Privacy Policy

Operator and scope

PK Creative, including its Indigo suite and related PKD Social and PKD Social-IG integrations, is operated by PK Design and Consulting, a limited liability company. This notice covers information handled through PK Creative and related support. PK Bridge is a separate service with its own privacy notice.

For privacy questions, access, correction, export, or deletion requests, contact PK@PKDesignandConsulting.com. A client organization also determines how it uses information in its assigned workspace.

Information we handle

Account information includes names, email addresses, sign-in identifiers, invitations, memberships, assigned brands, roles and authentication records. Workspace information includes business and campaign details, captions, notes, media or media links, document and Drive folder links, post requests, approvals, schedules and publication results.

When you authorize Facebook or Instagram inbox access, we receive the selected account or Page identifiers, profile information, granted permissions and authorization tokens. Inbox data can include available conversations, comments, replies, message text, sender and recipient identifiers, names or usernames, timestamps and attachment links. We also record read state, assignments, resolution state and reply delivery status. Availability depends on Meta permissions and account eligibility.

Operational records include activity timestamps, connection and delivery status, errors and security diagnostics. Hosting and sign-in providers may also process network and device information needed to operate and protect their services.

Pinterest integration

PK Creative Indigo is developing a Pinterest integration for authorized businesses. Once enabled and authorized, it will process connected-account identifiers, profile information, granted permissions, securely stored authorization tokens, the authenticated account's Pins and Boards, approved publishing content, and available performance analytics. This information supports account connections, board organization, approved publishing, and reporting. Each client's data is restricted to its authorized workspace. Users may revoke Pinterest access through Pinterest settings and request deletion by contacting PK@PKDesignandConsulting.com. The Pinterest integration is not yet active.

TikTok connections and posting

When you connect TikTok to Indigo, we receive your TikTok account identifier, profile display name and username, granted scopes, access and refresh tokens and their expiration times. We query current creator posting capabilities, including permitted privacy options, interaction restrictions and maximum video duration. We do not request TikTok direct messages or private conversation history through this publishing connection.

When an authorized administrator explicitly approves sending a video, we send TikTok the selected video, caption, cover-frame position, privacy choice, interaction settings and applicable commercial-content and AI-content disclosures. A signed delivery link lets TikTok retrieve that one selected file for up to one hour; anyone possessing that link could download the file before it expires. The private media library and its listing are not made public. We retain the approval, destination account, provider publishing identifier, status and any publication results to operate the feature and prevent duplicate submissions. Stored social credentials are encrypted. You may revoke access in TikTok settings and request removal of the connection and retained records through our deletion process below. Revocation alone does not remove already published content or stored history.

Purposes and authorized sharing

We use information to authenticate users, enforce brand and workspace permissions, provide the features requested, retrieve authorized messages and comments, display content to authorized team members, record approvals, process explicit reply or publishing instructions, provide support and investigate errors or abuse.

Sending a reply transmits the approved message to Meta and the intended recipient. Publishing transmits selected content to the selected social service, directly or through the configured publishing provider. Content becomes visible according to that destination's settings. Connecting an account does not authorize unrelated marketing use of its messages.

Authorized team members see information according to their assigned role and brand. Administrators manage access. Personnel supporting the service may access information where needed to operate it, investigate an issue or respond to an authorized request. We may disclose information where required by law or reasonably necessary to address abuse, security incidents or legal claims.

Service providers

PK Creative uses OpenAI Sites and its Cloudflare infrastructure for application hosting and storage, and Sign in with ChatGPT/OpenAI for access to this installation. Meta provides the Facebook and Instagram APIs. TikTok provides authorized TikTok login, creator information and content publishing APIs. Postiz is used for publishing features where that connection is configured. Render stores encrypted server backups for disaster recovery. Google Drive handles linked folders and documents according to the Google account permissions you grant. Provider terms and privacy policies apply to those services.

Inbox sync and replies do not automatically send customer message text to an AI text-generation service. Contact us about any optional AI feature before submitting sensitive material to it. Provider processing and retention are governed by their applicable terms and account arrangements; we do not promise zero provider retention.

Storage, security and browser technologies

We use account and brand access controls and encrypt stored social authorization tokens and inbox message content. These measures do not guarantee absolute security. Sign-in and authorization use necessary cookies and browser technologies; blocking them can prevent connections or access from working. Protect your login and contact us about suspected unauthorized access.

Retention and deletion

Records support ongoing client work, message follow-up, approvals, publishing history and support. There is no single automatic expiry period for all records. The inbox's 30-day viewing window is a display and import limit, not a promise that all stored information is automatically erased after 30 days.

To request account closure or deletion, follow the data deletion instructions. We verify identity and authority and explain any applicable retention limits. Legal obligations, security investigations and dispute resolution may require retention of some records. Backup copies may remain until the relevant backup lifecycle completes; immediate erasure from every backup is not promised.

You can revoke connected-service access through Meta or another provider's account settings. Revocation prevents future authorized API access when enforced by the provider; it does not automatically delete existing PK Creative records or content already sent or published elsewhere. Request deletion separately and use destination-service controls for its copies.

Your choices and updates

Contact us to request access, correction, export, deletion or information about processing and service providers. Depending on applicable law, you may have additional rights to restrict or object to processing, withdraw consent, appeal or complain to a regulator. We verify only information needed for the request and explain relevant limits. For client-managed information we may coordinate with or refer you to that client. Service providers may process data outside your country.

PK Creative is a business service and is not directed to children. This notice will be updated when practices change; additional notice or consent will be provided where required. A revised notice does not authorize uses of earlier information that violate prior commitments or applicable law.