1. Operator and scope
KELBRIO TRADE LTD., Bulgaria, European Union, operates Creator, also referred to as Creator Operations and previously Creator Operations Hub. This policy covers the application’s handling of personal information and Meta Platform Data, as well as contact requests and this public informational website.
KELBRIO is the controller for the processing purposes it determines, including administration of its authorized accounts, application setup, security and request handling. If an account is managed on another organization’s instructions, the relevant roles and any required processing agreement must be established before that workflow begins.
Contact: stoyankopanov@gmail.com. Application reference: Meta App ID 1470705144958316.
2. What is currently processed
The present integration is limited to human-supervised setup, authorization checks and basic verification of accounts the operator is permitted to manage. Depending on the permissions granted and the response returned by Meta, the following information is handled:
| Information | Purpose |
|---|---|
| Account and business identifiers | Identify the authorized Facebook user, business portfolio, Pages and linked Instagram Professional accounts. |
| Basic account metadata | Verify account names, usernames, links between Pages and Instagram accounts, and basic publication counts where returned. |
| Permissions and account tasks | Check which account actions Meta has authorized and which accounts are available to the operator. |
| Authentication credentials | Authenticate permitted API requests. This includes access tokens and, where applicable, application credentials. |
| Technical diagnostics | Investigate API responses, access failures and configuration issues. Diagnostics may include account identifiers and operational metadata. |
| Contact correspondence | Respond to application enquiries and requests about personal information. |
Basic account metadata is obtained from Meta through its APIs or supplied by the authorized operator. Contact information is supplied by the person contacting us. The integration does not gain general access to a person’s Facebook or Instagram account merely because this website is visited.
Reading these legal pages requires no Meta login or credentials. Authorization and the relevant account identifiers are necessary to perform requested account-access checks; without them we cannot complete those checks. Information supplied in an enquiry or privacy request helps us locate the relevant records and respond.
3. Features under development
Some intended Creator Operations features are not part of the current active integration. The following areas require separate implementation, authorization and activation:
- Public creator research: public profile information, public media metadata and relevant research records used to assess creator content and business opportunities.
- Own-account content and analytics: draft and published content, publication identifiers, performance metrics and account insights for authorized accounts.
- Comments and messages: comment or message content, participant identifiers and interaction metadata, only if the relevant workflow is activated and access is authorized.
- AI-assisted production: original creator assets, prompts, generated drafts and production records, with appropriate rights and provider arrangements.
Current scope
No publishing, automated inbox handling, comment-response service, recurring analytics collection or AI production service is activated by this website. Granted platform permissions do not mean every possible capability is in use.
If new features change the information we handle or how it is used, we will explain those changes before the new processing begins where required. Authorization to manage an account is not a general permission to use its information for unrelated purposes.
4. Purposes and legal bases
The current purposes are administering legitimately managed business accounts, checking authorized access, maintaining integration security, and responding to enquiries and privacy requests.
Where the GDPR applies, the relevant bases are:
- Legitimate interests — Article 6(1)(f): necessary and proportionate administration of authorized business accounts, application security and business enquiries, subject to the rights and interests of affected individuals.
- Legal obligations — Article 6(1)(c): responding to applicable data-protection obligations and retaining information when a specific legal obligation requires it.
- Contract — Article 6(1)(b): only where processing is objectively necessary for a contract with the person concerned or requested pre-contractual steps.
- Consent — Article 6(1)(a): where a separately activated optional activity requires and relies on valid consent. Consent can be withdrawn for future processing.
A Facebook or Instagram permission authorizes platform access; it does not by itself establish the GDPR legal basis for every subsequent use. New uses require their own assessment. The current integration does not make decisions producing legal or similarly significant effects about individuals solely by automated means.
5. Authorized accounts and platform access
Creator is intended for accounts KELBRIO owns or is authorized to manage. Operators must have the necessary account role and grant the permissions required for the relevant task. We use the resulting access to identify and verify the authorized accounts within the application’s actual processing scope.
Authorization may be revoked through the relevant Meta account settings. Revocation limits future platform access but does not automatically erase information already held by KELBRIO. See Data deletion instructions for a separate deletion request.
Meta operates Facebook and Instagram under its own policies and may independently process information about account use, permissions and API activity. See the Meta Privacy Policy.
6. Storage, recipients and service providers
Current application setup and account verification are handled on an operator-controlled workstation. Credentials are maintained separately from the public website’s files. This website does not provide a public account database or an account sign-in service.
Information is handled by authorized operators and the providers relevant to the specific activity:
- Meta: provides the authorized Facebook and Instagram APIs and processes platform activity under its own terms and privacy information.
- Cloudflare: delivers this public static website and may process connection, request and security data needed to provide and protect it. See Cloudflare’s privacy notice.
- Google/Gmail: receives and stores correspondence sent to our published contact address so we can review requests and reply. See Google’s privacy policy.
- Development and support tools: human-supervised development and troubleshooting use tools including OpenAI’s Codex. Relevant non-secret account identifiers, profile metadata and technical diagnostics can be handled by those tools. See OpenAI’s privacy policy.
The information handled by each provider depends on the task and the service used. You can contact us to ask which recipients are involved in processing your information and to request further details relevant to your account or enquiry.
7. Retention and deletion criteria
Retention depends on the purpose and the category of information. We do not apply a single fixed retention period to all application data.
- Authentication credentials: retained while needed for an authorized integration, and reviewed when access is revoked, replaced or no longer required.
- Account setup and verification records: retained while needed to administer the authorized accounts, troubleshoot the integration or establish what access was checked.
- Enquiries and privacy requests: retained while handling the request and, where necessary, to document its resolution or satisfy an applicable legal obligation.
- Security and audit information: retained only while relevant to a specific security, accountability or legal purpose.
Information that is no longer needed for its purpose should be deleted or reduced to what remains necessary. A lawful retention obligation or the establishment, exercise or defence of legal claims may require limited information to be kept. Where this affects a deletion request, we will explain the basis and scope of the retention.
Email submission does not itself trigger automatic erasure. Deletion requests are assessed and handled by an authorized operator, including information held with a relevant provider where applicable.
8. Security measures
Current safeguards include restricted local access to credential files, exclusion of credentials from the public website and project version control, and HTTPS for API communication. Authorized operators supervise integration work and review access before account actions are activated.
Access tokens, passwords and application secrets must not be included in public pages or privacy-request emails. We may use non-secret account identifiers and technical response information to diagnose an access problem. We review access and security measures as the application develops and as the scope of processing changes.
9. International processing
KELBRIO is based in Bulgaria. Meta, Cloudflare, Google and OpenAI operate internationally, and information handled through their services may be processed outside Bulgaria or the European Economic Area, depending on the service and its arrangements.
Data-protection requirements continue to apply when information is handled outside the EEA. Where GDPR Chapter V applies, a transfer requires a valid mechanism, such as an applicable adequacy decision or appropriate safeguards. Contact us for information about the destinations and safeguards relevant to your information and how to obtain further details.
10. Your rights
Depending on the circumstances and applicable law, you may request access to your personal information, correction, erasure, restriction of processing, or a portable copy of eligible information. You may object to processing based on legitimate interests and withdraw consent where consent is the basis. These rights are subject to their legal conditions and exceptions.
Send requests to stoyankopanov@gmail.com, identifying the relevant account or interaction and the right you wish to exercise. We may ask for proportionate information to verify identity or authority. Do not send passwords, access tokens, application secrets or identity documents unless a separate, necessary verification method has been arranged.
Where the GDPR applies, we respond without undue delay and normally within one month of receiving a request. If the complexity or number of requests requires an extension, we may take up to two additional months and will explain the reasons within the first month. We will explain any lawful refusal or retention and the available complaint options. See Data deletion instructions for the deletion process.
You may complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority, including where you live, work or believe a data-protection infringement occurred.
11. This website and cookies
The public legal pages can be read without login or JavaScript. Our website code does not set cookies, include analytics scripts or embed third-party advertising trackers. Visiting the site does not connect a Facebook or Instagram account.
Cloudflare may process ordinary technical request and security information to deliver and protect the site. Following an external link or sending email engages the relevant third-party service under its own terms and privacy information.
12. Changes and contact
We may update this policy when the application, providers or processing practices change. The date at the top identifies the current published version. Material changes affecting data use will be communicated through appropriate means before new processing is introduced where required.
Questions about the application’s use of personal information can be sent to stoyankopanov@gmail.com. Please identify Creator Operations in the subject line.