Privacy Policy

How Sweet Cloud MCP handles information from connected Meta accounts

Last updated: 12 October 2026

1. Who is responsible

SWEETCLOUD D.O.O.
ul. Aleksandra Popovića 1, Beograd (Zemun) 11283, Serbia
Company registration number (MB): 22049950
Tax identification number (PIB): 114637244
Privacy and application contact: kuznetcov@sweetcloud.me

This policy covers Sweet Cloud MCP, an internal application used by authorized SWEETCLOUD D.O.O. personnel to manage the company’s social media and advertising. It also explains how information about people who interact with those accounts may be processed. It does not replace Meta’s own privacy policies or govern unrelated uses of the Sweet Cloud website.

2. What the application does

Sweet Cloud MCP connects authorized operators’ AI client to Meta’s official interfaces. Depending on the accounts connected, permissions granted and features approved by Meta, operators can read business information and statistics, prepare and publish content, moderate comments, handle customer conversations and manage advertising. Facebook, Instagram and, once separately connected, Threads may be used. Listing a feature here does not mean that Meta has approved it or that it is currently enabled.

3. Information we access

• Account and authorization information: account, Page and business identifiers, names, usernames, account settings and permissions, and access credentials needed to operate the connection.
• Content: posts, captions, images or video references, publication dates, links, comments, replies, mentions and information about their authors that Meta makes available through the granted permissions.
• Conversations: messages requested by an authorized operator, conversation and participant identifiers, participant names and timestamps, to the extent available through Meta’s messaging interfaces. People may include contact details or other personal information in their messages.
• Advertising and analytics: advertising account and campaign information, settings, budgets, delivery status and performance statistics such as spend, reach, impressions, clicks and results.
• Information supplied by operators: instructions, draft content, media URLs, proposed campaign changes and replies.
• Technical and request-handling information: API error codes, connection status, and correspondence needed to handle support or privacy requests. The public website’s hosting service may process standard connection information such as IP addresses and access times when these pages are visited.

We access information provided by authorized operators and returned by Meta under the permissions and asset access actually granted. The application does not require people contacting Sweet Cloud to provide their Facebook or Instagram password. Do not send us passwords, access tokens or unnecessary sensitive information.

4. Why we use information

We use this information to maintain Sweet Cloud’s accounts, publish and manage its content, respond to enquiries, moderate discussions, measure performance, administer advertising, secure the integration, resolve technical issues and handle privacy requests. Access is limited to these business purposes and the permissions available for the connected accounts.

Where a legal basis is required, processing is based on our legitimate interests in operating business communications and securing our systems, steps needed to respond to your request or perform a contract, compliance with legal obligations, or consent where required. Granting an application permission in Meta does not replace any consent required for a separate use of personal information.

5. AI clients and recipients

When an authorized operator invokes a tool, the requested result is returned to that operator’s MCP-compatible AI client. This may be OpenAI’s Codex. Consequently, message text, comments or other requested information may be processed by the AI-client provider as part of that session. The provider’s processing and retention depend on the organization’s account settings and applicable service terms. Information already returned to a client is not automatically erased when a local server session ends.

Access is limited to authorized company personnel and service providers needed to deliver the integration, AI-client functionality, hosting, communications or security. Meta processes information under its own terms and policies. We may disclose information where required by law or to protect legal rights and security. We do not sell information obtained through this application. The application does not include a model-training function or a data-brokerage function.

6. Storage and retention

The local MCP server processes API responses in memory and does not maintain a separate persistent archive of retrieved posts or customer conversations. Requested results may nevertheless remain in the authorized AI client’s conversation history, in operator-created reports or in relevant business records.

Access credentials and encrypted rotation backups are stored on the company operator’s Windows computer using protection tied to that Windows account. Credentials are retained while the connection is needed. On disconnecting or deleting the integration, the operator removes current credentials and their local backups and revokes the relevant authorization in Meta.

We retain support and privacy-request correspondence only for as long as necessary to resolve the request and satisfy applicable legal obligations. Operator-created records and AI-client records must be reviewed as part of a deletion request. Where information must be retained for a specific legal reason, we restrict its use and explain the reason where permitted. Meta may independently retain information on its services.

7. Security and international processing

We use encrypted connections to Meta, locally protected credentials and account-scoped tools to reduce unauthorized access. Access credentials are not included in public pages or normal tool results. No system can guarantee absolute security.

Meta, AI-client providers and other necessary providers may process information outside Serbia. Where applicable law requires safeguards for such transfers, those safeguards must be in place before the relevant processing is enabled.

8. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent where processing relies on consent, without affecting processing already lawfully carried out. You may also raise a concern with the competent data-protection authority, including Serbia’s Commissioner for Information of Public Importance and Personal Data Protection where applicable.

Send requests to kuznetcov@sweetcloud.me. Include enough information for us to locate the relevant interaction, such as your public profile link and the approximate date. We may request proportionate verification to prevent disclosure to the wrong person. Do not send passwords, access tokens or identity documents unless specifically required through an appropriate secure process.

See our Data Deletion Instructions for the request procedure. We aim to respond within 30 days, or within any shorter period required by applicable law. If more time is lawfully necessary, we will explain the reason and expected timeframe.

9. Automated actions and children

This is an operator-controlled business tool. It is not intended to make decisions that produce legal or similarly significant effects about an individual. Any future material change to automation or data handling requires a corresponding policy update. The application is not a service directed at children; people should avoid sending unnecessary information about children through business messages.

10. Changes and contact

We will update this page when the application’s processing practices change. The revision date appears above. For questions about this policy or Sweet Cloud MCP, contact kuznetcov@sweetcloud.me.