How Noddi handles your data

Last updated 21 October 2026. Controller: Bennota Consulting Limited (privacy@bennota.com).

What Noddi does

Noddi turns photos and notes you send on WhatsApp into social media posts that you approve before anything is published. To do that it connects to your Instagram professional account and, optionally, your Facebook Pages and LinkedIn profile through the official Meta and LinkedIn APIs.

Data we collect

• Account identity from Meta: your Instagram or Facebook user id, username, Page names and ids and profile pictures. Used to show which account a post will go to and to publish on your behalf.
• Access tokens issued by Meta or LinkedIn. Stored encrypted (AES, key held outside the database) and used only to publish the posts you approve and to read publishing limits and post links.
• WhatsApp messages you send to the Noddi number: text, photos and voice notes, plus your phone number and display name. Voice notes are transcribed and the audio is deleted immediately afterwards.
• Posts: every draft, revision, approval, publication result and link, kept as the audit trail of what was approved and by whom.
• Operational logs (timestamps, errors) with no message content or tokens.

What we never do

• Publish anything you have not explicitly approved.
• Read your Instagram or Facebook inbox, followers or other people's data.
• Sell or share your data with advertisers or data brokers.
• Use your content to train AI models.

Processors

Drafts are written with Anthropic's Claude API (text and the photo you sent, under their commercial data terms, no training on your data). Publishing goes through Meta Platforms (Instagram and Facebook Graph API) and LinkedIn. Hosting is on servers in the United Kingdom / European Union.

Retention

Photos are kept until published plus 30 days, then removed. Posts and the approval trail are kept for as long as your workspace exists. Tokens are deleted the moment you disconnect an account, remove the Noddi app in your Meta settings, or ask us to.

Your rights

Under UK GDPR you can ask for access, correction, deletion, restriction or a copy of your data at privacy@bennota.com. To delete the data Noddi holds from Meta, see data deletion. You can complain to the Information Commissioner's Office (ico.org.uk).

Cookies

The dashboard uses one strictly necessary session cookie and one to remember the selected workspace. No analytics or advertising cookies.