Privacy Policy

This Privacy Policy explains how XE Website Solutions Ltd ("we", "us", "our") collects, uses, shares and protects your personal data when you use the Social Posting Tool (the "Service") at social-tool.bookdirectmate.com.

We are the data controller. You can contact us at:

• XE Website Solutions Ltd, Office 6, Nags Corner, Wiston Road, Nayland, Essex, CO6 4LT, United Kingdom
• Email: office@bookdirectmate.com

Data protection contact

For any questions about how we handle your personal data, or to exercise your rights, please contact our data protection contact at office@bookdirectmate.com. We have not appointed a formal Data Protection Officer, as we are not required to under UK GDPR, but this address reaches the person responsible for data protection at XE Website Solutions Ltd.

1. Data we collect

• Account details — your name, email address, password (stored hashed), cottage/property name, website and social media URLs.
• Facebook & Instagram data — when you connect your account we receive the list of Facebook Pages you manage, the Page's ID, name, category and profile picture, any linked Instagram Business account ID, and a Page access token used to publish on your behalf.
• Content — the posts, captions and images we generate and publish to your connected Page(s).
• Property data — where you connect SuperControl, we import your property details, descriptions, images, pricing and availability.
• Payment data — for paid accounts, billing is handled by Stripe. We do not see or store your full card details; we store a customer/subscription reference and status.
• Technical & usage data — log data and essential session cookies needed to keep you signed in and operate the Service.

2. How we use your data

• To create your account and provide the Service.
• To publish posts to the Facebook/Instagram account(s) you have connected and authorised.
• To import and display your property information from SuperControl.
• To process subscriptions and payments (via Stripe) for paid accounts.
• To communicate with you about your account and support requests.
• To secure, maintain and improve the Service.

3. Use of Facebook / Meta data

We use data obtained through Facebook Login and the Pages API solely to provide the Service — i.e. to list your Pages so you can choose one, to display the connected Page, and to publish content to Pages you have explicitly connected. We use these permissions (pages_show_list, pages_read_engagement, pages_manage_posts, and optionally Instagram permissions) only for these purposes. We do not sell this data, and we handle it in accordance with the Meta Platform Terms and Developer Policies. Page access tokens are stored securely and used only to post to your connected Page(s).

4. Legal bases (UK GDPR)

• Performance of a contract — to provide the Service you signed up for.
• Consent — for connecting your social accounts and publishing on your behalf (you can withdraw at any time).
• Legitimate interests — to operate, secure and improve the Service.
• Legal obligation — where we must retain records (e.g. for tax).

5. Who we share data with

We do not sell your personal data. We share it only with service providers who help us run the Service:

• Meta Platforms (Facebook & Instagram) — to publish your posts and read the Page information described above.
• Stripe — to process subscription payments.
• SuperControl — as the source of your property data (read on your behalf).
• Our hosting provider — to host the application and database.
• Authorities or advisors where required by law.

6. Data retention

We keep your personal data for as long as your account is active and as needed to provide the Service. If you close your account or ask us to delete your data, we remove it as described in our Data Deletion instructions, subject to any legal retention we are required to keep.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise any of these, email office@bookdirectmate.com. You may also complain to the UK Information Commissioner's Office (ico.org.uk).

8. Deleting your data / disconnecting

You can disconnect the app at any time from your Facebook settings (Settings & privacy → Settings → Business integrations), and remove connected Pages within the app. To have your account and stored data deleted, follow our Data Deletion instructions.

9. Security

We use appropriate technical and organisational measures to protect your data, including hashed passwords, encrypted connections (HTTPS) and secure storage of access tokens. No method of transmission or storage is completely secure, but we work to protect your information.

10. Children

The Service is intended for property owners and businesses and is not directed at anyone under 18.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date above reflects the latest version, and significant changes will be communicated where appropriate.

12. Contact

Questions about this policy or your data? Email office@bookdirectmate.com or write to XE Website Solutions Ltd at the address above.

← Back