Privacy Policy

Last updated: 5 September 2026

This policy describes how Abraham González Madrid, trading as Chocola Studio (“we”), processes personal data through Chocola Feeds at feeds.chocolastudio.com (the “Service”), including Instagram Login / Meta Platforms.

1. Controller

Controller:
Abraham González Madrid
Tax ID (NIF): 44992498J
Address: Carrer Estrella, 13, 08201 Sabadell, Barcelona, Spain
Trade name: Chocola Studio
Website: https://chocola.studio
Privacy contact: info@chocolastudio.com

2. What Chocola Feeds is

Chocola Feeds is a multi-site hub that lets websites operated by Chocola Studio display recent posts from an Instagram Professional account (Business or Creator) after the account holder authorizes the app.

We request only the Meta permission instagram_business_basic: read profile and media. We do not publish content, manage comments, or send messages on the user’s behalf.

3. Data we process

3.1 Hub administration

• Admin panel credentials (username and hashed password) for operators authorized by Chocola Studio.
• Site metadata (name, domain, site_key, status, post limit).

3.2 Data obtained via Instagram / Meta

After the Instagram Professional account holder consents:

• Instagram user ID and username.
• Access token (stored securely on our server) used to read the feed.
• Post metadata (id, type, permalink, date).
• Images / thumbnails cached on our servers so the client website can load the feed reliably.

3.3 Technical data

• Limited server logs (IP, user-agent, date) for API, OAuth, and Meta callbacks.
• Logs of deauthorize and data-deletion callbacks sent by Meta.

4. Purposes and legal bases

• Provide the Service (sync and serve the feed on the client website): contract / pre-contractual steps with the Chocola Studio client, and the Instagram account holder’s consent when authorizing the app.
• Security and audit (logs, abuse prevention): legitimate interest.
• Legal obligations and Meta / authority requests: legal obligation.

5. Recipients

• Meta Platforms Ireland Ltd. / Meta Platforms, Inc. — Instagram Login and Graph API.
• Hosting provider for feeds.chocolastudio.com.
• Client websites receive the public JSON feed and cached images; they never receive the Instagram token.

We do not sell personal data.

6. Retention

• Instagram tokens and connection data: while the site is connected, or until deauthorize / deletion.
• Media cache: refreshed or cleared on sync, disconnect, or request.
• Technical logs: limited retention unless needed for security or law.

7. How to disconnect and delete data

1. From the hub: an operator can disconnect Instagram on the site (stops using the token in the Service).
2. From Instagram: Settings → Apps and websites → remove Chocola Feeds. Meta notifies our deauthorize endpoint.
3. Meta data-deletion callback: https://feeds.chocolastudio.com/meta/data-deletion. We process the request and provide a status URL with a confirmation code.
4. Direct request: info@chocolastudio.com with the Instagram account or affected site.

8. International transfers

Meta may process data outside the EEA using Standard Contractual Clauses or other recognized mechanisms. Hosting location is available on request.

9. Security

We use HTTPS, restricted admin access, application secrets kept off public repositories, and we never expose Instagram tokens on the public feed API.

10. Rights (GDPR)

You may request access, rectification, erasure, restriction, objection, and portability where applicable by writing to info@chocolastudio.com. You may also complain to the Spanish Data Protection Agency (aepd.es).

11. Children

The Service is for professionals and businesses. It is not intended for anyone under 16.

12. Changes

We may update this policy. The “Last updated” date will reflect the change.