Privacy policy

Effective 3 November 2026. This policy explains what Kemetova OS (“the portal”, at kemetova.net) collects, why, and what happens to it. The portal is operated by Kemetova (“we”, “us”), a digital marketing agency registered in Egypt (س.ت.: 207484 - ب.ض: 752-656-333), reachable at hello@kemetova.com.

1. Who the portal is for

The portal is an internal tool. Its users are Kemetova staff. Clients of the agency interact with it through links we send them (to approve posts or read a report) and through the social media and Google accounts they authorise us to manage on their behalf. We do not offer the portal to the public.

2. What we collect

• Staff accounts: name, work email, password (hashed), two-factor settings, the device tokens used for push notifications, and the work recorded in the portal (tasks, hours, messages, files).
• Client records: company and contact details our clients give us, the files they share for their campaigns, contract and invoicing details, and messages received through our websites’ contact forms.
• Connected platform accounts: when a staff member connects a client’s account, we receive from the platform the account’s identifier, name and picture, and an access token. For Facebook Pages and Instagram professional accounts (through Meta’s Facebook Login for Business and Business Login for Instagram), LinkedIn profiles and company pages, TikTok accounts, X accounts and Google Business Profile locations, we then read the account’s audience and performance numbers (followers, reach, views, engagement) and the results of the posts we published.
• Posts and media: the captions, images and videos the team prepares and the client approves, and the identifiers of the published posts.
• Technical data: server logs with IP addresses and request times, kept for security; a session cookie that keeps a staff member signed in. We use no advertising or tracking cookies.

3. Why we use it

• To do the work our clients hired us for: planning, approving, publishing and reporting on their marketing.
• To publish approved content to the accounts a client authorised, at the scheduled time, and to read that content’s results for the client’s analytics and monthly report.
• To run the agency: tasks, time, messages and notifications for staff.
• To keep the portal secure and available: logs, backups, two-factor authentication.

The legal basis is the contract between Kemetova and its clients, our legitimate interest in running the agency, and, for connected accounts, the authorisation the account owner gives on the platform’s own login screen.

4. Data from connected platforms

Platform data is used only to serve the account owner who connected it. In particular:

• Meta (Facebook and Instagram): we use the permissions granted to list the Pages and Instagram accounts the staff member manages, publish approved posts, reels and stories to them, and read their insights. We do not read private messages or comments, do not run ads through the portal, and do not use the data for any purpose other than the client’s own marketing. Removing the portal from the account on Facebook or Instagram, or disconnecting it in the portal, ends our access.
• Google: with the account owner’s consent we read the business locations the Google account manages, publish approved updates to the chosen locations, and read their performance (views on Search and Maps, calls, direction requests). Kemetova OS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, never sold, and never shared with third parties except as needed to provide the service to the account owner, for security, or as required by law. Humans read it only with the account owner’s consent, for security, or to comply with the law.
• TikTok: we publish the videos the account owner approved, with the audience, comment, duet, stitch and commercial-content settings chosen for each one, and read the account’s and the videos’ numbers. Content is uploaded directly from our server.
• LinkedIn and X: we publish approved posts to the connected profile, company page or account and read the published posts’ numbers.

Access tokens are stored encrypted in our database and used only by the portal’s own server. They are deleted when the account is disconnected, when the client’s workspace is deleted, or when the platform revokes them.

5. Who else sees data

We do not sell personal data and we do not share it for advertising. Data is processed by the service providers the portal runs on, under their own privacy terms: our web host (the server in Egypt where the portal and its database run), Pusher (real-time notifications; message content passes through it), Anthropic (when a staff member asks the portal to draft a caption, a report summary or an article, the relevant text and image are sent to the Anthropic API; access tokens and credentials never are), Google Drive (encrypted daily backups), and the social platforms themselves when we publish or read on the client’s behalf. We may disclose data when the law requires it.

6. How long we keep it

• Staff accounts and work records: for as long as the person works with the agency, then archived or deleted.
• Client records, posts and reports: for the duration of the engagement and the period our accounting obligations require.
• Platform tokens: until the account is disconnected (see above). Platform numbers: kept for the client’s historical reports.
• Public copies of media made for publishing: removed two months after the post is published.
• Server logs: a short rolling period. Backups: daily, kept for up to 30 days, then deleted.

7. Security

Connections to the portal use HTTPS. Passwords are hashed, administrators must use two-factor authentication, tokens and credentials are encrypted at rest, access is limited to the staff who work on the client, and the database is backed up daily. No system is perfectly secure; if we learn of a breach that affects you we will tell you without undue delay.

8. Your rights and data deletion

You can ask us what we hold about you, ask for it to be corrected or deleted, or object to a use of it, by writing to hello@kemetova.com. Account owners can also end our access themselves at any time, on the platform or in the portal: see data deletion. We answer within 30 days.

9. Children

The portal is for working adults. We do not knowingly collect data about anyone under 18.

10. Changes and contact

When this policy changes, the new version is published here with a new effective date. Questions go to Kemetova, hello@kemetova.com, 01500033224 - 01558458887, www.kemetova.com.