PUBLIC POLICY · UPDATED 3 AUGUST 2026
Privacy policy
This policy explains how Alejandro Carbajo Vidales handles personal data through alejandrocarbajo.com and the owner-operated PersonalBrand Social Connector used with Alejandro's Facebook Page and Instagram creator account.
Who is responsible
The data controller is Alejandro Carbajo Vidales, based in Spain. Privacy questions and requests can be sent to [email protected].
Data the connector processes
When Meta sends an authorized webhook event, the connector may process account, Page, media, comment, message or mention identifiers; event types and timestamps; bounded source references; and integrity hashes used for deduplication and security.
The webhook ingress does not intentionally retain comment or message bodies. Raw webhook bodies are verified, normalized and discarded. Provider access tokens and app secrets are stored in the macOS Keychain on the local Mac Mini, not in the public website or repository.
Why the data is used
- to authenticate and operate the exact social accounts Alejandro owns or manages;
- to publish content that has passed the applicable approval boundary;
- to receive, deduplicate and classify authorized interaction events;
- to protect the service, investigate delivery failures and maintain an accountability record;
- to respond to a person only when the applicable platform and human-approval rules allow it.
Where applicable, this processing is based on the account owner's authorization, consent, performance of a requested service, and the legitimate interest in operating and securing the connector. Consent or account authorization can be withdrawn at any time.
Storage and retention
Normalized terminal webhook metadata is retained for up to 30 days and then tombstoned or redacted under the connector's retention process. Credentials remain until they are revoked, rotated or no longer required. Minimal security, deletion and publication records may be retained when necessary to demonstrate that a request or public action was handled correctly.
Who receives data
Data is not sold. Meta provides the Facebook and Instagram APIs. Cloudflare supplies DNS and encrypted tunnel transport only. Processing and durable ingress storage run on Alejandro's local Mac Mini. These providers may process technical data under their own terms and privacy policies.
Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability, and may withdraw consent. You can also revoke the app directly in Facebook or Instagram's Apps and Websites settings. See the data-deletion instructions for the practical route.
Security and children
The connector uses signed webhooks, exact route allowlists, loopback-only local service binding, Keychain-backed credentials and platform kill switches. No system can guarantee absolute security. The connector is not directed to children and is not intended to collect children's data.
Changes
Material changes will be published on this page with a new effective date. Questions can be sent to [email protected].
Current automation boundary: an integration being technically connected does not by itself authorize a post, reply or private interaction.