ILN Marketing

[Legal · 01]

Privacy Policy

Last updated: May 19, 2026

1. Who we are

ILN Marketing is operated by International Legal Network (ILN), a company registered in Costa Rica. This policy describes how we collect, use, and protect the personal data of those who use the platform or authorize the connection of their social media accounts through us.

2. Data we collect

2.1 Data you give us directly

  • First and last name, email address, phone number.
  • Company information (name, business registration, address).
  • Content you upload to the ERP (posts, images, copy, campaigns).

2.2 Data we collect via Meta (Facebook, Instagram, Threads)

When you authorize the ERP to connect with your Meta account, we receive only the information strictly necessary to publish and read metrics for your posts:

  • Basic identity: your public Facebook name and associated email.
  • Pages you administer: ID, name, photo, and permissions of each Facebook Page you manage.
  • Instagram Business account: ID and username of the IG account linked to your Page.
  • Threads profile: ID and handle of the Threads profile linked to your Instagram.
  • Ad accounts: ID and name of the Meta Business ad accounts you administer (only if you enable advertising).
  • Access tokens: temporary credentials Meta issues so the ERP can publish on your behalf. These tokens are encrypted with AES-256-GCM before storage and are never exposed to the frontend.

2.3 Data we collect via TikTok

When you authorize the ERP to connect with your TikTok account, we receive only the information strictly necessary to upload and publish videos on your behalf:

  • Basic identity: your public TikTok username and avatar (via user.info.basic).
  • Access tokens: temporary credentials TikTok issues so the ERP can upload and publish videos on your behalf (video.publish / video.upload). These tokens are encrypted with AES-256-GCM before storage and are never exposed to the frontend.

We do not access your private videos, direct messages, follower list, or any activity beyond the content you create and publish from the ERP.

2.4 Data we do NOT collect

  • We do not access your friends list.
  • We do not read your private messages.
  • We do not access content from pages you do not administer.
  • We do not sell or share your data with third parties for commercial purposes.

3. How we use your data

  • Publish content you explicitly create and approve in the ERP.
  • Read metrics (impressions, reach, clicks, reactions) for posts we made on your behalf.
  • Create and manage advertising campaigns you configure in the ERP.
  • Notify you about the status of your posts and campaigns.
  • Maintain an auditable record of who published what and when, for compliance.

4. How we protect your data

  • Encryption in transit: all communications use HTTPS / TLS 1.2+.
  • Encryption at rest: Meta tokens and sensitive data are encrypted with AES-256-GCM before being persisted in the database.
  • Multi-tenant isolation: each company's data is isolated by company_id and verified on every query.
  • Restricted access: only authorized ILN technical personnel can access the infrastructure, with audit logging.

5. Retention

We retain your data while your account is active. Meta tokens are automatically invalidated when:

  • You manually disconnect your account from Marketing → Social Networks in the ERP.
  • You revoke access from Facebook → Settings → Apps and Websites.
  • You close your ERP account.

In all cases above, tokens and data associated with your connection are deleted within 7 days. Aggregated data without personally identifiable information may be retained for accounting requirements (minimum 4 years in Costa Rica).

6. Your rights

Under Costa Rica's Law 8968 and Meta's regulations you are entitled to:

  • Access: request a copy of the data we hold about you.
  • Rectification: correct inaccurate data.
  • Deletion: ask us to delete your data. See Data Deletion Instructions.
  • Portability: receive your data in a structured format and migrate it to another platform.
  • Objection: object to specific uses of your data.

7. Sharing with Meta

When we publish content on your behalf, we send back to Meta:

  • The text, image, or video you created.
  • The identifier of the Page or account where it is published (which you selected).
  • The access token you authorized.

Meta processes this data according to its own privacy policy: facebook.com/privacy/policy.

8. Changes to this policy

If we update this policy, we will notify you by email at least 7 days before the change. If you continue to use the ERP after that date, you accept the updated version.

9. Contact

Questions about privacy? Write to soporte@iln.law.

For regulatory complaints in Costa Rica: PRODHAB (Personal Data Protection Agency).