managed accounts, the tool may process Page or professional-account identifiers, names or usernames, assigned capabilities, and public posts, media, mentions, tags, comments, and replies. That information may include public author identifiers and display names, text, timestamps, permalinks, and fields Meta makes available for the relevant object. Public content can contain personal or sensitive information even when it is visible on Meta.

Information comes from Meta through managed-account features, public interactions with managed content, items an operator selects or saves, and people who contact the project about a request. Request correspondence may include an email address, reply information, and links or identifiers supplied by the sender.

Local and operational records

Operator-controlled browser profiles may display or cache public Meta content during review. The tool may retain selected public-content text, identifiers and links, media hashes, limited cropped screenshots for shortlisted or saved items, local descriptions, selection data, AI-assisted recommendations or reasons, draft or published managed-account interactions, and authorization, audit, capability, or readback metadata.

The tool does not request Meta email permission or use Meta direct messages, a Meta Pixel, behavioral advertising, or advertising audiences. Social Director content is not currently sent to a cloud AI processor for analysis.

Why information is used

Information is used to operate and secure the tool, review managed-account activity, prepare or review bounded interactions, deliberately publish an allowed Page interaction when an operator enables it, verify results, maintain safety and audit records, respond to privacy requests, and meet applicable obligations.

Automated assistance may organize, summarize, score, or recommend a bounded interaction. It is not used to make decisions about credit, employment, housing, insurance, education admission, healthcare, legal services, or other similarly consequential decisions about people.

Sharing and security

Meta receives interactions published through its APIs and the API requests needed to provide them. Cloudflare hosts the ordinary signed event-webhook endpoint; its application code validates notification bodies without retaining, logging, forwarding, or acting on them, although Cloudflare may process provider-side operational metadata. The project’s email provider may process privacy correspondence. Operator-controlled browser profiles and local systems may display, cache, store, or analyze Social Director content.

The project does not sell this information or disclose it to data brokers through the tool. Access is limited, credentials are kept separate from operational records, and audit records support operation. No storage or transmission method is perfectly secure. Concerns may be sent to legal@themaidensofficial.com.

Retention

Feed content, observations, sessions, decisions, commands, review metadata, and exact-linked operational records are kept for up to 30 days after their last relevant observation or closure. Capabilities are kept for up to 24 hours after expiry and never more than 30 days after creation. Active saved intake and queue records are kept for up to 30 days after their last update; terminal saved records are kept for up to 7 days. Action evidence is kept for up to 30 days after its terminal outcome or last readback.

Screenshots and crops, reports, exports, PDFs, content-free operational logs, and Social Director database backups are kept for up to 7 days under their applicable workflow. Dedicated browser state, model temporary data, and runtime temporary data have a 24-hour maximum. A log containing Meta Platform Data is removed within 1 hour and its source is corrected.

Privacy-request email and attachments are kept for up to 30 days after closure. Selectors and match maps for a completed request are kept for no more than 24 hours; unresolved selectors may remain for up to 7 days. A random completion receipt designed not to identify the person may be kept for up to 12 months. A specific written legal or Meta hold may retain only its stated scope for up to 90 days per authority.

Access, correction, restriction, and deletion requests

The request process is manual. A person may ask the project to assess Social Director information connected to a public Meta interaction by following the Social Director data deletion instructions. Records are located using deterministic links or platform identifiers; a display name or substring alone is not enough to authorize deletion.

For an applicable verified request not limited by a valid obligation, the workflow is designed to delete person-specific records and remove person-linked fields from a shared record. A shared record is retained only when verification shows it is no longer linkable to the person; otherwise it is deleted. The workflow checks registered database records, screenshots, reports, exports, backups, snapshots, runtime artifacts, dedicated browser profiles, request correspondence, and required provider tasks.

Completion is not recorded until the mandatory Social Director storage and provider tasks pass their verification steps. After completion, the workflow removes request selectors and the match map and retains only the limited random completion receipt described above. The project does not promise automatic, immediate, guaranteed, or complete deletion. A valid legal or Meta hold, unresolved identity or record match, provider processing, or records independently controlled by Meta may limit or delay an outcome.

Location, children, and rights

The Social Director and its service providers may process information in the United States and other locations outside a person’s country or region, where protections may differ. Privacy rights depend on location and on whether a particular law applies. Anyone may use the request process, and the project will assess it under applicable law and the limits in this notice.

The tool is not directed to children, and the project does not intentionally use it to collect information from children. A public Meta interaction may still be processed when it appears on managed content. A parent or guardian may use the same request process for a concern involving a child.