Privacy Policy

Overview & Scope

This Privacy Policy applies to NeoChronics ("NeoChronics", "we", "us", or "our"), our website (https://neochronics.com), and all software applications, automated tools, AI agent systems, and third-party platform integrations built or operated by NeoChronics.

By accessing our website, using our services, or authorizing any of our applications (including applications connecting via Meta or Instagram APIs), you acknowledge that you have read, understood, and agree to the data collection and handling practices described herein.

This policy is formulated in accordance with global privacy principles, including the General Data Protection Regulation (GDPR), California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the Information Technology Act (India), and the Meta Platform Terms and Developer Policies.

Information We Collect

We collect only the minimum amount of information necessary to deliver our engineering services, software applications, and customer support. The categories of information we may collect include:

A. Information You Provide Directly

• Contact Details: Your name, email address, company name, phone number, and physical location when you submit an inquiry via our contact forms or email us at contact@neochronics.com.
• Project Specifications: Technical requirements, project briefs, architecture notes, and business logic shared during consultations or project engagements.
• Authentication Credentials: When you connect accounts or use authorized portals, we may process account usernames and authentication tokens. We do not store plaintext passwords.

B. Automated Technical & Device Information

• Device & Connection Data: IP address, browser type and version, operating system, device identifiers, and language preferences.
• Usage Logs: Access timestamps, pages viewed, referring URLs, request headers, error logs, and session diagnostic data collected to protect our infrastructure against DDoS attacks and maintain system stability.

C. Third-Party Platform Data

When you explicitly connect a third-party platform (such as Meta, Instagram, GitHub, or cloud providers) to one of our tools, we receive information strictly within the boundaries of the OAuth permissions you have approved.

Meta & Instagram Platform Data & API Usage

A. Scope of Instagram & Meta Data Accessed

Our applications only request and access the specific permissions granted by the user via Meta's official OAuth consent dialog. Depending on the specific application functionality, this may include:

• Basic Account Information: Instagram User ID, username, account type (business, creator, or personal), and profile picture URL.
• Media & Publishing Data: Media metadata (captions, media type, timestamps, permalinks) strictly when necessary for automated publishing, previewing, or content analysis tools.
• Messaging & Interaction Data: Message content and sender IDs exclusively for automated customer support chatbots or agent workflows configured directly by the account owner.
• Insights & Analytics: Aggregated reach, impressions, and engagement metrics when authorized for performance reporting dashboards.

B. Strict Functional Purpose Limitation

All Instagram and Meta platform data is accessed and processed solely to operate the specific functionality of the application authorized by you (for example: generating performance reports, automating authorized responses, or managing business workflows).

C. Absolute Prohibition on Selling Meta Data

NeoChronics does not sell, license, transfer, or rent Instagram or Meta user data to any third parties.

• We do not share Meta user data with data brokers, ad networks, or third-party analytical vendors.
• We do not use Meta user data to construct user profiles for behavioral advertising or surveillance.
• We do not use private Instagram direct messages or user media to train general foundation models or disclose them to unauthorized parties.

D. Token Storage & Lifecycle Management

Access tokens issued by Meta are encrypted using industry-standard AES-256 encryption at rest and transmitted exclusively over TLS 1.3. When an access token expires, is revoked by the user, or when the user disconnects their account, all cached session tokens are permanently purged.

How We Use Information

We process collected data exclusively for legitimate operational and business purposes:

• Service Delivery: Designing, engineering, deploying, and maintaining custom software platforms, cloud infrastructure, AI agents, and integrations.
• Customer Support & Communication: Answering technical inquiries, providing architectural consultations, preparing proposals, and sending transactional updates.
• Application Functionality: Executing authorized API calls, synchronizing configured data streams, and running automated workflows as directed by the user.
• Security & Abuse Prevention: Monitoring system health, detecting unauthorized access, preventing malicious activity, and enforcing our terms of service.
• Legal & Regulatory Compliance: Fulfilling statutory requirements, accounting obligations, and responding to lawful requests from regulatory authorities.

Data Sharing & Third-Party Disclosures

We treat your data with the highest level of confidentiality. We do not sell your personal data. Disclosures are strictly limited to the following circumstances:

• Essential Infrastructure Providers: We engage reputable cloud hosting and database sub-processors (e.g., Vercel, AWS, Cloudflare) that maintain strict SOC 2, ISO 27001, and GDPR compliance to securely host our servers and databases. These providers process data solely on our behalf under binding confidentiality agreements.
• Legal Requirements: We may disclose information if required to do so by applicable law, subpoena, court order, or governmental regulation, provided that we give you prompt notice where legally permissible.
• Protection of Rights: In circumstances where disclosure is necessary to investigate potential violations of our terms, prevent fraud, or protect the safety and property of NeoChronics, our clients, or the public.
• Business Transfers: In the event of a merger, acquisition, or reorganization, user records may be transferred to the successor entity subject to the same privacy safeguards outlined in this policy.

Data Retention & Security Standards

A. Data Retention Schedules

We retain personal data and API data only for as long as necessary to fulfill the purposes for which it was gathered, or as required by applicable tax, commercial, or corporate laws:

• General Inquiries: Contact form submissions and consultation requests are retained for up to 24 months, after which they are archived or securely deleted.
• Active Client Records: Stored for the duration of the active contractual relationship plus statutory limitation periods (typically 5 to 7 years).
• API Access Tokens & Cached Meta Data: Stored only during active user authorization. Upon account disconnection or explicit deletion request, tokens and cached API data are permanently erased within 30 days.

B. Security Measures

We implement comprehensive technical, organizational, and physical safeguards designed to prevent accidental loss, unauthorized access, alteration, or disclosure:

• End-to-End Encryption: All HTTP traffic is enforced over HTTPS with TLS 1.3 and HSTS (Strict-Transport-Security: max-age=63072000; includeSubDomains; preload).
• Robust Headers: Deployment of strict Content Security Policies, X-Content-Type-Options: nosniff, and frame-ancestors 'none' to eliminate clickjacking and script injection risks.
• Credential Protection: Cryptographic salting and hashing for passwords, and encrypted vaults for API secrets and environment variables.
• Access Controls: Principle of least privilege (PoLP) enforced across all internal production systems, backed by multi-factor authentication (MFA).

Your Privacy Rights

Depending on your jurisdiction (such as under the European Union GDPR, UK GDPR, or California CCPA/CPRA), you are entitled to exercise the following rights regarding your personal information:

• Right of Access: You may request confirmation of whether we hold your personal data and receive a copy of that data.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal records.
• Right to Erasure ("Right to Be Forgotten"): You may request permanent deletion of your personal data held by us, subject to legal retention obligations.
• Right to Restriction of Processing: You may request that we temporarily suspend the active processing of your data under certain circumstances.
• Right to Data Portability: You may request an export of the data you provided to us in a structured, machine-readable format (e.g., JSON or CSV).
• Right to Withdraw Consent: Where processing is based on consent, you may revoke your consent at any time with future effect.

To exercise any of these rights, please submit a written request to contact@neochronics.com. We will respond and verify your identity within 30 days.

User Data Deletion Instructions

Option 1: Self-Service Disconnection via Meta / Instagram

You can revoke our application's access to your Instagram or Facebook account at any time directly through your account settings:

Option 2: Direct Email Request to NeoChronics (Permanent Purge)

If you wish for NeoChronics to completely erase all stored records, history, logs, and associated identifiers from our database and backup systems, please follow these instructions:

Cookies & Tracking Technologies

Our website uses minimal cookies and localized browser storage to ensure optimal site performance:

• Strictly Necessary Cookies: Essential for routing, load balancing, security tokens, and preserving user preferences.
• Performance & Diagnostics: Anonymous diagnostic telemetry to detect page rendering issues and optimize resource delivery.

We do not use invasive third-party cross-site behavioral tracking cookies. You may disable cookies in your browser settings at any time without losing access to core public content on our website.

Children's Privacy

Our services, website, and applications are exclusively intended for commercial enterprises, developers, and individuals of legal age (18 years or older). We do not knowingly collect or solicit personal information from children under the age of 16. If we become aware that we have inadvertently collected personal data from a minor without verified parental consent, we will promptly delete that information from our records.

Changes to this Privacy Policy

We may periodically update this Privacy Policy to reflect changes in our software offerings, technology stack, legal requirements, or Meta Platform Policies.

Any modifications will be published directly on this page (https://neochronics.com/privacy-policy) with an updated "Last Updated" timestamp. We encourage you to review this page periodically to remain informed of our privacy commitments.

Contact Information & Legal Notices

If you have questions, feedback, or concerns regarding this Privacy Policy, or wish to exercise your data rights or request data deletion, please contact our privacy compliance team: