Privacy Policy

This Privacy Policy explains how Qantara ("we," "us," or "our"), operated by Focal Point ("Focal Point"), collects, uses, stores, and protects your information when you use our social media management platform at qantara.app (the "Service"). This policy also describes your rights regarding your personal data and how to exercise them.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you register for Qantara, we collect:

• Full name and email address
• Organization/business name
• Authentication credentials (managed via our identity provider, Focal ID)
• Billing and subscription information

1.2 Social Media Platform Data

When you connect your social media accounts (including Instagram, Facebook, and other supported platforms), we collect and process the following data through authorized platform APIs:

• Profile Information: Username, display name, profile picture URL, account type, and account ID
• Media & Content: Posts, images, videos, captions, and other content you create or manage through the Service
• Insights & Analytics: Post performance metrics, audience demographics, reach, impressions, and engagement data
• Access Tokens: OAuth access tokens and refresh tokens required to interact with platforms on your behalf
• Page & Account Data: Connected Facebook Pages, Instagram Business/Creator accounts, and associated permissions

1.3 Usage Data

We automatically collect:

• Log data (IP address, browser type, pages visited, timestamps)
• Feature usage patterns within the Service
• Error and performance data

2. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Publish, schedule, and manage social media content on your behalf
• Display analytics and performance insights for your connected accounts
• Authenticate your identity and manage account access
• Process transactions and send billing-related communications
• Send service-related notices and updates
• Monitor and improve the Service's performance and security
• Comply with legal obligations

We do not sell, rent, or share your personal data or social media data with third parties for advertising purposes.

3. Data Storage & Security

3.1 Encryption

All sensitive data, including social media access tokens and refresh tokens, is encrypted at rest using AES-256-GCM encryption before being stored in our database. Encryption keys are managed securely and separately from the encrypted data.

3.2 Infrastructure

• Data is stored in secure, managed PostgreSQL databases
• All data transmission uses TLS/HTTPS encryption in transit
• Access to production systems is restricted and logged
• Regular security reviews and updates are performed

3.3 Tenant Isolation

Qantara is a multi-tenant platform. Each organization's data is logically isolated using tenant-scoped access controls, ensuring that your data is never accessible to other organizations.

4. Data Sharing & Third Parties

We share data only in the following circumstances:

• Meta / Instagram API: We transmit content and API requests to Meta platforms (Instagram, Facebook) as necessary to publish content, retrieve analytics, and manage your connected accounts. This is governed by Meta's Platform Terms and policies.
• Amazon Web Services (AWS S3): Media files (images, videos) uploaded for social media publishing are stored in AWS S3 buckets. Data is encrypted in transit and at rest.
• Infrastructure Providers: We use managed hosting and database services that process data on our behalf under strict data processing agreements.
• Legal Requirements: We may disclose data if required by law, regulation, or legal process.

5. Meta Platform Data

In compliance with the Meta Platform Terms and Meta Developer Policies, we adhere to the following:

• We only request permissions (scopes) that are necessary for the features you use
• Data obtained from Meta APIs is used solely to provide the Service to you
• We do not transfer Meta platform data to third parties except as necessary to provide the Service
• We do not use Meta platform data for independent advertising or monetization
• We delete Meta platform data when you disconnect your account or upon your request
• We maintain appropriate technical and organizational security measures as required by Meta

6. Data Retention

• Account Data: Retained for as long as your account is active. Upon account deletion, personal data is removed within 30 days.
• Social Media Tokens: Access tokens and refresh tokens are deleted immediately when you disconnect a social media account.
• Post & Content Data: Retained for as long as your account is active. Historical post data may be retained for analytics purposes but is deleted within 30 days of account closure.
• Audit Logs: Retained for up to 12 months for security and compliance purposes.
• Backup Data: May persist in encrypted backups for up to 90 days after deletion from primary systems.

7. Your Rights & Choices

7.1 Disconnect Social Accounts

You can disconnect any social media account at any time from your Qantara dashboard. When you disconnect an account, we immediately delete the associated access tokens and stop accessing data from that platform on your behalf.

7.3 Data Export

You may request a copy of your data in a machine-readable format by contacting us at app@focalpoint.sa.

7.4 Access & Correction

You can access and update your account information at any time through the Service. For other data correction requests, please contact us.

8. Cookies & Tracking

We use essential cookies required for authentication and session management. We do not use third-party advertising cookies or trackers.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, please contact us immediately.

10. International Data Transfers

Your data may be processed on servers located outside of Saudi Arabia. We ensure that appropriate safeguards are in place in compliance with applicable data protection laws, including the Saudi Personal Data Protection Law (PDPL).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us: