Social Pulse Privacy Notice

1. Who is responsible for your information?

Social Pulse is operated by Next Level Entertainment Ltd, Ireland, through its Next Level AI service. Next Level Entertainment Ltd is the data controller for the processing described in this internal pilot.

For privacy questions or requests, email info@nextlevelai.ie.

This notice covers Social Pulse. It does not replace the customer privacy notices for Pink Ladies Glam Van, our other business services, or the Next Level AI website.

2. Who uses Social Pulse?

The current pilot is restricted to authorised business users. It is not a public customer-registration service.

This notice does not claim that external client businesses are already using the service. Before expanding the service, we will update the relevant notices and put appropriate data-processing arrangements in place.

3. Information we process

• Workspace account information: email address, account identifier, access permissions and authentication-session information.
• Facebook connection information: Facebook account identifiers, granted permissions and information needed to verify an authorised connection.
• Page-selection information: names and identifiers of Pages returned during connection, allowing the owner to select and explicitly confirm the correct Page.
• Connection credentials: access credentials needed to establish and maintain an approved Page connection.
• Page information: Page profile details, Page-published content and available performance measurements when the relevant reading functionality is used. Content may include personal information such as names, photographs or videos.
• Workspace content: media, draft content, review decisions and associated records supplied or created by authorised users.
• Technical information: security and operational records associated with authentication, access and service operation. Hosting providers may also process connection and device information when delivering the service.

Information comes from authorised workspace users, Meta through an approved connection, and operation of the workspace and its infrastructure.

4. How and why we use information

We use information to:

• Authenticate authorised users and protect the workspace.
• Identify and confirm the correct business Facebook Page.
• Establish and maintain an approved Page connection.
• Support review of existing content and business media.
• Understand available Page performance information.
• Investigate faults and respond to privacy or security requests.

For account administration, security and business Page analysis, we rely on our legitimate interests in securely operating our business workspace and understanding our social media performance. We consider the rights and interests of affected individuals when carrying out these activities.

Where processing is necessary to meet a legal obligation, we rely on that obligation. The basis for collecting and using customer photographs or other source material must also be established through the relevant business's customer-facing practices and privacy information. Uploading material to Social Pulse does not itself establish permission to use it.

Approving Facebook permissions authorises API access. It does not replace our responsibilities under data-protection law. Connecting Facebook is optional; declining the connection makes the associated features unavailable.

5. Facebook permissions and connection controls

The current connection requests permission to list managed Pages, read Page-published content and Page information, and retrieve available insights. Facebook's default public-profile permission may also apply.

A Page is not permanently bound to the workspace until the authorised owner explicitly confirms its returned name and identifier.

The current connection does not request publishing, messaging, comment-management or Facebook-content deletion permissions. It does not connect Instagram.

The current Facebook integration does not send Page information to an AI generation service or make automated decisions producing legal or similarly significant effects on individuals.

6. Children and photographs

Social Pulse is intended for authorised adult business users. Business media may nevertheless contain images of children.

The responsible business must have an appropriate basis for using that material and respect applicable parental or guardian choices. Inclusion in the workspace is not permission to publish a photograph.

If you are concerned about an image of yourself or a child for whom you are responsible, contact info@nextlevelai.ie. Please describe the relevant image or event without sending unnecessary identity documents.

7. Who can access information?

Access is restricted to authorised personnel and service providers supporting the workspace, according to their role.

• Supabase: database, authentication, media storage and server functions.
• OpenAI Sites: hosting and delivery of the owner workspace.
• Meta: Facebook authentication, permission handling and Page API services. Meta also processes information under its own applicable terms and privacy notices.

Information may also be disclosed where required by law or where necessary to establish, exercise or defend legal claims.

8. Hosting and international transfers

Our Social Pulse database is hosted through Supabase in its EU West (Ireland) region. This database location does not mean that all service operations take place exclusively in Ireland. Hosting, support and other provider operations may involve processing outside the European Economic Area.

Our providers' data-processing terms describe the applicable international-transfer safeguards, including European Commission adequacy decisions or Standard Contractual Clauses, where applicable. Contact us for information about safeguards relevant to your data.

Further information is available in Supabase's Data Processing Addendum and the OpenAI Sites Data Processing Addendum .

9. Security and session storage

The workspace uses authentication, access restrictions and server-side connection controls. Stored Page credentials are encrypted and are not displayed in the workspace.

Authentication uses necessary browser storage and session mechanisms. The Facebook connection also uses a temporary security cookie to associate the login response with the browser that started it and help prevent unauthorised connection attempts.

Please never send passwords, App Secrets, access tokens or authorisation codes to our contact email.

10. How long we retain information

Account and connection records are retained while necessary to provide authorised access, administer the connection and meet relevant security or legal needs. Credential expiry is not the same as deletion of a stored record.

Temporary Page-selection sessions expire after ten minutes. Expired temporary candidate credentials are removed by subsequent cleanup operations; session expiry does not promise immediate physical deletion at the ten-minute mark.

Retention of workspace media, drafts and review records depends on their continuing business purpose, applicable image-use permissions, deletion requests and any necessary legal retention. Information should not be retained solely because storage is available.

Backups and separate media recovery copies may contain information removed from the active workspace. A deletion request must therefore account for relevant recovery copies as well as live records. We will explain applicable retention limitations when responding to a request.

11. Your data-protection rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal information. You may also object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent.

Contact info@nextlevelai.ie to make a request. We may ask for proportionate information to verify your identity and locate the relevant records.

We normally respond within one month. Where a lawful extension is necessary, we will explain the extension and its reason within that first month.

You may complain to Ireland's Data Protection Commission or another competent supervisory authority.

12. Requesting deletion

Our Social Pulse data-deletion instructions explain how to request deletion of information held in the workspace.

Deleting Social Pulse information does not delete your Facebook account, Facebook Page or original Facebook posts.

13. Changes to this notice

We will update this notice when the service or its data handling changes, including before introducing materially different integrations or external client arrangements. The date above identifies the latest revision.