User data deletion

1. Who this page is for

SocialFlow is an internal tool used by the Graphik Impact agency under the social media Co-Management contracts signed with its client brands. This page describes how any individual whose data has been processed by SocialFlow can request its deletion.

This concerns:

• Graphik Impact's client brands who have connected their Facebook, Instagram, LinkedIn, TikTok, YouTube, Pinterest or X account to SocialFlow;
• client-side validator users who take part in the publication validation workflow;
• end users who interacted with a publication or a Lead Ad form of a client brand, and whose record is kept in SocialFlow (moderated comment, lead received via Lead Ads, etc.).

2. Data concerned

Depending on the role:

Role	Data retained in SocialFlow
Brand owner	name, email, role, connected Page/Account identifiers, encrypted OAuth tokens
Client-side validator	name, email, validation/refusal history, reply templates
Facebook/Instagram end user	public name, moderated comment content, detected sentiment and intent
Lead received via Lead Ads	data entered in the form (name, email, phone, custom fields), leadgen_id, timestamp

3. Deletion procedure

3.1 Deletion initiated by the brand (self-service)

The owner or administrator of the brand workspace can, at any time:

1. Open the "Settings" tab of their brand in SocialFlow.
2. "Network connections" section: click "Remove" on the Facebook connection (or any other network). This revokes the tokens, removes the leadgen subscription and immediately disables collection.
3. "Meta integrations" section: click "Disable lead reception" to stop only the Lead Ads flow without disconnecting the rest.
4. To entirely delete the workspace and all its data: contact contact@graphik-impact.com stating "Delete workspace + brand name".

3.2 Individual request (GDPR — right to erasure)

Any individual whose data appears in SocialFlow (validator, end user, received lead, etc.) can request the erasure of their data by writing to contact@graphik-impact.com, specifying:

• their name and email;
• the brand concerned (or "all");
• the type of data to delete.

Response time: 30 days maximum, in accordance with the GDPR (art. 17). Confirmation by email once the deletion is complete.

3.3 Automatic deletion

• Moderated comments are anonymized after 12 months.
• Leads received via Lead Ads are kept for a maximum of 24 months, after which the form content (field_data) is anonymized.
• OAuth tokens are automatically revoked when a network connection is disconnected.

4. Data controller

• Controller: Graphik Impact (SARL, RCS Sedan)
• DPO: Kevin Boisard
• Contact: contact@graphik-impact.com
• Address: 96 avenue Charles de Gaulle, 08000 Charleville-Mézières, France

5. Recourse

You may at any time lodge a complaint with the CNIL (French Data Protection Authority): https://www.cnil.fr/en/plaintes.