Privacy

This statement covers iov.agency and the I.O.V Social Operator: an internal studio instrument, used by the founder only, that publishes text posts to his own LinkedIn account after an explicit, reviewed instruction.

The Social Operator is not a public product. It has no sign-up, no multi-tenant accounts and no audience-facing surface.

Reading the site requires no account. Enquiries sent through the contact form are delivered to the studio inbox and are not stored in a database.

The studio records coarse, non-identifying interaction events — a path, a viewport class, a device class — to understand which work is read. No advertising trackers, no cross-site profiles, no sale of data.

Cookies are used only where a function requires them, for example the short-lived, HttpOnly cookie that protects a LinkedIn authorization request against cross-site forgery.

Connecting LinkedIn uses LinkedIn's own OAuth flow. The studio never sees, receives or stores a LinkedIn password: authentication happens entirely on LinkedIn.

The scopes requested are exactly openid, profile, email and w_member_social — enough to confirm which member authorized the connection and to publish on that member's behalf.

What is stored: the LinkedIn member identifier, the display name and email returned by LinkedIn's userinfo endpoint, the granted scopes, the token expiry and the access token itself, encrypted at rest.

The access token is held server-side only. It is never returned to the browser, never placed in a URL and never exposed to any frontend code or third party.

A post is created only after the operator writes it, reviews it and confirms the publish action in the interface. There is no scheduler, no autonomous agent and no background posting in this version.

For each publish attempt the studio keeps a minimal audit record: the time, the LinkedIn post identifier, the status and the authoring account identifier. No engagement analytics are collected.

Third-party processors may include LinkedIn (authorization and publishing), the studio's hosting and database provider, and the transactional email provider used to deliver contact enquiries. Each processes data only to provide the function described here.

Connection data is kept only while the connection is active. Disconnecting deletes the stored token, the account metadata and the connection record from the studio's database immediately.

LinkedIn does not offer a self-service token-revocation endpoint to this application, so disconnecting removes the studio's credentials. Authorization can additionally be withdrawn at any time from LinkedIn's own permitted-services settings.

Audit records are kept as a short operational history and can be deleted on request. Contact enquiries live in the studio inbox and are deleted when they are no longer needed.

You may request access to the data the studio holds about you, its correction or its deletion, and you may object to processing. Requests are answered by a person, not a queue.

Because the Social Operator handles only the founder's own LinkedIn account, no third-party member data is collected through it.

Credentials live in a managed secret store, never in source code. Access tokens are encrypted before they are written and decrypted only inside the server function that publishes a post.

The tables holding connection and audit data are reachable only by trusted server-side code; they carry no browser-accessible access at all.