Privacy Policy

Agency Workspace, Inc. (“Agency Workspace”, “we”, “us”) operates this website and the Agency Workspace application. When an agency connects a client’s social account, the agency is our customer and the Page admin is the person who authorizes LinkedIn.

Privacy questions: contact@agencyworkspace.io.

Agency Workspace connects LinkedIn Company Pages, not a member’s personal profile feed. A Page admin starts the connection from Social → Connections (or from a client connect link). LinkedIn then asks that person to approve access. We only receive LinkedIn data after they approve.

We request these LinkedIn permissions:

• openid, profile, and email — identify the admin who is connecting the Page.
• rw_organization_admin — list Company Pages that admin can administer.
• r_organization_social — read organization content needed to manage the Page.
• w_organization_social — publish posts to the Company Pages the admin selects.

The connecting member must be an Administrator, Content admin, or Direct sponsored content poster on each Page. We do not publish to a personal LinkedIn profile.

What we store from LinkedIn

How we store LinkedIn data

• Access tokens and refresh tokens are encrypted with AES-256-GCM before they are written to our database. The database stores ciphertext. The product interface does not display the raw token.
• While the admin is choosing Company Pages, the member token is held in an encrypted, HTTP-only cookie for at most five minutes. That cookie is cleared after the Pages are saved, or when it expires.
• Each connection belongs to one customer organization. Other customers cannot read it. Inside that organization, only signed-in users with access to social connections can use it.
• We send data to LinkedIn over HTTPS, and only to perform the action the customer asked for: list Pages, publish a scheduled post, check that the connection still works, or read engagement counts for posts we published.
• We do not sell LinkedIn data. We do not rent it. We do not use LinkedIn member or Page data to advertise to those members, to build profiles for unrelated products, or to train public AI models.
• We do not share one customer’s LinkedIn data with another customer.

Who else processes it

LinkedIn receives the content we publish and the API calls we make, under LinkedIn’s own terms. Our cloud hosting and database providers store the encrypted tokens and workspace records so the application can run. They process that data only to host the service. We may disclose information if the law requires it.

How long we keep it

We keep the encrypted tokens, Page name, and Page URN while the Company Page stays connected. Posts the customer created, and the engagement counts we have already saved, stay in that customer’s workspace so their history and reports remain available.

When someone disconnects LinkedIn in Agency Workspace, we ask LinkedIn to revoke the token and we replace the stored tokens with a value that cannot be used to call LinkedIn. The connection is marked revoked. Reconnecting later requires the Page admin to approve access again.

Deleting the customer organization deletes its social connections. To ask us to delete remaining LinkedIn-derived records (Page name, member name, published-post history, or saved engagement counts), email contact@agencyworkspace.io. We will delete them unless we must keep a record to meet a legal obligation.

How to stop access

• In Agency Workspace, open Social → Connections and disconnect LinkedIn.
• In LinkedIn, open Permitted services and remove Agency Workspace. That stops our ability to call LinkedIn with the old token. Email us if you also want the stored records deleted.

Account data. If you create an Agency Workspace account, we store your name, email address, password hash, and organization membership so you can sign in and so we can tell your workspace from other customers.

Content you add. Projects, captions, media you upload, comments, and approvals stay in your organization so your team can do the work.

Other social networks. If you connect Facebook, Instagram, YouTube, TikTok, or X, we store the same kind of record as LinkedIn: account name, account id, and an encrypted token, used only to publish and report for that account.

Billing. If you subscribe, our payment processor collects card details. We store the subscription status and a customer reference. We do not store full card numbers.

Technical logs. Servers record IP address, browser type, and error messages so we can keep the service secure and fix failures. We do not use those logs to sell data.

• Provide the workspace you signed up for, including publishing and analytics.
• Authenticate you and keep one customer’s data separate from another’s.
• Send operational email, such as invitations and password resets.
• Protect the service against abuse and debug failures.
• Meet legal duties.

We do not sell personal information. We do not share it with data brokers.

Social tokens are encrypted at rest. Sessions and the short-lived LinkedIn connect cookie are HTTP-only. Production traffic is served over HTTPS. Access to a customer’s workspace requires a signed-in user of that organization. No method of storage is perfect. If we learn of a breach that affects LinkedIn tokens or personal data, we will notify affected customers and, where required, regulators.

Agency Workspace is a business product. We do not direct it at children under 16, and we do not knowingly collect their personal information.

If we change how we store LinkedIn data, we will update this page and the effective date above. Continued use of a connected Page after the change means the updated policy applies to that connection. If a change is material, we will also notify workspace admins by email when we have an address for them.

Agency Workspace, Inc.
Email: contact@agencyworkspace.io

Include the Company Page name and the workspace email if you want access revoked or LinkedIn records deleted.