Data Deletion — Wiam.ai

Effective date: [to be filled before launch]

Last updated: [to be filled before launch]

Wiam.ai respects your right to control your data. This page explains how to permanently delete:

• Your Wiam.ai account and all associated data
• Data Wiam.ai obtained from Meta (Facebook, Instagram) on your behalf
• Data Wiam.ai obtained from TikTok on your behalf

1. How to Delete Your Data

Option A — Self-service via the dashboard (fastest)

1. Log in to https://app.wiam.ai
2. Go to Settings → Account → Danger zone
3. Click Delete my account
4. Confirm by typing your business name
5. Click Permanently delete

Your account is queued for deletion immediately. All personal data is purged within 30 days.

Option B — Email request

If you cannot access your account, email privacy@wiam.ai with:

• The email address associated with the account
• A confirmation that you want all data permanently deleted

We respond within 5 business days and complete deletion within 30 days.

Option C — Automated Meta Data Deletion (Meta Platform requirement)

Meta requires a callback endpoint that allows Meta users to request deletion of data Wiam holds about them, including data acquired through the Instagram Graph API.

Endpoint URL: https://wiam.ai/data-deletion-callback

Method: POST

Expected payload (signed_request): Per Meta specification at https://developers.facebook.com/docs/development/create-an-app/app-dashboard/data-deletion-callback

When triggered, this endpoint:

1. Validates the signed_request from Meta
2. Identifies all Wiam accounts linked to that Meta user_id
3. Queues deletion of all associated data within 30 days
4. Returns to Meta a unique confirmation_code and a status URL where the user can track deletion

Status URL format: https://wiam.ai/data-deletion-status?code={confirmation_code}

Option D — TikTok user deletion

TikTok users who connected their account to Wiam.ai can revoke access at:

https://www.tiktok.com/setting/connected-apps

When revocation is detected by Wiam (via TikTok webhooks or token failures), we automatically:

1. Mark the connection as revoked in our system
2. Stop all scheduled publications for that account
3. Delete TikTok-specific tokens immediately
4. Delete all TikTok-derived data (insights, comments) within 30 days

2. What Gets Deleted

After full purge, only anonymized aggregate metrics (no PII, no business identity) remain for product analytics.

3. What CANNOT Be Deleted

• Content already published to Instagram or TikTok belongs to your social account on those platforms. You must delete it directly from the Instagram/TikTok apps. Wiam.ai does not retain the ability to delete posts on your behalf after disconnection.
• Stripe billing records are retained as required by tax law (typically 7 years), with PII minimized.
• Audit and security logs are retained for 90 days for fraud investigation and legal compliance.

4. Confirmation

Once deletion is complete, we send a confirmation email to the address associated with the account. If the deletion was triggered via the Meta callback, we expose the status at the URL returned to Meta.

5. Questions

If you have questions about data deletion, contact:

• Email: privacy@wiam.ai
• Postal: Rocket Science Development, [TO BE FILLED — address]

You also have the right to lodge a complaint with your local data protection authority (CAI Quebec, CNIL France, ICO UK, etc.).

Annex — Technical Specification for Developers

This section is informational and describes the implementation of the Meta Data Deletion Callback for compliance reviewers.

Endpoint

POST https://wiam.ai/data-deletion-callback
Content-Type: application/x-www-form-urlencoded

signed_request=<encoded_signed_request>

Validation

The signed_request is parsed and validated using the Meta App Secret as per:

https://developers.facebook.com/docs/games/gamesonfacebook/login#parsingsr

Response

{
  "url": "https://wiam.ai/data-deletion-status?code=ABC123XYZ",
  "confirmation_code": "ABC123XYZ"
}

Status endpoint

GET https://wiam.ai/data-deletion-status?code={confirmation_code}

Returns a human-readable page with one of:
"Deletion in progress"
"Deletion complete on YYYY-MM-DD"
"Deletion request not found"

Internal flow

1. Decode signed_request → extract user_id (Meta App-scoped ID)
2. Lookup social_accounts WHERE platform='instagram' AND platform_meta_user_id=user_id
3. For each matching account → enqueue Kafka event tenant.data_deletion_requested
4. Worker performs cascade delete on all related records within 30 days
5. Update data_deletion_requests table with status
6. Send confirmation email to tenant owner