How we handle Meta Platform Data

What Bellerofonte reads from Meta's APIs, under which permissions, what it is used for, who can see it, how long we keep it and how to have it deleted.

Last updated: 2026-09-20

Controller

Bellerofonte s.r.l.

Address

Via G. Galilei 2, 48018 Faenza (RA)

VAT no.

02648640395

App

Bellerofonte — https://dashboard.bellerofontedata.com

Privacy contact

privacy@piavedigitalagency.it

Security contact

security@piavedigitalagency.it

1. What we mean by "Platform Data"

We use the term Platform Data with the meaning given to it by the Meta Platform Terms (§12): any information obtained by us, or by anyone acting on our behalf, from the Meta Platforms — directly or indirectly, before or after the date of the agreement — including data derived from that information.

The consequence we treat as binding: derived and aggregated data is still Platform Data. A sentiment score computed on an Instagram comment, a keyword extracted from a caption, a topic cluster, an interaction time series, a line in a PDF report — all of it remains subject to the same usage restrictions, the same retention rules and the same deletion obligations as the original record. There is no level of aggregation at which, for us, the data stops being Platform Data and becomes ours to sell or repurpose.

2. How we obtain the data

• Official APIs only. Every piece of Meta data in Bellerofonte comes from HTTPS calls to graph.facebook.com with a valid access token issued by Meta.
• Only with a token granted by the channel owner. Connecting a channel starts from the Facebook authorisation dialog, where the administrator of the Page or of the Instagram professional account explicitly grants the permissions. Without that step we read nothing.
• No automated collection outside the APIs. We do not scrape facebook.com or instagram.com, we do not call internal or undocumented endpoints, we do not automate browsers, and we do not use libraries that impersonate a logged-in user. A non-API collection path still exists in the codebase, switched off by the setting META_ALLOW_NON_API_INGESTION, which is False: while it is, that path exits without collecting anything. Removing the code is planned; disabled is not the same as removed, and we would rather say so.
• We never ask customers or third parties for Meta credentials. We do not request — and do not accept — any customer's or anyone else's Facebook or Instagram email, password, verification code or session cookie. The public deletion form is deliberately built so that it never asks for them either. The non-API path above did require an Instagram session belonging to the Controller, and the model that stores one is still in the code: it has to go together with that path, because Platform Terms §6.a.iii forbids storing Meta credentials even when they are your own.
• Tokens are stored encrypted and never written to logs in cleartext. They are deleted on revocation, expiry or channel disconnection.

3. The four permissions we request

We request four permissions, all read-only. Connecting a Facebook Page uses two of them (pages_show_list and pages_read_engagement); connecting an Instagram professional account uses all four. For each one, the table states the Graph endpoints we actually call, the fields we request, Meta's declared allowed usage, and where the data appears in the product. Where a field is requested from Graph but never stored, we say so.

We request no other permissions. In particular we request no publishing permission, no messaging permission and no advertising permission: Bellerofonte only reads. It does not publish posts, does not reply to comments, does not send or read direct messages, and does not access campaigns, ad spend or advertising audiences.

Connection, renewal and revocation calls

Besides reading data, the app calls Graph to manage the life cycle of the consent. None of these calls reads content or data about people:

There is finally GET /pages/search, used on the screen where a customer looks for the Facebook Page to add to their project: it returns public Page metadata (id, name, location, link, verification_status), the results are only displayed, and nothing is stored until the channel is actually added.

4. Business Discovery

Business Discovery is the Graph API feature that lets a connected Instagram professional account read the public data of other professional accounts by username: GET /{ig-user-id}?fields=business_discovery.username(...).

We use it for one thing: building the benchmark comparisons customers ask for — their own channel's performance next to that of other public channels in the same sector, for instance one municipality next to other municipalities, or one publisher next to other publishers.

It is the only legitimate way to read that data. The alternative would be collecting it from public web pages, that is scraping, which the Platform Terms prohibit and which we do not do. We would rather use an official endpoint with clear limits than a shortcut with none.

Which account the call is made from. Business Discovery is not a global search: it is queried through a professional account you control. If the person running the search has connected their own Instagram professional account, the call is made from that account and with their token — on behalf of the customer. If they have no account connected, the search falls back to the Controller's own professional account, and the page says so with a visible warning. The scheduled refresh of the public benchmark channels always uses the Controller's account, because it runs at night, with no user signed in.

What this means in practice:

• it returns only the public data Meta exposes for a Business or Creator account: name, username, picture, follower count, media count, and the published media with their public counts;
• it only works on professional accounts (Business or Creator): it does not reach personal accounts and it does not reach private accounts, which return an error;
• it returns none of those accounts' private insights: reach, views and demographics stay visible to the channel owner alone, and indeed never reach us;
• it gives us no access to the people who follow or comment on those accounts.

5. What we do not do

Meta Platform Terms §3.a lists the prohibited uses of Platform Data. Below, one by one, what each of them means for Bellerofonte.

6. Who sees what

Bellerofonte has no public feed, directory or search over Meta-sourced content and comments: to consult them you have to be an authenticated user of the project that channel belongs to.

• In full form: authorised internal staff of the Controller only, and solely for service delivery, data quality control and support. Access is named and individual.
• The customer: sees the channels in their own project and nothing else. They cannot see another customer's channels, not even a public channel that also happens to be present in another project.
• In aggregated, de-identified form: the data feeds the platform's indicators — sentiment analysis, keyword extraction, topic modelling, trends and reports.

7. Separation between customers

Each customer works inside their own project. Channels, content, insights and analysis outputs are bound to the project that produced them, and the application's queries are always scoped to the project of the user running them. One customer's data never flows into a shared pool available to other customers, and no feature exposes to one customer the data collected for another.

8. Retention and deletion

Meta-sourced content, comments and metrics are retained for 90 days, after which they are deleted automatically together with the derived outputs that remain associable with them (for example that comment's sentiment score). Only aggregates that can no longer be associated with a person are kept.

Before expiry, we delete Platform Data whenever any of the six triggers in Platform Terms §3.d.i.2 occurs — stated here in plain language:

1. when we no longer need it for the legitimate business purpose for which it was collected — which is exactly what the 90-day expiry enforces;
2. when we stop offering the feature the data was collected for, or discontinue Bellerofonte: for that case there is a full-purge procedure that deletes the data of every Meta channel with no time window at all;
3. when Meta asks us to delete it, including to protect its own end users;
4. when the user asks us to delete it, or deletes their Meta account;
5. when an applicable law or regulation requires it;
6. when Section 7 of the Platform Terms requires it, that is if our agreement with Meta is suspended, terminates or expires.

On top of these, one commitment of our own, beyond what the Platform Terms require: if the channel owner withdraws authorisation — disconnects the channel, revokes the permissions, or removes the app from their Facebook settings (in the latter case Meta sends us the deauthorization notification and we proceed on our own) — we delete that channel's data without waiting for expiry. Disconnecting the channel from the platform also revokes the consent on Meta (DELETE /{user-id}/permissions), deletes the channel's content, comments, metrics and derived statistics, clears the tokens, and immediately sweeps any record left without the data it was attached to, without waiting for the nightly pass.

All three routes — the disconnect button in the platform, the Deauthorize Callback and the Data Deletion Request Callback — go through the same procedure and leave a recorded request, with a confirmation code and a summary of what was deleted: it is the proof of deletion Platform Terms §3.d.i.3 require us to be able to produce to Meta or to an authority. One honest exception: if a Deauthorize Callback arrives with an identifier that matches no connection we know of, there is nothing to delete and we record nothing — that notification leaves no trace.

Two clarifications, so as not to claim more than we do. Deletion at expiry runs once a day, at night: a record disappears within twenty-four hours of reaching 90 days, not at the exact instant. And if a post or a comment is deleted on the source platform, we do not notice on our own: our copy goes away with expiry, with the disconnection of the channel, or on a deletion request — not at the next synchronisation.

9. Vendors and language models

The vendors processing data on our behalf are listed, with their function and their location, on the Processors page. Each one is appointed under a written agreement and bound to the same usage restrictions the Platform Terms impose on us.

Bellerofonte's infrastructure is located within the European Economic Area. Language processing — sentiment, keywords, topics, summaries — runs on models hosted on the Controller's own infrastructure: Meta-sourced text is not sent to third-party AI services and is not used to train anyone's models.

10. Security

• encrypted transport (HTTPS/TLS), both to the user and to Meta's APIs;
• access tokens and application secrets encrypted at rest and never written to logs in cleartext;
• system access restricted to authorised, individually named staff;
• data separated per project and per customer;
• automatic, verifiable deletion at expiry;
• in the event of a personal data breach, notification to the supervisory authority within 72 hours and to Meta without delay, as required by the GDPR and the Platform Terms respectively.

So as not to claim more than we do: multi-factor authentication on administrative tooling, a centralised access log with periodic review, and a tested incident response plan are not yet in operation. They are planned work, not active measures, and until they are this page does not list them among our controls.

The detailed measures and the channel for reporting a vulnerability are on the Security page.

11. How to request deletion

Anyone can request deletion of their data, including people who are not customers and have never held an account with us. The form is public and asks for no Facebook or Instagram credentials:

Request deletion of your data

Each request receives a confirmation code for tracking its status on a public page until the final outcome. If a request is refused, the status page states the reason.

Alternatively, if you connected a Meta account to Bellerofonte, simply remove the app from your Facebook account settings (Settings & privacy → Settings → Apps and websites). Meta notifies us through the Deauthorize Callback and the Data Deletion Request Callback we have registered, and deletion starts automatically: nothing else is required of you.

If you are a customer and connected the channel yourself, the Disconnect button on the connection screen does exactly the same thing: it revokes the consent on Meta, deletes the data collected through that connection, and records the deletion request with its confirmation code.

For any other question about Meta data, write to privacy@piavedigitalagency.it. The full picture of our processing is in the Privacy Policy.