Privacy Policy

1. Who this policy covers

This Privacy Policy explains how Limitless Enterprises (“Limitless,” “we”) handles data through Rosalinda, the dashboard we use to deliver social media management services to our clients. It covers the business account holders who log into Rosalinda (“you,” “Client”) and, where relevant, the third-party platform data we process on your behalf.

2. Information we collect

We collect the following, directly through your use of Rosalinda:

• Account information: your business name, login username, a securely hashed password (never stored or viewable in plain text), contact email and phone number, time zone, and brand assets (logo, brand colors, tagline) you or Limitless add to your account.
• Content you provide: post captions and any images or video you upload through the Create Post tab, and any messages you send Limitless (feedback, disapproval reasons, replies to inbox messages).
• Connected social media platform data (see Section 3 below for the Facebook/Instagram-specific detail Meta's policies require us to disclose).
• Billing information: Rosalinda does not process payments. Billing for Limitless's services is handled outside this dashboard, and the only billing data Rosalinda stores is the last four digits of a payment method, shown so you can identify which card an invoice relates to. We never receive or store a full card number, expiry or security code.
• Technical data: a signed session cookie that keeps you logged in (contains no personal data beyond your account identifier and an expiry, and cannot be read or modified by anyone without our signing key), and standard web server logs (IP address, timestamp, page requested) generated by our hosting provider.
• Error reports: if error monitoring is enabled for this deployment, technical details about application errors (what went wrong, which page, a stack trace) are sent to Sentry, our error-monitoring provider, to help us fix problems. This is configured to exclude cookies, request bodies, and personal profile data by design - see Section 6.

3. Facebook and Instagram data, specifically

When you connect a Facebook Page or Instagram Business account, Rosalinda receives and stores, via Meta's Graph API:

• Your Page and/or Instagram Business Account ID and name/username.
• An access token that authorizes Rosalinda to act on that account - stored encrypted (AES-256-GCM) and never displayed anywhere in the dashboard.
• The comments, messages, and reviews on your connected accounts, so they can appear in your Rosalinda inbox and (where you choose to reply) be posted back to the platform on your behalf.
• Basic performance metrics (reach, engagement, follower counts) shown on your dashboard.

We use this data solely to provide the services you've engaged Limitless for: publishing the posts you've approved, showing you your own account's analytics, and surfacing comments/messages for you to review and respond to. We do not sell, license, or share this data with any third party for their own purposes, do not use it to build advertising profiles, and do not use it to make eligibility determinations about anyone (employment, credit, housing, or similar).

Requesting deletion: you can disconnect any platform account at any time from the Accounts tab, which immediately deletes the stored access token and revokes Rosalinda's access to that account. To request deletion of any other data described in this section, contact us using the information in Section 9 - we will delete it as soon as it is no longer needed to provide the service, and in any event within 14 days of your request.

4. How we use information

We use the information above to: operate your Rosalinda dashboard and account; publish posts you've approved to your connected platforms and read/respond to activity on them; calculate and display the analytics shown to you; communicate with you about your account and respond to feedback you send us; maintain the security of the service (rate-limiting login attempts, detecting misuse); and diagnose and fix technical problems.

5. How we share information

We share data only as necessary to provide the service:

• The social media platforms themselves (Facebook, Instagram, and any others you connect) - necessarily, since publishing a post or reading a comment means talking to their API.
• Infrastructure providers we use to run Rosalinda: Vercel (hosting, and Vercel Blob for the photos and videos attached to your posts), Neon (the managed PostgreSQL database holding your account and content), Resend (transactional email, such as password resets), and, where enabled, Sentry (error monitoring, configured to exclude cookies, request bodies and personal profile data). Each only receives the data necessary to perform its function and is contractually and technically restricted from using it for any other purpose.
• If required by law, subpoena, or to protect the rights and safety of Limitless or others.

We do not sell your data or your clients' data to anyone.

6. Security

Passwords are never stored in plain text - they're hashed with scrypt, a memory-hard algorithm designed to resist password-cracking. Platform access tokens are encrypted at rest (AES-256-GCM) before being stored, and are only decrypted in memory at the moment they're used to make a request to Facebook/Instagram. Session cookies are signed so they cannot be forged or edited, and are marked HttpOnly (unreadable by page scripts) and Secure (sent only over HTTPS) in production. Login attempts are rate-limited to slow down password-guessing. No method of storage or transmission is perfectly secure, but this is what Rosalinda does today to protect your data.

7. Data retention

We retain your account and content data for as long as your engagement with Limitless is active. Platform access tokens are deleted immediately when you disconnect an account. When your engagement with Limitless ends, we retain your account and content data for 30 days - long enough to produce any final reporting and to let you return without starting over - and delete it after that.

8. Children's privacy

Rosalinda is a business tool for companies engaging Limitless's services and is not directed at, or knowingly used by, children. We do not knowingly collect information from anyone under 16.

9. Your rights and contact

You can review and update most of your account information directly in Settings. To request access to, correction of, or deletion of data we hold about you or your business, or with any other question about this policy, contact raoul@limitlessenterprisespro.com. We will acknowledge your request and act on it within 14 days.

10. Changes to this policy

We may update this policy as Rosalinda's features change. Material changes will be reflected by updating the “Last updated” date above, and, where required, by notifying Clients directly.