Alwin Lubbers Software offers an app for Servonnect to share content to platforms of Meta Platforms, Inc.. If you set up any of the connections, like Facebook, Instagram or WhatsApp, with your Servconnect installation, you agree to this privacy policy and the privacy policy of the respective platform.
For more information about how these platforms handle your data, please refer to the following documents:
Handling Secrets and Tokens
Because all of the Meta Platforms use sensitive 'Secrets', such as the 'app secret', which may give someone complete access to your data, we store those 'Secrets' on a centralized server managed by Alwin Lubbers Software. This service is called 'Servconnect Live'.
Meta Platforms generally use two types of 'secrets':
- App Secret: Used by Meta to authenticate that the request is comming from the Servconnect app, used by Meta Connections.
- Access Token: Used by Meta to authenticate a specific user or page, tied to the 'App Secret'.
The 'Access Token' will always be stored on your own server, running the Servconnect installation.
If we placed the 'App Secret' on your own server running your Servconnect installation, one badly secured server may not only affect your Meta account(s), but the account(s) of all Servconnect users.
This is why we opted to build a 'Relay'. This 'Relay' will accept certain Facebook API endpoints, attach the 'App Secret' to the original request, and send it on to the correct Meta API. Every request the 'Meta Connections app' makes, will go through 'Servconnect Live'. This way, no one server ever has the ability to access your Meta account(s) without the other server: 'Servconnect Live' can authenticate as the app, but not as you, and your server can authenticate as you, but not as the app. No one server every holds all the 'Secrets' needed to access your Meta account(s).
The 'Servconnect Live Relay' will only allow a certain amount of API endpoints to go through. Which means that it's not possible to access or call endpoints which are not allowed by 'Servconnect Live'. Only the endpoints which are absolutely needed for the 'Meta Connections app' to function are allowed.
Data Collection in Servconnect
Servconnect is a 'self-hosted' system, which means that you host the Servconnect platform on your own server. Everything you see, which is presented by the Meta Connections app, is handled by your own server, up until you 'Post' or 'Share' something with a Meta Platform, by clicking on 'Post' or 'Share' in the 'Meta Connections app'.
Alwin Lubbers Software, hosting the 'Servconnect Live Relay' service, does not log or store any of the data that gets sent through the 'Servconnect Live Relay'. However, if a fatal error occurs, caused by the 'Meta Connections app', your Servconnect installation may still send some data related to your Meta accounts to Alwin Lubbers Software if you have enabled 'Send diagnostic information to Servconnect' under 'Settings' > 'Analytics & Diagnostics' > 'Help To Improve Servconnect'. This is a single toggle, which is off by default.
'Servconnect Live' will always collect the follwing information from each request:
- IP Address: The IP address of the client making the request.
- URL: The URL (link) that the client requested.
- User Agent: A simple text string identifying your Servconnect installation.
- Servconnect installation UUID: A text string, consisting of an UUID, identifying your Servconnect installation.
- Servconnect installation Secret: A text string, used to authenticate that the request is really coming from the Servconnect installation given by the 'Servconnect installation UUID'.
- Servconnect installation Version: A text string, identifying the version of your Servconnect installation.
This information is used to check if you have a valid license for Servconnect. Only activated Servconnect installations are allowed to use 'Servconnect' and 'Servconnect Live'.
What 'Servconnect Live' does not collect:
- Facebook Page ID: The ID of the Facebook page you want to share to or get information about.
- Access Token: Used by Meta to authenticate a specific user or page, tied to the 'App Secret'.
- Uploaded Media: Data, like media, you want to forward to the Meta API(s).
- Other data in the request body: Including all Meta API related data.