User Data Deletion

1. What Meta Data We Collect & Store

When you connect a Meta account, Vermoon stores only what its agents need to publish content and manage campaigns on your behalf. Depending on which agents you use, this can include:

• Account identifiers: your Facebook and Instagram account ID, username, and profile or Page name; the list of Pages you grant access to and their Page IDs; and Instagram Business account identifiers.
• Social content data: identifiers, captions, and timestamps of posts the social content agent publishes, and Page engagement insights (reach, impressions, audience metrics) used to report on performance.
• Meta Ads data: ad account IDs, campaign and ad performance records, and audiences created or managed by the Meta Ads agent.
• Access tokens: the OAuth access token and its expiry, encrypted at rest using AES-256-GCM. Our production storage is in the European Union.

We never sell your Meta data and we never use it to train AI models.

2. Choose What to Delete

There are three distinct actions. They are easy to confuse, so it is worth being clear about what each one does:

• Disconnect a Meta connection in Vermoon: immediately deletes the stored token and the Meta data tied to that connection, while keeping your Vermoon account and everything unrelated to Meta. See Option A.
• Revoke access in Facebook or Instagram: stops Vermoon from accessing your account in the future. On its own it does not erase the data we already stored, so pair it with Option A or Option C. See Option B.
• Delete your whole Vermoon account: removes everything we hold about you, including all connected Meta data. See Section 6.

3. Option A: Disconnect a Meta Connection in Vermoon (Recommended)

This is the fastest path and takes effect immediately. If you only want to remove your Meta data but keep using Vermoon for other agents, use this option.

1. Log in to Vermoon.
2. Go to Settings → Integrations.
3. Find the Meta (Instagram + Facebook) connection.
4. Click Disconnect and confirm.

Disconnecting permanently deletes the stored access token and the Meta data tied to that connection. There is no waiting period and your Vermoon account stays active.

4. Option B: Revoke Access from Facebook or Instagram

You can also remove Vermoon from Meta’s side. The Meta platform does not offer an app-side endpoint to revoke a token, so removing the app from your Meta settings is how you cut off our future access.

On Facebook

1. Open the profile menu and choose Settings & Privacy, then Settings.
2. Open Apps and Websites.
3. Under Active, find Vermoon.
4. Click Remove and confirm. You can also tick the box to delete posts the app made on your timeline.

On Instagram

1. Open Settings, then Apps and websites.
2. Under Active, select Vermoon and choose Remove.

When you remove the app, we delete the Meta data we hold for you. Revoking access stops future access only. To also erase data we already stored right away, use Option A or Option C.

5. Option C: Email Us a Deletion Request

If you would rather have us handle it, email privacy@vermoon.es with the subject line Data Deletion Request. So we can locate and verify your records before deleting them, please include:

• The email address on your Vermoon account.
• The connected Facebook or Instagram username or user ID.
• For ad data, the Meta ad account ID, if you know it.

We verify your identity before acting on the request and confirm once it is complete. This is also the channel for any GDPR right-to-erasure request.

6. Deleting Your Entire Vermoon Account

To delete your whole account and everything we hold about you, send a deletion request by email as described in Option C. Account deletion is scheduled with a 30-day grace window during which you can cancel it. After the grace window, our team carries out a purge that permanently deletes the rows you own (including your Meta connections, tokens, notifications, and shares), removes your user attribution from retained cost and usage records, deletes your sign-in account, and leaves only a tombstone marker. All connected Meta data is deleted as part of this purge. Before you delete, you can ask us for a machine-readable copy of your data so you keep your own records.

7. Deletion Timeline & the 30-Day Grace Window

• Disconnecting in Vermoon (Option A) or removing the app (Option B): the relevant Meta data and tokens are deleted immediately.
• Email requests (Option C): completed within 30 days of a verified request.
• Full account deletion (Section 6): a 30-day cancelable grace window, then a permanent purge, including copies held in backups, within the same window.

In short: we delete your Meta-sourced data within 30 days of your request, of disconnecting the connection, or of removing the app, backup copies included.

8. What We Delete & What We Retain

• Permanently deleted: encrypted Meta access tokens, Meta account and Page identifiers, post metadata and captions, engagement insights, ad account and campaign records, audiences, and your stored Meta connections. On full account deletion this also covers your notifications and shares.
• Anonymized: aggregate cost and usage logs. The records remain for accounting and capacity planning, but your personal attribution is removed.
• Retained for a legal reason: where statutory accounting or tax law requires it, we retain the minimum data necessary for the legally mandated period and tell you which data and why. Usage and cost logs are anonymized on account deletion and otherwise kept for as long as your account is active.

GDPR Article 17(3)(b) (compliance with a legal obligation) and Article 17(3)(e) (establishment or defence of legal claims) permit this limited retention. If we ever have to keep data you asked us to delete, we tell you which data and why.

9. Confirmation of Deletion

For email requests, we send a confirmation that states what was deleted and when, with a reference code for your records. In-app disconnects show an immediate success state. If you do not receive a confirmation within 30 days, email us again at privacy@vermoon.es and we will give you a plain-language status update, including the reason for anything we have lawfully retained.

10. Your GDPR & CCPA Rights

Under GDPR Article 17 you have the right to erasure of your personal data. We act without undue delay and within one month of a verified request, extendable by two further months for complex or numerous requests, in which case we tell you about the extension and the reasons within the first month. Erasure is not absolute where retention is legally required, as set out in Section 8. You may lodge a complaint with your local data protection authority. For Spain this is the Agencia Española de Protección de Datos (aepd.es). California residents may request deletion of their personal information under the CCPA through the same channels described above.

11. Contact

Vermoon S.L., Barcelona, Spain, is the data controller for your personal data. For any deletion request or question, contact us at privacy@vermoon.es using the subject line Data Deletion Request. For more on how we handle your data, see our Privacy Policy and Terms of Service.