Privacy policy for OSNP's Meta connection

Last updated: 28 August 2026

This page covers one specific thing: the software we run against Facebook and Instagram, and what it does with data about you. Our general privacy policy at www.opnsrc.nu/policies/privacy-policy covers everything else we do, including the advertising pixel on this website, and it applies here too.

Controller: Magic beans spletna trgovina d.o.o., trading as Magic beans d.o.o., brand OSNP (Open Source Nutrition Project), Kongresni trg 8, 1000 Ljubljana, Slovenia. VAT ID SI52473929. Email hq@opnsrc.nu.

What this is

We run a small, private application on Meta's platform, registered under the name "OSNP Social OS". It has no users other than us. It exists so that our own systems can read and manage the accounts we own: the OSNP Facebook Page, the Instagram account @osnp.eu, the OSNP advertising account, and the product catalog that feeds our shop tags. Nothing about it is a product you can install, log into, or be signed up for.

Whose data it touches

Yours, if you comment on one of our posts, reply to one, react to one, tag us, or send a message to our Page or Instagram account. Everyone else on Facebook and Instagram is out of reach: the application can only see what happens on our own accounts and what Meta shows to any Page owner.

What it reads

  • Our own posts, their captions, media, timestamps and links.
  • Engagement figures on those posts: reach, likes, saves, shares, comment counts, follower counts. These are aggregate numbers, and Meta strips them of names before we see them.
  • The comments people leave on our posts, with the commenter's public username and the text. This is the one place the application handles something written by an identifiable person.
  • Messages sent to our Page or Instagram inbox, if we use the application to read them. Today we read them by hand in Meta's own apps; if the application starts reading them, this page changes first.
  • Advertising performance for our own ad account: spend, impressions, clicks, conversions. Aggregate only; we never receive a list of who saw or clicked an ad.
  • Our own product catalog, which contains product data and no personal data at all.

What it does with that

We read comments to know what people are asking and to answer them. A reply posted from our accounts is written or approved by a person at OSNP before it goes up; nothing is auto-posted in response to you. Engagement and ad figures tell us which posts were worth making and which ads were worth paying for.

One thing to say plainly: we use AI tools to help us read what comes in and draft what goes out, so comment text and message text may be processed by Anthropic (the maker of Claude), under its API terms, which do not allow it to train on that data. A person still decides what is published.

What it does not do

  • It does not follow, like, message, or comment automatically. There is no bot behind our accounts.
  • It does not scrape, collect or store data about anyone who has not interacted with our accounts.
  • It does not build audiences or advertising targets from your comments or messages. Ad targeting runs through Meta's own tools and the website pixel described in our general policy, and never from what you wrote to us.
  • It does not sell, rent or pass your data to anyone. The only third party that ever sees comment or message text is the AI provider named above, as our processor.
  • It does not touch the data Meta holds about you beyond what any Page owner can see. Meta's own privacy policy governs everything on Meta's side.

Permissions versus practice

Meta grants the application a long list of technical permissions, forty-three at the time of writing, covering publishing, comments, insights, messaging, advertising, catalog and WhatsApp. That is how Meta's business tooling is packaged, and it is wider than what we do. The sections above describe what the application actually does. If we start using a permission in a way this page does not describe, we update this page before we do it.

Where the data lives and for how long

Everything the application retrieves is stored on computers we control, in Slovenia. It is not uploaded to a public server and it is never published. Copies of comments and messages are kept for as long as the post they belong to is live and at most twelve months after, then deleted. Aggregate figures with no names in them we keep as long as they are useful. Access credentials for the application are held in a restricted local file and are not shared with anyone.

Legal basis: our legitimate interest in running our own social-media accounts and answering the people who write to us, Art. 6(1)(f) GDPR. You can object at any time by writing to us, and deleting your comment or message on Meta's side removes it from what the application can see going forward.

Your rights and how to reach us

You have the same rights over this data as under our general privacy policy: access, correction, erasure, restriction, objection, and a complaint to the Informacijski pooblaščenec (ip-rs.si) if you think we have got it wrong. Write to hq@opnsrc.nu; we answer within a month. If you want a local copy of your comment or message deleted, say so and it is gone the same day; we cannot delete it from Facebook or Instagram themselves, only you can.

Changes

If this page changes, the date at the top changes with it, and the change is logged in our public changelog.