Privacy Policy

Marketing Machine is a campaign planning, content generation, approval, scheduling, and social publishing service operated by Full Blown Studio (“Full Blown Studio,” “we,” “us,” or “our”). This policy explains how we handle information when agencies, their personnel, and their clients use the service.

1. Information we collect

Account and security information

We collect account names, email addresses, password hashes, roles, client access assignments, session information, browser user-agent information, and hashed IP addresses. We do not store account passwords in readable form.

Business and campaign information

Users may provide client names, websites, business descriptions, brand guidelines, approved facts, audiences, campaign strategies, offers, calls to action, source materials, uploaded media, content drafts, approvals, comments, schedules, and related operational records.

Facebook and Instagram information

If a user connects Meta services, we receive information authorized by that user, which may include an app-scoped Meta user identifier, Facebook Page identifiers and names, Page access tasks, linked Instagram professional-account identifiers and names, granted permissions, token expiration and connection-health information, publishing results, and access tokens. Access tokens are encrypted at rest and are never intentionally displayed in the browser or written to application logs.

Usage and audit information

We record important application actions, job status, publishing attempts, errors, timestamps, and security events to operate the service, enforce approvals, troubleshoot failures, and maintain an accountability history.

2. How we use information

We use information to:

• authenticate users and enforce tenant, client, and role-based access;
• create, edit, review, approve, schedule, and publish marketing content;
• connect authorized Facebook Pages and Instagram professional accounts;
• perform permission, token-health, media, and publishing checks;
• generate requested campaign text and images using artificial-intelligence services;
• provide support, maintain security, prevent abuse, and improve reliability; and
• comply with legal obligations and enforce our agreements.

We do not sell personal information or Meta Platform data. We do not use connected Meta access tokens to advertise to users or publish content that has not passed the application’s approval controls.

3. Artificial-intelligence processing

When a user requests an AI feature, the campaign instructions, selected business facts, brand guidance, and other context needed for that request may be transmitted to OpenAI to generate the requested text or image. We do not intentionally send Meta access tokens, application secrets, or user passwords to AI providers. Users should not enter sensitive personal information that is unnecessary for a campaign.

4. How we disclose information

We may disclose information to service providers that help us host, secure, maintain, and operate Marketing Machine; to OpenAI when a user invokes an AI generation feature; and to Meta when a user connects or publishes to Facebook or Instagram. We may also disclose information when required by law, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards. Service providers are permitted to process information only for the services they provide to us.

5. Meta Platform data

Marketing Machine requests only the Meta permissions needed for connected-account discovery and approved content publishing. These may include pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, and instagram_content_publish. We use this information to show eligible business assets, verify connection health, and publish content selected and approved by an authorized user.

Users can revoke access through Marketing Machine, through Facebook or Instagram settings, or by submitting a deletion request. Revocation may prevent scheduled content from publishing.

6. Data retention and deletion

We retain account and business records while an account is active and as reasonably necessary to provide the service, resolve disputes, maintain security and audit records, and meet legal obligations. One-time Meta authorization codes are short-lived and cleared after exchange or expiration. Connected-account credentials are retained only while needed for the authorized connection and are deleted when the connection is removed or a valid Meta deletion request is processed.

Some limited records may be retained where required for security, fraud prevention, legal compliance, or documented business transactions. Where deletion is not appropriate, we may restrict or de-identify the information. See our Data Deletion Instructions.

7. Security

We use administrative, technical, and organizational safeguards appropriate to the information we process. These include tenant-aware access controls, password hashing, encrypted social credentials, approval gates, audit logging, restricted server configuration, and HTTPS transport. No system can guarantee absolute security.

8. Browser storage

Marketing Machine may use browser session storage or local storage to maintain an authenticated application session and remember workspace preferences such as the selected client. The current application does not rely on third-party advertising cookies.

9. Your choices and rights

Depending on your location, you may have rights to request access, correction, deletion, restriction, or a copy of personal information. Authorized users may update many business records within the service and may disconnect social accounts at any time. To make a privacy request, contact us using the details below. We may need to verify the request and your authority over the relevant account.

10. Children

Marketing Machine is a business service and is not directed to children under 13. We do not knowingly collect personal information from children through the service.

11. Changes to this policy

We may update this policy when the service, our practices, or applicable requirements change. We will post the updated policy at this URL and revise the effective date above.