Privacy Policy

This policy explains what personal data JEP GLOBAL LLC (“Neosocios”, “we”, “us”) handles, why, who we share it with, how long we keep it and how you can control it. It applies to:

• our website, neosocios.com;
• the Neosocios Platform at app.neosocios.com, the web app our clients and our team use to work on their marketing, including its connection to Facebook and Instagram;
• our short links on neosoc.io and on the domains our clients connect to the Platform.

Neosocios is a brand of JEP GLOBAL LLC. For any privacy question or request, write to [email protected].

1. Our role

• For our website, our sales conversations and the accounts of people who use the Platform, we decide how the data is used (we are the data controller, or responsable del tratamiento).
• For the data a client business brings into the Platform, such as its connected Facebook and Instagram accounts and its advertising data, we handle it on behalf of that business and only to provide the service it asked for (we are its processor, or encargado). If you are a customer or follower of one of our clients, that business is responsible for your data, and we help it answer your requests.
• The Platform also shows public information of other Instagram professional accounts that a client chooses to study (see section 2). We handle it on behalf of that client. If you run one of those accounts and want your information removed, write to us and we will delete it.

2. The data we collect

When you contact us or talk to us

• Your name, email, phone, company and what you tell us about your business when you fill in the form on our website, write to us or book a call.
• If you agree to it being recorded, a sales or discovery call with our team. Our meeting recording provider keeps the recording and its transcript. In the Platform we keep only your company name, the call title, a link to the recording and an AI-written analysis that may include short quotes from the call, which we use to prepare a proposal for you.

When you use the Platform

Access is by invitation only. We do not offer public sign-up.

• Account data: your name, email, password (stored hashed by our authentication provider; we never see it), language, role, the organizations you belong to, who invited you and when you last signed in.
• Content you create: tasks, comments, ideas, links and other work your team saves in its workspace.
• Business figures you give us: for advertising reports, figures such as your target cost per sale, close rate, fixed costs and weekly sales, and the ad reports you upload. We may send you a single-use link to enter these figures without signing in.
• Problem reports and suggestions you send us: what you write, plus the page you were on and your browser’s type, language and window size, so we can reproduce the problem. Before storing them we automatically remove the passwords and access tokens we can recognize. When we close a report, we email you.
• Records of administrative actions (for example, who invited whom, including the invited email), kept for security.

When you connect Facebook or Instagram

Someone in your organization who can edit the content research tool (administrators always can) connects a Facebook account through Facebook Login. You choose which Pages and Instagram professional account to share, and Meta shows you the permissions we request. Our access is read-only: we can see, but not change anything. The Platform never publishes, edits, deletes or sends anything on Facebook or Instagram, and it never manages ads.

With that connection:

• we read your Facebook user ID and name;
• we read the list of Pages you shared, to find the one linked to an Instagram professional account, and keep only that Page’s ID and name;
• we keep the ID, username, name, profile picture and follower count of that Instagram professional account;
• we keep an access token (the permission Meta gives us to read the account), stored encrypted.

We read nothing else from your account. With that connection, the Platform helps your team research content: it reads public information of other Instagram professional accounts that your team chooses to study, through an official Meta feature called Business Discovery:

• their public profile: username, name, biography, website, profile picture and follower, following and post counts;
• their public Reels: link, caption, publication date, type, thumbnail, video link and the number of views, likes and comments.

We do not read private messages, private profiles, or data of personal (non-professional) Instagram accounts.

Permissions we use and why:

• pages_show_list: to list the Pages you manage so we can find the one linked to Instagram;
• pages_read_engagement and instagram_basic: to read the ID and name of that Page and the basic profile of its Instagram professional account;
• instagram_manage_insights: required by Meta to look up public information of other professional accounts through Business Discovery. We do not read the insights of your account;
• ads_read: to read the reports of the ad accounts a business shares with Neosocios as a partner.

When your business shares an ad account with us

If your business gives Neosocios access to an ad account from Meta’s Business Manager, we read its advertising data, also read-only:

• the names, IDs and status of campaigns, ad sets and ads;
• the performance numbers: spend, impressions, clicks and results;
• the account’s activity log, which includes the names of the people who made changes.

When someone clicks one of our short links

We record the country, the type of device, the page the click came from and whether it looks like a bot. We do not store the IP address: we use it only for a moment to limit abuse. We also store a shortened code derived from the browser’s user agent, used to tell repeated clicks apart.

Technical data

• IP address: our servers and providers use it to deliver the service, protect it and limit excessive requests. Our sign-in system also keeps the IP address and browser of each active session, for security.
• Error reports: when something fails, our error monitoring receives technical details such as the page, the browser and the error. Passwords, tokens, cookies and form contents are removed first.

Cookies and similar technologies

• Website: the website does not use analytics or advertising cookies. It shows the home in your browser’s language; if you pick another language with the language button, a cookie remembers your choice for a year. If you tap a testimonial video, it plays from our video hosting provider, which receives your IP address and browser details to deliver the video and may use cookies or local storage to play it. We ask it not to record viewing statistics. Nothing from that provider loads until you tap.

• Platform: it uses only what it needs to work:

  • your session, your preferences (such as language) and recent work, such as the links you built, stored in your browser;
  • a security cookie that lasts 10 minutes while you connect Facebook.

  The Platform has no advertising or analytics trackers.

• Do Not Track: we do not track you across other websites, and we do not allow third parties to do so. Because we don’t do that kind of tracking, nothing changes when your browser sends a “Do Not Track” signal.

3. How we use the data

• To provide the Platform: show your team its workspace, content research and advertising reports, and keep each organization’s data separate from the others.
• To prepare proposals and deliver the services you hired.
• To communicate with you: invitations, password links, notifications about your work in the Platform and answers to your requests.
• To keep the service secure, prevent abuse and fix errors.
• To comply with our legal obligations.

We do not sell personal data or share it for cross-context behavioral advertising, and we do not use data from Facebook or Instagram to build advertising profiles, to target ads or for any purpose other than providing the Platform to the business that connected it.

When you write to us, book a call, accept an invitation to the Platform or agree to a call being recorded, you authorize us to use your data for the purposes in this policy.

Legal bases (if the EU or UK GDPR applies to you):

• providing the Platform and our services: our contract with your organization, and our and your organization’s legitimate interest in letting its team use the tools;
• preparing proposals and answering you: steps you ask for before a contract, and our legitimate interest;
• recording calls: your consent;
• security, abuse prevention and error monitoring: our legitimate interest;
• invoices and legal duties: our legal obligations.

For data we handle on behalf of a client, the client decides the legal basis.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

4. Artificial intelligence

Some Platform features use an AI provider to write text for our team:

• Advertising reports: the AI receives only total performance numbers and the account’s goal (for example, spend, results and costs for a period). It does not receive the names of people, ads or accounts.
• Sales proposals: the AI receives the transcript of a sales call recorded with consent, the company name and the call title.
• Problem reports: when our team chooses to, a report you sent (its text, the page, and your browser’s type, language and window size) goes to an AI assistant that helps us fix it.

Instagram data is not sent to AI providers. For advertising reports and sales proposals, the AI provider handles the data only to return the result, under terms that do not allow it to use the data to train its models. We do not use your data to train AI models either.

5. Who we share data with

• Your organization: the members of your organization can see its workspace, according to the role and tools your administrator gives them.
• The Neosocios team: the people on our team who work on your account or manage client accounts can see it to deliver our services.
• Service providers who help us run the website and the Platform. We share with them only what each service needs, under written agreements that require them to use the data only on our instructions. They are:
  • cloud hosting and database;
  • user authentication and email delivery;
  • network delivery and security;
  • error monitoring;
  • AI text generation;
  • meeting recording and transcription;
  • video hosting;
  • code hosting and development tools.
• Meta: your browser loads Instagram images and videos directly from Meta’s servers. Meta’s own Privacy Policy applies to what you do on Facebook and Instagram.
• Authorities: when the law requires it, or to protect the rights and safety of people or of Neosocios.
• Business transfers: if JEP GLOBAL LLC is merged or acquired, the data may be transferred under this policy and with the approvals the law and the platforms we use require.

6. Where the data is stored

Our main servers and databases are in the United States. Our network provider delivers the website and short links from locations around the world, near each visitor.

If you use our services from another country, such as Colombia, your data is transferred to and processed in the United States. The United States is among the countries that Colombia’s Superintendencia de Industria y Comercio recognizes as having an adequate level of protection, and our service providers handle the data only on our instructions under written agreements.

7. How long we keep it

• Facebook and Instagram connection: the access token and the connected account details are deleted immediately when someone in your organization disconnects the integration. Access tokens also stop working when they expire or when access is removed from Facebook.
• Content research: the public profiles and Reels your team saved stay in your workspace until your team removes them or you ask us to delete them.
• Advertising data: kept while your business keeps its ad account shared with Neosocios and uses the reports and, after that, until you ask us to delete it.
• Account and workspace data: kept while your organization uses the Platform and, after that, until you ask us to delete it.
• Contact and sales data: kept while we have a commercial relationship or until you ask us to delete it.
• Short-link click statistics: kept while the organization that owns the link uses the Platform, or until it asks us to delete them.
• Records of administrative actions: kept for security. If you ask us to delete your data, we remove your identity from them.

We delete data sooner when it is no longer needed for the purpose we collected it for. Deleted data disappears from our backups when they rotate. We keep something longer only if the law requires it, for example invoices.

8. Your rights and choices

Depending on where you live, for example under Colombia’s Law 1581 of 2012, the European GDPR or US state privacy laws, you can:

• know and access the personal data we have about you, free of charge, and get a copy in a portable format;
• be told, on request, how we have used your data;
• correct it or update it;
• ask us to delete it;
• ask for proof of the authorization you gave us, withdraw it, or object to or restrict a use, including any use based on our legitimate interest;
• file a complaint with your data protection authority. In Colombia, that is the Superintendencia de Industria y Comercio (sic.gov.co), after first making your request to us.

You can also:

• disconnect Facebook and Instagram at any time from the Platform’s integrations page;
• remove Neosocios from your Facebook settings, under Business Integrations, which stops our access immediately.

Giving us your data is not a legal requirement, but we cannot give you access to the Platform without your account data.

How to make a request

Our team handles every privacy request at [email protected]. Your request should include:

• your name and a way to confirm your identity;
• what you want us to do;
• the email where we should answer;
• any document you want us to consider.

Your heirs or a representative can also make a request, with proof of that role. Requests are free.

• To know or get a copy of your data, we answer within 10 business days. If we need more time, we tell you why and answer within 5 more business days.
• To correct, update or delete your data, withdraw your authorization, or file a complaint, we answer within 15 business days from the day after we receive it. If we need more time, we tell you why and answer within 8 more business days. If your request is incomplete, we ask you for what is missing within 5 business days.

The steps to delete data from Facebook and Instagram are on our data deletion page.

9. How we protect the data

• Encrypted connections (HTTPS) for the website and the Platform.
• Access tokens from connected Facebook accounts are encrypted before they are stored, and they are never shown in the app or written to our logs.
• Each organization’s data is separated at the database level: one client cannot see another client’s data.
• Access by invitation only, with roles that limit what each person can see and do.
• Records of administrative actions, and automatic removal of the passwords and tokens we can recognize in error reports.

No system is completely secure. If a security incident affects your personal data, we will notify you and the authorities as the law requires.

To report a security vulnerability in our website or the Platform, write to [email protected] with the subject “Security report”. We review every report and fix confirmed issues promptly.

10. Sensitive data and children

• We do not ask for sensitive data, such as health, biometric, political or religious data. If we ever ask a question about sensitive data, answering it is optional.
• Our website and the Platform are meant for businesses and professionals. They are not directed to people under 18, and we do not knowingly collect their data.

11. Changes to this policy

When we change this policy, we update the date at the top of this page. If the change is important, we also let Platform users know by email or inside the app before it takes effect.

12. Contact and effective date

JEP GLOBAL LLC (Neosocios) Email: [email protected]

This policy takes effect on the date at the top of this page. We keep the databases it covers while we offer our services, for the time described in section 7.

This policy is also available in Spanish.