Skip to content

Last updated 28 September 2026

Privacy Policy

This Privacy Policy explains how Magoven (“Magoven”, “we”, “us”, or “our”) collects, uses, stores, and shares information when you use Limeo at limeo.co.za and related APIs, MCP endpoints, and services (together, the “Service”).

By creating an account or using the Service, you acknowledge this Policy. For our contractual terms, see the Terms & Conditions.

1. Who we are

Magoven operates Limeo as an AI-native social media operating system for brands and agencies. For privacy matters relating to Limeo, Magoven is the data controller of account and platform-operational data we process to provide the Service.

Where you connect third-party social networks (Meta/Facebook/Instagram, LinkedIn, X, and others), those platforms remain controllers of data on their own systems. We process tokens and content you authorise only as needed to provide features you enable.

Contact: [email protected] · Website: magoven.io

2. Scope

This Policy applies to:

  • Visitors to limeo.co.za and Magoven marketing pages that link here
  • Registered users, workspace members, and administrators
  • API and MCP clients acting on behalf of a workspace
  • Personal data processed when connecting social accounts or using AI features

3. Information we collect

Account & organisation data. Name, email address, password (stored as a one-way Argon2id hash), organisation/workspace name, brand profiles, role and membership information, billing-related identifiers where applicable, and onboarding preferences.

Usage & technical data. IP address, device/browser type, approximate location derived from IP, timestamps, pages or API routes accessed, error logs, and security/audit events (including actor type such as HUMAN, AI, API, MCP, or SYSTEM).

Content you create. Drafts, scheduled and published posts, captions, media uploads, campaigns, ideas, approval comments, inbox replies, listening queries, automation workflows, Brand Brain knowledge you upload, AI prompts and generated outputs, and related metadata.

Social account connection data. When you connect Facebook, Instagram, LinkedIn, X, or other providers, we receive OAuth authorisation codes and exchange them server-side for access/refresh tokens, account identifiers, handles, page/profile metadata, granted scopes, and health/expiry information. Access and refresh tokens are encrypted at rest (AES-256-GCM) and are never exposed to the browser.

Engagement data you sync. Depending on permissions you grant, this may include comments, mentions, messages, reviews, and related public or page-scoped social content needed for inbox, listening, analytics, and reply features.

Communications. Support requests, email verification and password-reset flows, and transactional product emails.

We do not intentionally collect special-category data. Please do not upload sensitive personal information unless it is necessary for your legitimate business use of the Service.

4. How we use information

  • Provide, operate, secure, and improve the Service
  • Authenticate users, manage workspaces, roles, and permissions
  • Connect social accounts and publish, schedule, or engage on your behalf
  • Power AI features (studio, assistant, Brand Brain, policies, repurposing, agents)
  • Run automations, approvals, analytics, listening, and MCP/API tooling you enable
  • Send service, security, and product notices
  • Prevent abuse, debug incidents, and maintain audit trails
  • Comply with law and enforce our Terms

Legal bases (where GDPR/UK GDPR or similar frameworks apply) typically include: contract performance (providing the Service), legitimate interests (security, product improvement, fraud prevention), consent (optional cookies / certain marketing or platform permissions), and legal obligation.

5. AI processing

Limeo uses AI models to help draft, rewrite, classify, search Brand Brain knowledge, check policies, and assist workflows. Prompts and relevant workspace context you provide may be sent to Magoven-operated infrastructure and/or contracted model providers solely to generate the requested output.

Do not submit secrets, payment card numbers, or third-party personal data into AI tools unless you have a lawful basis and your organisation’s policies allow it. AI outputs may be inaccurate; you remain responsible for reviewing content before publishing.

6. Sharing and processors

We do not sell personal data. We share information only:

  • With social platforms you connect — to authenticate and perform actions you request (post, reply, read permitted engagement data), subject to those platforms’ terms and privacy policies
  • With service providers who host, monitor, email, or process data on our instructions (e.g. cloud hosting, email delivery, model providers), under confidentiality and data-processing terms
  • Within your organisation — other members with appropriate roles can see workspace content according to permissions
  • For legal reasons — to respond to lawful requests, protect rights and safety, or in connection with a merger, acquisition, or asset transfer (with notice where required)

7. Meta, LinkedIn, X and other platform data

When you authorise Meta (Facebook/Instagram), LinkedIn, X, or similar providers, we access Platform Data only as needed for the features you use (account connection, publishing, inbox/engagement, analytics, listening). We do not use Platform Data to build independent advertising profiles, sell it to data brokers, or transfer it except as described here or as required to operate the Service for your workspace.

You (or your organisation) are responsible for having the right to connect Pages, profiles, and Instagram professional accounts, and for complying with each platform’s Platform Terms, Developer Policies, and community standards.

You may disconnect social accounts at any time in Settings → Social Accounts. Disconnecting revokes our stored tokens for that account where the platform supports revocation; residual copies in backups or audit logs may persist for a limited period.

8. Cookies and similar technologies

We use essential cookies and similar technologies for authentication, session security, CSRF protection, and remembering preferences (such as theme or navigation state). These are required for the Service to function. We may use limited analytics to understand product usage; where consent is required, we will request it.

9. Retention

We retain account and workspace data for as long as your organisation maintains an active account and for a reasonable period afterward (typically up to 90 days unless a longer period is required for legal, security, or dispute purposes). Audit logs, security records, and encrypted backups may be kept longer under reduced access. Media and content you delete may remain in backups until those backups rotate.

10. Security

We use industry-standard measures including TLS in transit, encrypted social token vaults, hashed passwords, role-based access control, tenant isolation by organisation, and audit logging of sensitive actions. No method of transmission or storage is 100% secure; please use strong passwords and protect API/MCP tokens.

11. International transfers

Magoven may process data in South Africa and in other countries where our infrastructure or processors operate. Where required, we use appropriate safeguards (such as contractual clauses) for cross-border transfers.

12. Your rights

Depending on your location (including under POPIA in South Africa and GDPR where applicable), you may have rights to access, correct, delete, restrict, or object to certain processing, to data portability, and to withdraw consent where processing is consent-based. Workspace owners can manage much of this in-product; otherwise contact [email protected]. You may also lodge a complaint with your local supervisory authority.

If we process personal data on behalf of your organisation as a processor for end-customer contacts you import, your organisation is the controller of that data and should handle data-subject requests accordingly; we will assist as reasonably required under our agreement.

13. Children

The Service is intended for business users aged 18 and over. We do not knowingly collect personal data from children.

14. Changes

We may update this Policy from time to time. Material changes will be posted on this page with an updated “Last updated” date, and where appropriate we will notify account owners by email or in-product notice.

15. Contact

Privacy questions or requests: [email protected]
General: https://magoven.io
Service: https://limeo.co.za

This Policy is provided for transparency about Limeo’s practices. It is not legal advice. Magoven may refine wording with counsel as products and jurisdictions evolve.