Privacy Policy
This policy describes the private AutoPost tool used for Pan Card Centre social publishing. It does not describe the separate PAN application assistance service or documents that customers may send through WhatsApp.
Information accessed
- Meta: when an administrator connects Meta, the application receives the granted permissions, the authorizing Meta account ID, available Page IDs and names, Page tasks and Page access tokens, and any linked Instagram Professional account ID and username.
- YouTube: when an administrator connects YouTube, the application uses the granted YouTube upload and read scopes to discover channel IDs and titles and to publish videos to the selected channel.
- Google Business Profile: if Google approves the project and the administrator authorizes the business scope, the application can discover account and location IDs and names, verify the selected location, and publish Local Posts. This feature is not available until the required Google approval and API access are in place.
The application requests access only to support those account discovery, verification and publishing functions. It does not request or process PAN applicant documents, PAN numbers, payment details, or customer application data.
Information stored and use
Server-side records can include OAuth access and refresh tokens, granted scopes, account and location identifiers and names, the selected destination, and connection timestamps. Publishing records can include the scheduled date, topic, channel status, provider post identifiers and links, and error or recovery details. The tool does not request a Google email address or general Google profile data.
Authorization records and publishing records are stored in Netlify Blobs for use by the private dashboard and scheduled functions. Provider client credentials are intended to be configured as Netlify environment variables; the account owner must supply any missing credentials directly in Netlify before provider connections can be used. Netlify documents encryption of Blobs in transit and at rest. Token values are not returned to the browser. No automatic expiry of publishing history is configured; it remains in the Netlify site data until the operator removes it.
Sharing
When publishing is enabled, the selected platform receives the post text and media needed to publish and displays them according to that platform’s settings. Google and Meta process account connections and content under their own terms and privacy notices. Netlify hosts the website, functions and stored records. If the operator configures an external failure-alert webhook, it receives the scheduled date and a failure or recovery summary; the application is designed not to include OAuth tokens or client secrets in those alerts. No advertising profile is created by AutoPost.
Retention, revocation and deletion
An administrator can use Disconnect Meta or Disconnect Google accounts in the protected dashboard. This removes the corresponding locally stored authorization records and attempts to revoke the provider grant. Google revocation applies to all OAuth scopes previously granted to this project, so the Google action removes both YouTube and Business Profile authorization records. If the dashboard cannot confirm provider revocation, the account owner should also remove the app from the provider account’s security or connected-app settings. Disconnecting does not erase publishing history; the site operator must separately remove that history from Netlify Blobs.
Revoking access in a provider account prevents future authorization but does not by itself remove records already stored by this application. For help with AutoPost data, contact Pan Card Centre at 8328177065 on WhatsApp.
Contact and scope
Pan Card Centre operates this private tool for its own social accounts. For questions about this policy or AutoPost data, contact Pan Card Centre through the number above. This policy is specific to AutoPost and does not replace the privacy notices of Google, Meta, Netlify or WhatsApp.