1. Data controller
The MSP service is published by Whynote Consulting, a company established in Vélizy-Villacoublay, France, represented by its legal representative.
For any question regarding your personal data, contact us at [email protected].
Full legal details (legal form, SIREN number, postal address) are available on request.
2. Scope
This policy applies to the MSP application, an operational steering tool for company directors, and in particular to its social publishing module, which connects to Facebook through the Meta API.
It describes the data we process when you use the service and when you connect your professional Facebook Pages to MSP.
3. Data collected
We limit collection to what the service strictly requires.
| Category | Data | Source |
|---|---|---|
| Account | Name, work email, organisation | You / Google sign-in |
| Social publishing | Content (text, images) you create and approve | You |
| Meta connection | Public profile name and picture, list of your Facebook Pages, access tokens | Facebook Login (with your consent) |
| Technical | Activity logs, action timestamps (audit trail) | Automatic |
We do not collect your private messages, your friends list, or any sensitive data. No advertising profiling, no resale of data.
4. Facebook integration
When you connect your account through Facebook Login, MSP requests only the permissions required to publish content you have approved:
- pages_show_list — display the list of your Pages so you can choose which one to manage;
- pages_manage_posts — publish to the Facebook Page you selected.
No post is ever published without your explicit approval. MSP generates proposals; you decide whether to publish. Meta access tokens are stored encrypted and are used solely to carry out the posts you approve.
Your use of Meta platforms remains subject to Meta’s privacy policy.
5. Purposes
Your data is processed in order to:
- provide and secure access to your MSP workspace;
- publish content to your Facebook Pages, at your request and after your approval;
- maintain traceability of actions (audit log) and provide support;
- meet our legal obligations.
6. Legal basis
In accordance with the GDPR, our processing rests on:
- performance of the contract for the provision of the service;
- your consent, in particular when connecting your Facebook Pages, which you may withdraw at any time;
- our legitimate interest in securing the service and keeping it running correctly.
7. Data sharing
We neither sell nor rent your data. It may be processed by a small number of technical sub-processors, solely to operate the service:
| Recipient | Role |
|---|---|
| Meta Platforms | Publishing to Facebook / Instagram through its API |
| Infrastructure host | Running the service and storing its data |
| Google Workspace | Authentication and email delivery |
| Anthropic | Text generation by artificial intelligence |
Each sub-processor accesses only the data strictly necessary for its service, under confidentiality commitments.
8. Retention period
We retain your data for as long as you use the service. Meta access tokens are kept while the connection is active and deleted as soon as you disconnect your accounts or revoke access. Account data is deleted within a reasonable period after your account is closed, unless a legal retention obligation applies.
9. Security
We implement appropriate technical and organisational measures: encryption of credentials and tokens at rest, data partitioning by organisation, access control, and logging of sensitive actions. Hosting details — provider and data location — are available on request.
10. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time.
To exercise these rights, write to [email protected]. You may also lodge a complaint with the French data protection authority, the CNIL.
11. Deleting your data
You may at any time request deletion of the data associated with your use of MSP, including data originating from Facebook:
- From Facebook: Settings & privacy → Settings → Apps and websites → select MSP → Remove. This immediately revokes our permissions.
- By email: send a request to [email protected] with the subject “Delete my data”. We delete the data concerned and confirm within 30 days.
This section serves as the data deletion instructions required by Meta for Facebook applications.
12. Changes & contact
We may update this policy to reflect legal or technical changes. The date of the last update appears at the top of this page; in the event of a significant change, we will inform you.
For any question: [email protected].