Privacy

Controller and contact

Central Fox Tecnologia LTDA — CNPJ 66.678.057/0001-52. Institutional privacy contact: [email protected], as documented in the existing Central Fox policy. Receipt and resolution of FoxCMS-specific requests have not been tested in this audit.

What FoxCMS is

FoxCMS is a web application for organizing workspaces, teams, social accounts, and publications. Each workspace has its own plan, status, members, and roles.

Observed data

• Registration: username, email address, and password handled by the authentication module's password type, which stores a hash rather than password text.
• Session: JWT held in an HTTP-only cookie for up to 30 days, with SameSite=Lax and Secure in production.
• Workspace: name, plan, status, members, roles, and invitation or joining dates.
• Social accounts: platform, handle, account reference, status, and access token stored as a private encrypted backend field.
• Content: text, public media URL, scheduled date, requested action, publication status, and results for each destination account.
• Operations: workspace action audit records available in the backend.

How the data is used

• Authenticate the account and enforce workspace access.
• Connect Facebook Pages and professional Instagram accounts through Meta OAuth.
• Create drafts, schedule, and run authorized publications.
• Apply the member limit observed in the backend and display the plan catalog. Enforcement of account and post limits was not confirmed.
• Record states and failures needed to operate and diagnose the service.

Meta and other providers

The Meta connection redirects the user to the official authorization flow and uses the Graph API to list accounts and publish when requested. Meta’s own policy governs Meta’s processing. The inspected code did not confirm an operational AI provider or an operational WhatsApp approval flow, so this document does not claim that content is sent to those services.

• Meta Privacy Policy: https://www.facebook.com/privacy/policy/
• Meta Platform Terms: https://developers.facebook.com/terms/

Retention, cookies, and security

The snapshot confirms membership-based access control, password hashing by the authentication module, a private encrypted social token, and logical workspace separation. The session uses an HTTP-only cookie for up to 30 days with Secure in production and SameSite=Lax. Meta OAuth uses an HTTP-only state cookie for up to 10 minutes with the same production attributes. The browser stores the theme preference in localStorage. No other cookie use was confirmed; this is not a complete inventory. The snapshot does not define verifiable retention or backup periods and does not support a promise of absolute security.

Choices and requests

Users can revoke FoxCMS access in Meta settings. Revocation prevents further token use but does not replace a request to delete data already held by FoxCMS. See Data deletion for the candidate procedure and its current limits.