Privacy: publishing on social networks

This policy explains what data Maxilog processes when a restaurant customer links its Facebook Page, its Instagram professional account, its TikTok account, its Google Business Profile or its LinkedIn company page to its Maxilog space in order to publish there. It supplements our privacy policy.

The service is operated by Maxilog Software, Ksar Zaouia, 4170 Zarzis, Tunisia. For any question about your data: contact@maxilog-resto.com.

1. Who is responsible for what

• For its publications and the data of its pages, the restaurant is the data controller. Maxilog acts as its processor (Article 28 GDPR): we publish and read statistics only on the restaurant’s instructions, under its contract.
• For its own data, Maxilog is the data controller: customer space accounts, the activity log, billing and the running of the service, as well as our obligations as an app developer towards Meta, Google, TikTok and LinkedIn.

2. The data Maxilog reads

Only what the restaurant authorises when it connects, and only for the professional accounts it chooses.

• Meta (Facebook Pages and Instagram professional accounts): the identifier and name of the Page or account, and the access tokens that allow publishing on its behalf.
• Google Business Profile: the identifier and name of the business location, and the access tokens that allow publishing on its behalf.
• TikTok: basic profile information (the account’s identifier for Maxilog, the display name and the address of the profile picture, through the “user.info.basic” permission), the access tokens that allow publishing on its behalf, and, when each post is prepared, the creator information TikTok asks us to show (username, the privacy levels offered, the comment, Duet and Stitch settings, the longest video allowed). Of the latter we keep only the username, for the link to the post.
• LinkedIn (company pages): the identifier, name and LinkedIn address of the pages the connecting person administers, their role on each, the date the access ends, and the access tokens that allow publishing on behalf of the chosen page. To keep a record of the permission given, we also store that person’s LinkedIn identifier and name.
• The content of the posts Maxilog publishes: text, images and videos, links, publishing date, status and the post’s identifier on the network.
• Aggregated statistics on those posts and on the connected accounts: numbers, such as views, reach or interactions (for LinkedIn: impressions, clicks, likes, comments, shares and the page’s follower count). Never a list of people.
• The business location’s Google reviews, when its Google Business Profile is connected: the rating, the text of the review, the author’s name as Google publicly displays it, the dates, and the business’s reply. We keep neither the author’s profile photo nor their Google identifier.

3. What Maxilog does not read

In this version of the service, Maxilog does not read:

• private messages;
• followers (the list of people who follow the account);
• comments posted under the posts (their text and their authors);
• on LinkedIn, the connecting person’s profile beyond their identifier and name, or their connections.

We do not sell this data and do not use it for advertising.

4. Why

• To publish on the restaurant’s behalf the posts it has written or approved, at the time it has chosen.
• To show the statistics of those posts and of the connected accounts in the restaurant’s space.
• To keep a record of the LinkedIn permission (who gave it) and to warn the restaurant 7 days before it ends: LinkedIn limits this access to 60 days.
• To show the business’s Google reviews in the restaurant’s space, to email it about new 1- or 2-star reviews (without the author’s name or the review’s text), and to let it reply.

Replies to reviews are always sent by a person. Maxilog never replies to a review automatically: each reply is written or reviewed, then confirmed by an authorised person at the restaurant before it is published on Google. The writing assistant can suggest a text, which the person edits and sends themselves if they wish. The Maxilog team never replies to reviews on the restaurant’s behalf.

On TikTok, nothing is published without the restaurant’s own choices. For each post, an authorised person at the restaurant chooses who can see it, allows comments or not (and, for a video, Duet and Stitch), says whether it is commercial content and accepts TikTok’s terms. Nothing is chosen in advance, neither the Maxilog team nor the writing assistant can make these choices, and any change to the post asks for them again. Posts published on TikTok are photos or videos.

Nothing is published without the restaurant’s approval. Maxilog only publishes posts written or approved by an authorised person at the restaurant. When the Maxilog team or the writing assistant prepares a post, it waits for the restaurant’s approval, and the Maxilog team cannot approve on the restaurant’s behalf.

Maxilog’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Where access tokens are stored

Access tokens are kept in an encrypted secret store, separate from our databases. They are never stored in a database or written to logs. They are read when the call to the social network is made, and deleted when the account is disconnected, and at the latest on the day the contract ends. For LinkedIn, the identifier and name of the person who connected the page are kept in the same place as the tokens and deleted with them.

6. How long we keep data

• Events received from the networks (webhooks): 30 days.
• History of publishing attempts: 1 year.
• Images and videos prepared for each network: 90 days after publishing.
• Statistics: for the whole length of the contract, then deleted 3 months after it ends.
• Identifier and name of the person who connected a LinkedIn page: until the page is disconnected, the contract ends or the page is connected again.
• Instructions sent to the writing assistant (AI), when it is used: 30 days. We do not keep the text of reviews or their authors’ names there.
• Google reviews: while the profile is connected, updated about every 30 minutes. A review is deleted from Maxilog as soon as it no longer appears on Google, as soon as the profile is disconnected or the contract ends, and at the latest 30 days after it was last updated from Google.

7. Sub-processors and transfers outside the European Union

For this service, Maxilog relies on:

• Meta (Facebook and Instagram), Google (Google Business Profile) and LinkedIn (company pages), to publish and read statistics;
• TikTok, to publish the photos and videos the restaurant approved, with the choices it made;
• an artificial intelligence provider, for the writing assistant, when it is used: Anthropic, OpenAI, Google, Mistral AI, xAI or DeepSeek, depending on the provider Maxilog has chosen, only one at a time for a restaurant. It receives the restaurant’s public information and the writing instructions and, only when a person at the restaurant asks for a suggested reply to a review, that review’s rating and text and the first name of its author as Google displays it (never their full name). You can ask us which provider handles your restaurant’s requests at contact@maxilog-resto.com;
• our hosting provider: our servers and databases are located in the European Union.

Meta, Google, TikTok, LinkedIn and the chosen artificial intelligence provider may process data outside the European Union, in particular in the United States, or in China if DeepSeek is chosen. Mistral AI offers processing in the European Union. Maxilog Software is established in Tunisia and its staff access the systems from Tunisia to operate the service. For these transfers we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses. You can ask us for details of those safeguards at contact@maxilog-resto.com.

8. Disconnecting an account

The restaurant can disconnect a Facebook, Instagram, TikTok, Google or LinkedIn account at any time from its Maxilog space (/espace), in the social networks section. Maxilog then revokes its access with the network where the network allows it, and deletes the access tokens. You can also remove Maxilog’s access from the settings of your Facebook account, your Google account or your TikTok account (app permissions).

LinkedIn does not allow a permission to be removed remotely: when a LinkedIn page is disconnected, Maxilog deletes its access tokens, which are no longer used, and the access expires by itself at the latest 60 days after the connection. You can also remove Maxilog in your LinkedIn account’s settings, in the data privacy section, among the permitted services.

9. Requesting deletion of your data

• From Facebook: in your account settings, under apps and websites (or business integrations), remove Maxilog and request deletion of your data. Facebook forwards the request to Maxilog, which deletes the connected accounts linked to your Facebook user and their tokens. You receive a confirmation code and a link to the deletion status page.
• By email: write to contact@maxilog-resto.com naming the restaurant and the accounts concerned. We handle the request within 30 days.

10. Your rights

You can access, correct, export or erase your data, object to its processing, or withdraw your consent. If you are a customer of the restaurant rather than the restaurant itself, first send your request to the restaurant, which is responsible for its publications; we will help it answer.

If you left a Google review of a restaurant that uses Maxilog: you can edit or delete it on Google at any time, and Maxilog deletes its copy at the next update. You can also write to us at contact@maxilog-resto.com.

You also have the right to complain to a supervisory authority: in France, the CNIL (cnil.fr); in Tunisia, the Instance Nationale de Protection des Données Personnelles (INPDP, inpdp.tn).

Representative in the European Union: we are in the process of designating a representative under Article 27 GDPR. Until that is published here, you can write to us directly at contact@maxilog-resto.com.

11. Changes

If we change how we handle this data, we will update this page and change the date at the top.

12. Contact

Maxilog Software
Ksar Zaouia, 4170 Zarzis, Tunisia
contact@maxilog-resto.com