Effective date: 2026-10-21
This policy explains how Exact Studios (“Exact Studios”, “we”, “us”), of 101 Old Hall St, Liverpool, L3 9PP, UK, handles personal data in connection with Exact Social (the WordPress plugin, the Exact Social Pro add-on, and the Exact Social connect service at connect.exactwp.com) and the website exactwp.com.
Contact: info@exactwp.com
1. How Exact Social works
Exact Social is a plugin you install on your own WordPress site. The plugin runs on your site, and the data it manages stays in your site’s database, under your control. That includes your posts, schedules, team members, analytics and the access tokens for your connected social accounts. We don’t receive or store that data. Your site sends posts to social networks and reads their statistics directly.
For the data stored on your site, the site’s owner is the data controller. We’re the controller only for the limited data described below.
2. The connect service (connect.exactwp.com)
Social networks such as Facebook, Instagram and Threads only let an app connect accounts through addresses the app has registered. So when you connect an account using Exact Social’s own app (the default), the connection passes through our connect service. If you use your own developer app instead, it doesn’t.
During a connection, the connect service receives:
– the address of your WordPress site;
– for Facebook: your Facebook user ID and name, an access token for your account, and for each Page you choose: its ID, name, picture, your role on the Page, its access token, and the ID, username, name and picture of any Instagram account linked to it;
– for Instagram and Threads: your account’s ID, username, name, profile picture and an access token.
What we do with it: we pass it to the WordPress site that started the connection, and nothing else. It’s stored encrypted for at most 10 minutes, until your site collects it over an encrypted connection, and then deleted. We keep no copy of your tokens or account details after that.
The cookie: the connect service sets one strictly necessary cookie, exs_relay. It lasts 10 minutes and makes sure a connection finishes in the same browser that started it.
Server logs: like any web server, ours records each request: IP address, time, browser type and the address requested. Those addresses can include one-time codes that become useless once the connection completes. Error logs can include the reason a social network gave for refusing a connection. Logs are kept for 10 days to keep the service running and secure, then deleted.
The connect service runs on servers in the USA.
3. Data from Meta’s platforms (Facebook, Instagram, Threads)
Data obtained through Meta’s platforms is used only to provide the features you use in Exact Social:
– publishing and scheduling posts;
– showing your Pages and accounts;
– reading their statistics;
– where you turn them on, reading and replying to comments and messages.
We don’t sell it, don’t use it for advertising or to build profiles about you, and don’t share it with anyone except the hosting provider that runs the connect service. As explained above, everything except the connect service’s 10-minute hand-off lives on your own WordPress site, not with us.
4. Exact Social Pro: licences and updates
When Exact Social Pro is active, your site contacts exactwp.com to activate your licence and check for updates. It sends:
– your licence key;
– your site’s address;
– the installed Pro version;
– your PHP and WordPress versions.
We use this to validate your licence, deliver updates, and see which versions are in use.
5. The exactwp.com website and purchases
If you buy a licence or create an account on exactwp.com, we process your name, email address, billing details and purchase
6. Legal bases (EU and UK)
We process this data:
– to provide the service you asked for (performance of a contract);
– for our legitimate interest in keeping the service secure and working (server logs);
– to meet legal obligations (for example, invoices).
7. How long we keep data
| Data | Kept |
| Connection data at the connect service | At most 10 minutes |
| Server logs | 10 days |
| Licence and purchase records | As long as your licence is active, and as long as tax law requires afterwards |
8. Deleting your data and disconnecting
– In Exact Social: disconnect an account under Social accounts. This removes its tokens from your site. Deleting the plugin, with “Delete all data when uninstalling” turned on, removes all Exact Social data from your site.
– At the network:
– Facebook: Settings & privacy → Settings → Business integrations. Remove Exact Social.
– Instagram: Settings → Apps and websites.
– Threads: Settings → Account → Website permissions.
– With us: we hold no connection data beyond 10 minutes. To delete licence, purchase or log data, or to ask what we hold about you, email info@exactwp.com. We reply within 30 days.
9. Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict its processing, and complain to your data protection authority. Email info@exactwp.com to exercise these rights.
10. Children
Exact Social is a business tool and isn’t meant for children under 16.
11. Changes
We’ll post changes here and update the effective date. We’ll announce significant changes on exactwp.com.
12. Contact
Exact Studios, 101 Old Hall St, Liverpool, L3 9PP, UK, info@exactwp.com