AUREUS MediaTech
AUREUS MediaTech
Start a Project

hello@aureusmediatech.com

Legal · AUREUS Social Hub

Social Hub Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains how AUREUS MediaTech handles information in AUREUS Social Hub, the internal application we use to manage our own social media accounts and those of clients who have authorised us. It covers what is collected, where it is kept, what is and is not encrypted, who it is shared with, how long it is kept and how to have it deleted.

1. Who this policy is from

AUREUS Social Hub (“the Social Hub”) is operated by AUREUS MediaTech (“AUREUS”, “we”, “us”). AUREUS decides how the Social Hub is used and is responsible for the information processed in it. For questions about this policy, contact hello@aureusmediatech.com.

This policy applies to clients and account owners who authorise AUREUS to manage their accounts, and to people whose information reaches the Social Hub through those accounts, such as people who comment on a managed post. Information sent through the AUREUS website, such as project enquiries, is covered by the website Privacy Notice.

2. How the Social Hub works

The Social Hub is an internal application operated only by AUREUS personnel. It is not offered to the public and is not installed by clients. It is used to manage AUREUS MediaTech’s own accounts and accounts of clients who have directly authorised AUREUS (see the Terms of Service).

The Social Hub runs locally on a Windows computer operated by AUREUS. It can be opened only in a browser on that computer and stores its information in a data folder on that computer. It is not a hosted online service: there is no AUREUS server or cloud database behind it. The data folder is not currently synchronised with OneDrive, Google Drive, Dropbox or any other cloud storage service. If that arrangement changes, this policy will be updated.

The Social Hub contains no advertising, analytics or tracking tools. Information does leave the computer when that is needed for an authorised action: the Social Hub communicates with the platforms that have been connected, Meta (for Facebook and Instagram), TikTok and Google (for YouTube), as described in section 7.

3. Information processed

Depending on the accounts connected and the permissions granted, the Social Hub processes:

  • Connected account identifiers. Facebook: the signed-in user’s ID and name, the names and IDs of the Pages shared with the app and the tasks the user can perform on them, and the linked Instagram professional account’s ID and username. TikTok: the account’s open ID and display name (TikTok also returns a profile picture link, which is not stored). YouTube: the channel name. For every platform, the permissions granted and the connection date.
  • Platform authorisation data. Access tokens and, where issued, refresh tokens and their expiry times (see section 4).
  • Drafts and captions. Titles, general and per-platform captions, notes and publishing options.
  • Uploaded images and videos, stored under file names generated by the Social Hub, with technical details such as file type, size, dimensions and duration, used to check platform requirements.
  • Scheduled posts and publishing history. Selected platforms, scheduled times, approval status, a history of status changes, and the post IDs, links and messages returned by each platform.
  • Analytics. Follower counts and post statistics returned by the platforms, such as views, reach, likes, comments, shares and saves where available, including the most recent results and up to 400 earlier follower-count records. TikTok statistics are not collected (see below).
  • Comments and replies. When AUREUS personnel choose to load comments for Facebook, Instagram or YouTube, the comment text, date and the commenter’s display name where the platform provides it. Comments are shown on screen and are not saved to the Social Hub’s records. Replies and moderation actions are sent to the platform.
  • Application logs recording actions and errors, used for troubleshooting, with credentials removed.
  • Backups of posts, the media list, non-secret settings and analytics records (see section 9).

TikTok. The Social Hub requests only two TikTok permissions: basic profile information (user.info.basic) and video upload to drafts (video.upload). It does not request TikTok’s permissions for usernames and profile details, follower or video statistics, video lists, direct publishing or comments, so it does not receive that information. If AUREUS adds a TikTok permission in future, this policy will be updated first.

Records of each client’s authorisation (for example, the email or WhatsApp message) are kept in the channel where they were given. They are not stored in the Social Hub.

The Social Hub never receives or stores social media passwords.

4. How platform authorisation works

Accounts are connected through the platform’s official sign-in page, where the account owner or a person they have given access approves the permissions the Social Hub requests. The platform then issues tokens that let the Social Hub act within those permissions. TikTok and YouTube sign-ins use an additional protection called PKCE. Temporary values used during sign-in are kept only in memory, can be used once and expire after 10 minutes.

Platform permissions do not replace the client’s direct authorisation to AUREUS; AUREUS uses an account only within both.

5. What is encrypted and what is not

Encrypted by the Social Hub (AES-256-GCM, with the key protected by Windows so that only the same Windows user account can unlock it):

  • platform access and refresh tokens, and the connected account names and identifiers stored with them;
  • app secrets entered in the Social Hub’s settings;
  • temporary upload links; and
  • the private key of the Social Hub’s locally generated security certificate.

Not encrypted by the Social Hub: drafts and captions, uploaded media, scheduled posts and publishing history, analytics records, logs, backups, and non-secret settings (including public application identifiers such as the Meta App ID, TikTok client key and Google client ID). These rely on the security of the computer and Windows account on which the Social Hub runs (see section 12).

Tokens, secrets and sign-in codes are removed from logs, error messages and backups.

6. Why we use information, and our lawful grounds

AUREUS uses information in the Social Hub only to:

  • connect and keep connected the accounts we are authorised to manage;
  • prepare, check, approve, schedule and publish content, and send videos to TikTok drafts;
  • confirm whether a post was published and recover safely from interruptions without posting twice;
  • show analytics and respond to comments on managed accounts where authorised;
  • keep the Social Hub secure and diagnose problems; and
  • keep backups so posts and settings can be restored.

Where Ghana’s Data Protection Act, 2012 (Act 843) applies, we rely on:

  • consent and authorisation given by the account owner when they authorise AUREUS and approve platform permissions, which can be withdrawn at any time (section 10);
  • providing the services a client has asked AUREUS to provide;
  • legitimate interests in keeping the Social Hub secure, preventing duplicate or mistaken posts, troubleshooting, and letting account owners manage comments on their own content; and
  • legal obligations where the law requires us to keep or disclose information.

AUREUS does not sell information from the Social Hub, does not use it for advertising or profiling, and does not use it to train artificial intelligence models.

AUREUS Social Hub’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. YouTube information is used only to upload videos, show channel and video statistics and manage comments for the channel AUREUS is authorised to manage, and is not transferred to anyone other than Google except as described in this policy.

7. Information shared with connected platforms

The Social Hub sends information only to the platform concerned, and only to carry out an action AUREUS takes for an authorised account:

  • Facebook and Instagram: media, captions and settings of posts being published, comment replies and moderation actions, and requests for account information, publishing status and analytics. To publish an image to Instagram, the Social Hub first uploads it to the connected Facebook Page as an unpublished (hidden) photo, because Instagram must collect images from a web address. After publishing, the Social Hub asks Facebook to delete that hidden photo; if the deletion does not succeed, the photo can remain hidden on the Page until it is removed there.
  • TikTok: the video file sent to the account’s drafts, and requests for basic account information and upload status. Captions are not sent; they are added in the TikTok app.
  • YouTube: the video, title, description, privacy setting and “not made for kids” declaration of uploads, comment replies, and requests for channel information, upload status and statistics.

Each platform handles the information it receives under its own privacy policy:

AUREUS may share with each client information about that client’s own accounts, such as publishing status and analytics. AUREUS does not otherwise share Social Hub information with anyone, except where the law requires it.

8. International data processing

The Social Hub stores its information on the computer where it runs. When an account is connected or content is published, information is sent to Meta, TikTok or Google, which may process and store it in countries outside Ghana, including the United States. Those platforms handle that information under their own privacy policies and safeguards.

9. How long information is kept

  • Tokens and account details: until the account is disconnected or reconnected (which replaces them). Platforms also make tokens expire.
  • Drafts, scheduled posts and publishing history: until the post is deleted in the Social Hub. A post cannot be deleted while it is being published. There is no automatic time limit.
  • Media files: files not attached to any post are deleted by the automatic clean-up once they are more than 24 hours old (the default setting). Files attached to a post are kept while the post exists. Media for published posts is kept with no time limit unless a retention period is set in the Social Hub’s settings; by default none is set.
  • Analytics: the most recent results and up to 400 earlier follower-count records; older records are removed automatically.
  • Logs: log files older than about 30 days are deleted automatically when the Social Hub starts.
  • Backups: an automatic backup is made when the Social Hub starts, if the previous one is more than a day old, and the 14 most recent automatic backups are kept. Backups made manually, or automatically before a restore, are kept until they are deleted. A deleted post can remain in a backup until that backup is removed. Backups do not contain media files, tokens or secrets.
  • Comments: not stored by the Social Hub.

Automatic clean-up happens only while the Social Hub is running (media every hour, logs and backups when it starts), so information can be kept longer than the periods above if the Social Hub is not started for a while.

Deleting something in the Social Hub does not delete content already published on a platform. Published content is kept by each platform under its own policies until it is deleted there.

10. Withdrawing authorisation, disconnection and revocation

Clients can withdraw their authorisation and ask AUREUS to disconnect an account at any time (see the Terms of Service). When AUREUS disconnects an account in the Social Hub, its tokens and account details are deleted from the computer straight away. Drafts, media, publishing history and analytics records are kept until they are deleted (see section 11).

Disconnecting in the Social Hub does not notify the platform or cancel the permission granted there. The account owner can withdraw the Social Hub’s access directly in the platform’s settings at any time:

Platform menu names may change over time. After access is removed, the Social Hub can no longer use the account, and scheduled posts for it can no longer be sent through the Social Hub. An upload that the platform had already received before access was removed may still be processed by the platform.

11. Data deletion instructions

How to make a request

  1. Email hello@aureusmediatech.com with the subject “Social Hub data deletion request”, or use the channel you used to authorise AUREUS. Say which platform and account the request is about (for example, the Page name, Instagram username, TikTok username or YouTube channel) and what you want deleted.
  2. We may ask you to confirm that you own the account or are entitled to act for it, so that we do not act on a false request.
  3. AUREUS will then act on the request as soon as reasonably practicable, as described below.
  4. We will reply to tell you what has been deleted, what remains and why, and, where information remains in a backup, when it is expected to be removed.

What AUREUS will do

  • Disconnecting the account and deleting tokens. AUREUS disconnects the account in the Social Hub. This deletes its sign-in tokens and stored account details from the computer at once. It does not cancel the permission on the platform itself; you can do that in the platform’s settings (section 10).
  • Drafts, scheduled posts, media and publishing records. AUREUS deletes the account’s posts in the Social Hub, which removes their drafts, schedules and publishing history. A post that is being published at that moment can be deleted only once publishing has finished. Media files that are no longer used by any post are then removed by the Social Hub’s automatic clean-up, normally within a day while the Social Hub is running.
  • Analytics records. The Social Hub has no feature for deleting one account’s analytics. Analytics results and follower-count history are stored by platform, alongside other records. AUREUS removes the records relating to your account by careful manual handling where this can be done without damaging other information, and otherwise tells you what could not be removed and why.
  • Backups. Deleted information can remain in backups made before the deletion. Automatic backups are replaced over time as new ones are made (the 14 most recent are kept). Backups made manually or before a restore are kept until they are deleted; AUREUS reviews them and deletes or edits those containing your information where practicable, taking care not to lose other clients’ information. If a backup containing your information is ever restored, AUREUS will delete that information again.
  • Content published on platforms. This process does not delete content already published on Facebook, Instagram, TikTok or YouTube. You can delete it on the platform, or ask us to delete it for you while we still have access to the account and your authorisation to do so. Each platform keeps or deletes content under its own policies.

These practical limits do not remove any right you have under applicable law. Where the law requires information to be deleted, AUREUS will take the steps needed to do so, including manual steps.

If you commented on an account AUREUS manages, the Social Hub does not store your comment. To have a comment removed, delete it on the platform, contact the account owner, or contact us and we will pass your request to the account owner.

12. Security measures and their limits

The Social Hub’s security measures include:

  • accepting connections only from the same computer, over HTTPS with a security certificate generated on that computer;
  • encrypting tokens and secrets as described in section 5;
  • protecting sessions and actions against cross-site requests, and applying a strict content security policy;
  • using single-use, time-limited sign-in requests, with PKCE for TikTok and YouTube;
  • removing credentials from logs, error messages and backups; and
  • checking uploaded files by their content, not only their name.

No system is completely secure. The Social Hub has no separate login of its own: access depends on access to the Windows account on which it runs. Anyone who can use that Windows account, or malicious software on that computer, could access the Social Hub and its data, and the information listed as not encrypted in section 5 is protected only by the computer’s own security.

13. Your privacy rights and requests

Depending on how the law applies to your information, you may be able to ask AUREUS:

  • whether we hold personal information about you in the Social Hub, and for a copy of it;
  • to correct inaccurate information;
  • to delete information or stop using it (see section 11); and
  • to stop processing based on our legitimate interests.

You can withdraw consent or authorisation at any time; this does not affect anything done before the withdrawal. Send requests to hello@aureusmediatech.com. We may need to confirm your identity before acting on a request. We will respond as soon as reasonably practicable and in line with applicable law. For information held by a platform, contact that platform directly.

If you are not satisfied with our response, you may contact the Data Protection Commission of Ghana.

14. Children

The Social Hub is used to manage business and professional accounts and is not directed at children. Clients, and people who authorise AUREUS to manage an account, must be at least 18 (see the Terms of Service), and AUREUS does not knowingly manage accounts that belong to children.

Information about people under 18 may still reach the Social Hub incidentally, for example in a comment loaded from a platform or in a photo or video a client supplies. Comments are not stored by the Social Hub. Content showing other people, including children, is published only where the client has confirmed the permissions needed (Terms, section 5). If you believe the Social Hub holds information about a child that should be removed, contact us using the details in section 16.

15. Changes to this policy

We will update this policy when the Social Hub, the way it is used, the platforms it connects to or our practices change. The current version will always be published on this page with its “Last updated” date. Where a change significantly affects clients whose accounts we manage, we will take reasonable steps to tell them.

16. Contact

AUREUS MediaTech
Email: hello@aureusmediatech.com
Website: aureusmediatech.com

See also the Social Hub Terms of Service.