Privacy Policy
Last Updated: October 2026 • Official Legal Policy for Lomi (by Lomi Solutions)
https://uselomi.com/privacy
https://uselomi.com/data-deletion
1. Overview & Commitment
Lomi (“we”, “our”, or “us”) is an enterprise-grade social media management, unified cross-platform scheduling, and audience voting SaaS platform operated by Lomi Solutions (Legal Business Name: Lomi Solutions) at https://uselomi.com.
We are strictly committed to user privacy, rigorous data governance, and complete tenant isolation. We believe your social media presence, audience insights, and credentials belong exclusively to you. We do not sell, rent, monetize, or trade your personal data, connected social profile tokens, or analytics to third-party data brokers or advertising networks.
2. Information We Collect
We collect and process only the minimum necessary data required to provide content publishing, workflow automation, and campaign voting features:
A. Workspace & User Credentials
Your registered email address, name, workspace identification token, and authorization state during sign-in.
B. Connected Social Media Accounts & Tokens
Public profile information (username, display name, user ID, profile image URL) and OAuth 2.0 / OAuth 1.0a access tokens returned by connected social platforms (Facebook, Instagram, Threads, X/Twitter, LinkedIn, YouTube, TikTok).
C. Scheduled Content & Media Assets
Text copy, tags, scheduled publication timestamps, media URLs, and platform-specific publication options created by you in the Composer.
D. Audience Voting & Contest Security Fingerprinting
To prevent vote manipulation and enforce one-vote-per-device rules on public voting campaigns, we compute a one-way SHA-256 cryptographic hash derived from client headers. We do not store plaintext voter IP addresses.
3. Meta (Facebook, Instagram & Threads) Platform Disclosures
Lomi complies fully with the Meta Platform Terms and Developer Policies. When you connect a Facebook Page, Instagram Professional account, or Threads account:
- Requested Scopes: We request only authorized permissions necessary to fulfill your publishing instructions:
pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish, threads_basic, threads_content_publish - Page & Profile Management: We access the list of Facebook Pages you administer solely to allow you to select which Pages you want to broadcast content to.
- Publishing Posts: When you schedule or publish a post, our backend submits your message and attached media URL directly to Meta's Graph API endpoints (
graph.facebook.com). - No Unauthorized Surveillance: We do NOT read your private messages (DMs), personal timeline posts, or friend lists.
- No Sharing or Sale of Meta Data: Meta user data and page tokens are never transferred to third-party data aggregators, advertising brokers, or unauthorized external services.
4. Military-Grade Token Security & Encryption
Security is foundational to Lomi. All customer OAuth access tokens, refresh tokens, and platform client secrets are secured on the server using AES-256-GCM authenticated encryption with random initialization vectors (IVs):
- Plaintext access tokens are never transmitted to client browsers or exposed in client bundles.
- Tokens are decrypted strictly in ephemeral memory at the precise moment a scheduled publish job executes.
- Encrypted payloads in our database are isolated per workspace tenant, preventing cross-tenant access.
5. Data Retention & Lifecycle
We retain customer data according to the following strict lifecycle policies:
Retained strictly while the account remains connected. Immediately wiped upon disconnection.
Retained until publication or until manually deleted by the user in the dashboard.
Retained for 90 days for audit and retry purposes, after which logs are automatically rolled and purged.
Kept for the active duration of the voting campaign plus 30 days post-conclusion.
6. Facebook & Meta User Data Deletion Instructions
In accordance with Meta Platform Terms and Facebook Login policies, you have complete control over your data. You may delete all data and credentials associated with your Facebook, Instagram, or Threads account through any of the following three methods:
Navigate to your Connected Accounts Page in the Lomi dashboard. Find your Facebook Page or Instagram channel and click Disconnect. This action immediately deletes your access tokens, profile records, and cached metadata from our active database.
- Log in to your Facebook profile and navigate to Settings & Privacy > Settings.
- Click on Apps and Websites in the left sidebar menu.
- Locate Lomi in your list of authorized applications.
- Click Remove to revoke all access permissions.
- (Optional) Check the box to remove all posts, videos, or events published on your behalf, and click Remove.
If you wish to ensure complete erasure of all audit logs, backup references, and workspace records, submit an email to our Data Protection Officer at:
You can also visit our dedicated User Data Deletion Instructions Page for further details and deletion tracking.
7. Your Legal Rights (GDPR & CCPA)
Regardless of your geographic location, Lomi provides all users with comprehensive data rights:
- Right of Access: Request a complete export of personal information stored about your workspace.
- Right to Rectification: Update or correct inaccurate social account metadata at any time.
- Right to Erasure (Right to be Forgotten): Permanently delete all account data and publishing records.
- Right to Restrict Processing: Pause automated publishing jobs and schedule queues.
8. Contact Information & Data Protection Officer
If you have any questions, regulatory inquiries, or privacy concerns regarding this policy, please reach out to our legal and data protection team: