Privacy Policy
Last updated: October 2026
This policy explains how Shop App by i3 and the other apps of i3 Software Solutions (the "apps") process personal data, in particular when a business uses them to create posts and publish them to Facebook, Instagram and TikTok. Our website has its own privacy policy.
1. Controller
i3 Software Solutions UG (haftungsbeschränkt)
Stolberger Straße 146
52068 Aachen, Germany
Represented by: Umme Salma Sadia (Managing Director)
Email: contact@i3softwaresolutions.de
Phone: +49 177 6664715
2. Which apps this policy covers
- Shop App by i3 (Shop app) — for retail shops: product photos, names and prices turned into product videos and image posts.
- Restaurant app — for restaurants and cafés: menus and dishes, and promotions such as offers and the daily menu.
When we add further apps, we will list them here. All apps connect to Facebook and Instagram in the same way, through one Meta app named "i3 Software Solutions", and to TikTok through one TikTok app of the same name.
In each app, a business can publish videos (on Instagram as Reels), single images and multi-image posts (carousels on Instagram) to a Facebook Page and/or an Instagram professional account it has connected — immediately, or at a time or on a repeating schedule it has set. To TikTok, the app sends videos only: each one is placed in the connected TikTok account's inbox as a draft, and the business adds a caption and posts it in the TikTok app itself.
3. Data we process
3.1 Your account
- Email address and password (the password is stored only as a secure hash: for the Shop app on our own server in Germany, for the Restaurant app by our authentication provider), and an optional display name.
- Which business your account belongs to and your role in it.
3.2 Your business and your content
- Business details such as name, an optional address line shown on your posts, time zone and an optional logo.
- Content you enter in the app, for example products, dishes, menus, prices, offers and opening days.
- Photos you upload, and the videos and images the app creates from them.
- Your posts: captions, the channels you chose, and for scheduled posts the date, time or repeating pattern.
- For each published post and channel: its status, the ID and link of the published post, and error messages if publishing failed, including the platform's technical response (kept for support).
3.3 Data from Facebook, Instagram and TikTok
When you connect a channel, you log in on Facebook's, Instagram's or TikTok's own page. We never receive your Facebook, Instagram or TikTok password. We receive and store only:
- Facebook: the ID and name of each Facebook Page you choose to connect, and a Page access token that allows the app to publish to that Page.
- Instagram: the ID, username and account type of your Instagram professional account, and an access token that allows the app to publish to it. Instagram tokens expire after 60 days; the app renews them automatically while the connection is active.
- TikTok: the ID (open_id) and display name of your TikTok account, an access token that allows the app to upload videos to your TikTok inbox, and a refresh token. TikTok access tokens expire after 24 hours; the app renews them with the refresh token (valid for about a year) when it needs to upload a video.
- The permissions you granted.
Access tokens are encrypted (AES-256-GCM) before they are stored. The encryption key is kept separately from the database, so access to the database alone is not enough to use them. To publish scheduled posts, the app uses your stored token at the scheduled time, without you being signed in.
We use these permissions only to publish the posts you created and sent or scheduled, and to show you their links. We do not read your feed, posts by others, comments, messages, followers or insights; we do not publish anything you did not create and send or schedule; we do not use Facebook, Instagram or TikTok data for advertising or profiling; and we do not sell or share it with anyone except the service providers listed below.
3.4 Technical data
When you use an app, our servers process technical data such as your IP address, the time of the request and error logs. We use it to run the apps, keep them secure and fix problems.
4. Purposes and legal bases
- Providing the apps — your account, business data, content, posts, schedules and channel connections — to perform our contract with you (Art. 6(1)(b) GDPR).
- Security, stability and troubleshooting using technical data, based on our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).
- Keeping records where the law requires it (Art. 6(1)(c) GDPR).
5. Service providers and recipients
The apps' servers and databases, including scheduled publishing and video creation, are run by us on our own servers in Germany. We use the following providers, each bound by a data processing agreement under Art. 28 GDPR:
| Provider | What for | Where |
|---|---|---|
| Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992 | User login (accounts) for the Restaurant app | Servers in the EU (Frankfurt, Germany) |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | Delivering the apps, secure connections to our servers, and storing photos and videos | Global network; see section 6 |
Meta. When a post is published, the content you chose is sent to Meta Platforms Ireland Limited (Facebook and Instagram) and becomes visible on your Page or account. From then on, Meta's own privacy policy applies to it.
TikTok. When a video is sent to TikTok, it is uploaded to TikTok Technology Limited (Ireland) and placed as a draft in your TikTok inbox. It becomes visible to others only when you post it in TikTok. From then on, TikTok's own privacy policy applies to it.
6. Transfers outside the EU
Some providers are based outside the EU or may access data from there. Where data is transferred to the USA, we rely on the provider's certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, on the EU Standard Contractual Clauses (Art. 46 GDPR). For other countries we rely on the Standard Contractual Clauses.
7. How long we keep data
- Photos, videos and images made for a post: deleted from storage automatically once the post has been published to every channel you chose. If publishing failed, they are kept so you can try again. Preview images are deleted shortly after the preview. Photos you keep in the app on purpose (for example a dish photo in your menu) stay until you delete them.
- Scheduled posts: kept until they are published or you cancel them; afterwards they are part of your post history.
- Channel connections and access tokens: when you disconnect a channel in the app, the app stops using it immediately, including for scheduled posts. Connection data and tokens are deleted when your account is deleted or when you ask us to delete your data.
- Account, business data, content and post history (captions, status, links): kept while your account exists and deleted when it is deleted, unless the law requires us to keep them longer.
- Technical logs: kept for a short period, normally no longer than 30 days.
8. Deleting your data and revoking access
You can disconnect a Facebook Page, Instagram account or TikTok account at any time under Channels in the app; for TikTok, this also revokes the app's access on TikTok's side. You can also remove access directly on Facebook (Settings → Business integrations), Instagram (Settings → Website permissions → Apps and websites) or TikTok (Settings and privacy → Security and permissions → Apps and services permissions). Each of our apps appears there under its own name (the Shop app as Shop App by i3); removing one there disconnects only that app from that Page or account.
To have all your data deleted, follow our data deletion instructions.
9. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, contact us at contact@i3softwaresolutions.de.
You also have the right to complain to a supervisory authority (Art. 77 GDPR). Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
10. Security
All connections to the apps are encrypted (HTTPS). Access tokens are encrypted at rest, each business can only access its own data, and stored photos are private and only shared with Facebook and Instagram through short-lived links, or uploaded to TikTok, when publishing.
11. Children
The apps are business tools and are not intended for people under 16.
12. Changes
We update this policy when our apps or the law change, including when we add a new app. The current version is always available on this page, with its date at the top.