Privacy Policy

Account Information

When you register, we collect:

• First and last name
• Email address
• Mobile phone number
• Dental office name and address
• IP address (captured at registration for eligibility verification)
• Password (stored as a secure one-way hash — never stored in plain text)

Instagram / Meta Account Data

If you choose to connect your Instagram account, we collect and store the following data obtained through the Meta (Facebook) Graph API:

• Instagram User ID — a numeric identifier assigned by Instagram to your business account
• Access Token — a credential that authorizes our Platform to act on your behalf (publish posts to your Instagram account at your direction)
• Token Expiration Date — used to refresh your access token before it expires so scheduled posts continue to work without interruption

We do not collect your Instagram username, followers, direct messages, story content, personal photos, or any other Instagram data beyond what is listed above.

Content and Usage Data

• Media files you upload or import (stored in AWS S3)
• Scheduled post details (content item, caption, scheduled date/time, publish status)
• Download history
• Platform activity logs

• Account management — to create and maintain your account, verify your eligibility as a pediatric dental office, and authenticate your identity.
• Instagram publishing — to publish content to your connected Instagram Business account on your behalf, at the date and time you schedule. We only post when you explicitly schedule a post through the Platform.
• Token maintenance — to automatically refresh your Instagram access token before it expires so that your scheduled posts are not disrupted.
• Platform integrity — to enforce daily download limits, detect abuse, and verify that users are affiliated with legitimate pediatric dental practices.
• Communications — to send password reset emails and important account notifications. We do not send marketing emails.

We do not sell, rent, or trade your personal information. We share data only in these limited circumstances:

• Meta / Instagram (Graph API) — when you schedule a post, we send the content URL and caption to the Instagram Graph API using your access token to publish the post on your behalf.
• AWS (Amazon Web Services) — media files are stored in AWS S3. AWS processes data under our instructions and does not use your data for its own purposes.
• Legal requirements — we may disclose information if required by law, court order, or to protect the rights and safety of the Platform and its users.

• Account data — retained for as long as your account is active. If your account is terminated, we delete or anonymize your personal information within 90 days.
• Instagram access token and User ID— retained only while your Instagram account is connected to the Platform. Disconnecting your Instagram account (via the “Disconnect Instagram” button in your account) immediately removes your access token and Instagram User ID from our database.
• Scheduled post records — retained for 12 months after the scheduled date for audit and troubleshooting purposes, then permanently deleted.
• Uploaded media — retained until the content is deleted by an administrator or upon account termination.

You can revoke our access to your Instagram account at any time in two ways:

1. From the Platform — go to your Scheduled Posts page or the Instagram Import page and click “Disconnect Instagram.” This immediately deletes your Instagram User ID and access token from our database.
2. From Instagram— go to your Instagram account settings → Apps and Websites → find “Little Smiles Media” → click Remove. This revokes our access token. Any remaining token data in our system will be purged within 30 days.

To request complete deletion of all your data from our systems, email us at contact@littlesmilesmedia.com with the subject line “Data Deletion Request.” We will process your request within 30 days.

• All data is transmitted over HTTPS (TLS encryption).
• Passwords are hashed using industry-standard algorithms and never stored in plain text.
• Instagram access tokens are stored in an encrypted database with access controls.
• AWS S3 media files are stored in a private bucket accessible only through time-limited signed URLs.
• We do not log or display Instagram access tokens in application logs or user interfaces.

We use a single session cookie (HttpOnly, Secure) to maintain your login state. We do not use advertising cookies, third-party tracking pixels, or analytics services that profile individual users. We do not use cookies to track your activity outside of the Platform.

The Platform is intended for use by adult professionals at pediatric dental offices. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us and we will promptly delete it.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — request deletion of your personal data (see Section 5).
• Portability — request your data in a structured, machine-readable format.
• Withdraw consent — disconnect your Instagram account at any time without affecting your ability to use the rest of the Platform.

To exercise any of these rights, contact us at contact@littlesmilesmedia.com.

The Platform integrates with the following third-party services. Their use of your data is governed by their own privacy policies:

• Meta (Facebook / Instagram) — Meta Privacy Policy
• Amazon Web Services (S3) — AWS Privacy Notice
• Vercel (hosting) — Vercel Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Effective Date” at the top of this page. Continued use of the Platform after changes are posted constitutes your acceptance of the updated policy. For significant changes, we will notify registered users by email.

If you have questions, concerns, or requests related to this Privacy Policy, please contact us: