Privacy Policy

1. Who this policy covers

This Privacy Policy explains how Limitless Enterprises (“Limitless,” “we”) handles data through Rosalinda, the dashboard we use to deliver social media management services to our clients. It covers the business account holders who log into Rosalinda (“you,” “Client”) and, where relevant, the third-party platform data we process on your behalf.

2. Information we collect

We collect the following, directly through your use of Rosalinda:

• Account information: your business name, login username, a securely hashed password (never stored or viewable in plain text), contact email and phone number, time zone, and brand assets (logo, brand colors, tagline) you or Limitless add to your account.
• Content you provide: post captions and any images or video you upload through the Create Post tab, and any messages you send Limitless (feedback, disapproval reasons, replies to inbox messages).
• Connected social media platform data (see Section 3 below for the Facebook/Instagram-specific detail Meta's policies require us to disclose).
• Billing information: [BRACKETED: Rosalinda's current build stores only the last four digits of a payment method for display purposes and has no real payment processor connected yet - update this section with the true billing-data flow (e.g. “a third-party payment processor handles your full card details; we only ever receive the last four digits and a payment status”) once one is in place, and name the processor.]
• Technical data: a signed session cookie that keeps you logged in (contains no personal data beyond your account identifier and an expiry, and cannot be read or modified by anyone without our signing key), and standard web server logs (IP address, timestamp, page requested) generated by our hosting provider.
• Error reports: if error monitoring is enabled for this deployment, technical details about application errors (what went wrong, which page, a stack trace) are sent to Sentry, our error-monitoring provider, to help us fix problems. This is configured to exclude cookies, request bodies, and personal profile data by design - see Section 6.

3. Facebook and Instagram data, specifically

When you connect a Facebook Page or Instagram Business account, Rosalinda receives and stores, via Meta's Graph API:

• Your Page and/or Instagram Business Account ID and name/username.
• An access token that authorizes Rosalinda to act on that account - stored encrypted (AES-256-GCM) and never displayed anywhere in the dashboard.
• The comments, messages, and reviews on your connected accounts, so they can appear in your Rosalinda inbox and (where you choose to reply) be posted back to the platform on your behalf.
• Basic performance metrics (reach, engagement, follower counts) shown on your dashboard.

We use this data solely to provide the services you've engaged Limitless for: publishing the posts you've approved, showing you your own account's analytics, and surfacing comments/messages for you to review and respond to. We do not sell, license, or share this data with any third party for their own purposes, do not use it to build advertising profiles, and do not use it to make eligibility determinations about anyone (employment, credit, housing, or similar).

Requesting deletion: you can disconnect any platform account at any time from the Accounts tab, which immediately deletes the stored access token and revokes Rosalinda's access to that account. To request deletion of any other data described in this section, contact us using the information in Section 9 - we will delete it as soon as reasonably possible once it is no longer needed to provide the service, and no later than [BRACKETED: a specific number of days Limitless commits to].

4. How we use information

We use the information above to: operate your Rosalinda dashboard and account; publish posts you've approved to your connected platforms and read/respond to activity on them; calculate and display the analytics shown to you; communicate with you about your account and respond to feedback you send us; maintain the security of the service (rate-limiting login attempts, detecting misuse); and diagnose and fix technical problems.

5. How we share information

We share data only as necessary to provide the service:

• The social media platforms themselves (Facebook, Instagram, and any others you connect) - necessarily, since publishing a post or reading a comment means talking to their API.
• Infrastructure providers we use to run Rosalinda: a hosting provider, a managed database provider [BRACKETED: name it once one is chosen - Rosalinda falls back to a local file-based database with nothing external when none is configured], and, if configured, a cloud storage provider for uploaded post media (e.g. Vercel Blob or Amazon S3/Cloudflare R2) and Sentry for error monitoring. Each only receives the data necessary to perform its function and is contractually/technically restricted from using it for any other purpose.
• If required by law, subpoena, or to protect the rights and safety of Limitless or others.

We do not sell your data or your clients' data to anyone.

6. Security

Passwords are never stored in plain text - they're hashed with scrypt, a memory-hard algorithm designed to resist password-cracking. Platform access tokens are encrypted at rest (AES-256-GCM) before being stored, and are only decrypted in memory at the moment they're used to make a request to Facebook/Instagram. Session cookies are signed so they cannot be forged or edited, and are marked HttpOnly (unreadable by page scripts) and Secure (sent only over HTTPS) in production. Login attempts are rate-limited to slow down password-guessing. No method of storage or transmission is perfectly secure, but this is what Rosalinda does today to protect your data.

7. Data retention

We retain your account and content data for as long as your engagement with Limitless is active. Platform access tokens are deleted immediately when you disconnect an account. [BRACKETED: decide and state how long data is retained after the overall Limitless engagement ends, and make sure it matches the Terms of Service's termination section.]

8. Children's privacy

Rosalinda is a business tool for companies engaging Limitless's services and is not directed at, or knowingly used by, children. We do not knowingly collect information from anyone under 16.

9. Your rights and contact

You can review and update most of your account information directly in Settings. To request access to, correction of, or deletion of data we hold about you or your business, or with any other question about this policy, contact [BRACKETED: a real, monitored contact email - the codebase currently references raoul@limitlessenterprisespro.com internally; confirm this is the right address before publishing it here]. [BRACKETED: if any clients are located in the EU/UK, California, or another jurisdiction with its own privacy law (GDPR, CCPA, etc.), this section needs the specific rights those laws grant - this draft only covers general good-practice disclosure, not a specific statute's requirements.]

10. Changes to this policy

We may update this policy as Rosalinda's features change. Material changes will be reflected by updating the “Last updated” date above, and, where required, by notifying Clients directly.