tiziLast updated :
Tizi Privacy Policy
Last updated: 14 October 2026. This policy describes how IZEMX (a company incorporated in Morocco, Casablanca, contact: contact@izemx.com) processes personal data within the Tizi service, a gateway between a customer's AI agents or applications (the "Customer") and the social networks Meta (Facebook, Instagram, Messenger, WhatsApp Business), Telegram, LinkedIn and TikTok.
Each Tizi instance is deployed for a single Customer. IZEMX acts as a processor on behalf of the Customer, who is the controller of the data of its own contacts, followers and clients. IZEMX does not use the data for its own purposes.
1. Data we process
Depending on the platforms the Customer connects, Tizi processes:
- Connected accounts: technical identifiers of Pages, Instagram professional accounts, WhatsApp Business numbers, Telegram bots, LinkedIn organisations, TikTok accounts and ad accounts; display name, public handle, avatar, granted permissions; access tokens issued by the platforms.
- Messaging (WhatsApp, Messenger, Instagram Direct, Telegram): content of received and sent messages, sender identifier and display name, phone number (WhatsApp), timestamps, delivery and read statuses, exchanged media, internal notes and labels added by console users.
- Posts and comments: text, media, dates, public statistics (reactions, comments, shares, views), comments and their authors as provided by the platforms.
- Statistics: aggregated metrics provided by the platforms (followers, reach, impressions, engagement, conversations, ad spend).
- Ads: campaigns, ad sets, ads, budgets, spend, results, approval requests.
- Tizi Console users: e-mail address, display name, role, language, password hash (Argon2id), encrypted two-factor secret, hashed recovery codes, IP addresses and browsers of sign-ins.
- Technical logs: API key identifiers, received calls (route or tool, timestamp, duration, IP address, masked excerpt of request and response), webhook deliveries, hash-chained audit log.
Tizi collects no browsing data for advertising purposes and uses no third-party trackers on its pages.
2. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service to the Customer: relaying messages, publishing, reading statistics, managing ads | Performance of the contract with the Customer (art. 6(1)(b) GDPR); for people contacting the Customer, the Customer's legitimate interest in answering them |
| Securing the service: authentication, audit log, abuse detection, replay protection | Legitimate interest (system security) and legal obligations |
| Complying with platform rules (Meta, Telegram, LinkedIn, TikTok policies) | Contractual obligation and legitimate interest |
| Answering access, rectification and deletion requests | Legal obligations (GDPR, Moroccan law 09-08) |
3. Retention
- Messages, conversations, posts and statistics: kept while the account is connected to the instance, then deleted within 30 days of its disconnection or of a deletion request.
- Access tokens: encrypted (AES-256-GCM) in the instance vault; deleted immediately when the account is disconnected or the platform revokes them.
- Call log and webhook deliveries: 90 days (masked excerpts, never secrets).
- Audit log: lifetime of the instance (chained entries required for security); it contains no message content.
- Console user accounts: until deleted by an administrator; sign-in log 12 months.
- Data deletion requests: confirmation code and state kept 12 months as proof of processing.
4. Processors and recipients
- The host of the Customer's instance (server and database in the region chosen by the Customer, European Union by default).
- The connected platforms (Meta Platforms Ireland Ltd, Telegram FZ-LLC, LinkedIn Ireland Unlimited Company, TikTok Technology Ltd), which process data under their own policies; Tizi only sends the platforms what the Customer asks to send.
- The Customer's SMTP provider for console e-mails (invitations, alerts).
No data is sold or shared with third-party advertisers.
5. Transfers outside the EU and Morocco
Platforms may transfer data to the United States under their own safeguards (standard contractual clauses, Data Privacy Framework). Between the Customer and IZEMX, transfers are governed by the data processing agreement and, where applicable, the European Commission's standard contractual clauses.
6. Your rights
If you are in contact with a Customer through a platform connected to Tizi, you may exercise your rights of access, rectification, erasure, restriction, objection and portability with that Customer. You may also write to IZEMX (contact@izemx.com), which will forward your request to the Customer and answer within one month. You may lodge a complaint with the competent authority: the CNDP in Morocco (law 09-08 on the protection of individuals with regard to the processing of personal data) or your national authority in the European Union.
The Data deletion page explains how to request deletion of data about you, including through Meta's data deletion procedure.
7. Security
Encryption of tokens at rest (AES-256-GCM), TLS transport, HMAC authentication of API calls with replay protection, mandatory two-factor authentication for console administrators, hash-chained audit log, masking of secrets in logs, isolation per instance (one instance per Customer).
8. Minors
Tizi is not intended for people under 16 and only processes their data to the extent a platform transmits it to the Customer.
9. Changes
This policy may change; the update date appears at the top of the page and every version is kept in the software repository.
10. Contact
IZEMX — contact@izemx.com