Privacy Policy

Effective Date: October 26, 2026 · Last Updated: October 26, 2026

This Privacy Policy explains how Nuntior (accessible at https://nuntior.com, https://api.nuntior.com, and https://mcp.nuntior.com), operated by Allometrik Consulting FZCO ("Company", "we", "us", or "our"), a Free Zone Company registered at DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates, collects, uses, encrypts, stores, and protects information when you use our Unified Execution & OAuth Layer, REST API, and Model Context Protocol (MCP) Server.

1. Data Controller & Contact Information

• Legal Entity: Allometrik Consulting FZCO
• Registered Address: DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE
• Data Protection & Privacy Contact: hello@allometrik.com / jose@allometrik.com

2. Information We Collect

We collect only the minimum information required to authenticate your connected accounts and execute explicit user- or agent-initiated actions:

• Account & Workspace Data: Name, business email address, billing metadata, and multi-tenant profile settings.
• OAuth Credentials & BYOK Keys: OAuth 2.0 access tokens, refresh tokens, token expiration timestamps, authorized scopes, and optional customer-supplied Bring-Your-Own-Key (BYOK) Client IDs and Client Secrets.
• Connected Social Profile Metadata: Platform user/page ID, handle/username, display name, and avatar URL provided by authorized platforms (Meta/Facebook/Instagram/Threads/WhatsApp, TikTok, LinkedIn, Google/YouTube, X, Reddit, Bluesky, Pinterest, Ghost, WordPress, Webflow, and Telnyx).
• Content & Execution Payloads: Posts, media assets (images/videos processed through our Cloudflare R2 and FFmpeg pipeline), comments, messages, and campaign configurations explicitly submitted by you or your authorized AI agents.

3. Cryptographic Security & AES-256-GCM Token Vault

All OAuth access tokens, refresh tokens, and customer-provided BYOK credentials (customClientId and customClientSecret) are encrypted at rest using authenticated AES-256-GCM encryption with unique initialization vectors (IVs) and authentication tags prior to storage. All data in transit is encrypted via TLS 1.3. Credentials are decrypted strictly in isolated memory at the moment of executing an authorized API request to the target platform.

4. Platform-Specific Compliance & Limited Use Disclosures

• Google & YouTube API Services User Data Policy (Limited Use Compliance): Nuntior's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Users connecting YouTube channels also agree to be bound by the YouTube Terms of Service and Google Privacy Policy. We never use Google/YouTube user data for generalized AI/ML foundation model training or third-party advertising.
• Meta Platform Terms (Facebook, Instagram, Threads, WhatsApp): We process Meta Platform Data strictly as a Tech Provider / Data Processor acting on your instructions. We do not sell, license, or transfer Meta Platform Data to data brokers, and we provide automated and manual Data Deletion callbacks at https://nuntior.com/data-deletion.
• TikTok Developer Terms Compliance: Nuntior respects creator privacy settings (PUBLIC_TO_EVERYONE, MUTUAL_FOLLOW_FRIENDS, SELF_ONLY), interaction toggles (Comment, Duet, Stitch), and commercial content disclosures.
• LinkedIn API Terms Compliance: Nuntior never scrapes LinkedIn member profiles, never sends automated unsolicited connection spam, and only publishes content or moderates comments on behalf of authenticated members and verified organization administrators.
• X (Twitter) & Reddit Developer Terms: All actions are rate-limited and executed strictly under the authenticated user's explicit OAuth grant or isolated BYOK credentials.

5. No Sale of Data & No Foundation Model Training

We never sell your personal data, OAuth tokens, social graph, private messages, or content to third parties. Data retrieved from third-party social APIs is never used to train external foundation models.

6. Data Retention, Revocation & Deletion Rights

Cached analytics and metadata are refreshed or purged within 24 hours to 30 days in compliance with platform API policies. You may revoke Nuntior's access at any time via our API (accounts_manage with action: "disconnect"), through each platform's native security settings (e.g., Google Security Settings at https://security.google.com/settings/security/permissions), or by submitting a deletion request at https://nuntior.com/data-deletion. Upon disconnection or deletion request, all associated AES-256-GCM encrypted tokens and cached records are permanently purged within 24 hours.

7. GDPR, UAE PDPL & International Users

We comply with the EU General Data Protection Regulation (GDPR) and the UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (PDPL). You have the right to access, rectify, export, restrict, or erase your personal data by emailing hello@allometrik.com.