DATA DELETION REQUEST — ENDPOINT SPECIFICATION & POLICY
Version: 1.0
Last Updated: [INSERT DATE]

========================================================
PART 1: DATA DELETION POLICY (User-Facing)
========================================================

DATA DELETION REQUEST POLICY

At [YOUR COMPANY NAME], we respect your right to have your data deleted from our systems. This document describes how you can submit a data deletion request and how we process it.

HOW TO REQUEST DATA DELETION

You may request deletion of your data through any of the following methods:

Method 1 — Email Request:
Send an email to: [YOUR DELETION EMAIL, e.g., [email protected]]
Subject line: “Data Deletion Request”
Include: Your Instagram username or Meta User ID

Method 2 — Via Meta Platform:
You may revoke this App’s permissions through your Facebook/Instagram settings:
https://www.facebook.com/settings?tab=applications
Revoking permissions will automatically trigger our deletion process.

Method 3 — In-App Request (if applicable):
[If your app has a UI, describe the steps here, e.g., “Go to Settings > Privacy > Delete My Data”]

WHAT WE DELETE

Upon receiving a verified deletion request, we will delete:
– All Instagram account data associated with your Meta User ID
– All analytics and metrics data collected for your account
– All cached profile data (username, bio, follower counts, etc.)
– All OAuth access tokens associated with your account
– All API request logs containing your user identifier

DATA WE MAY RETAIN

We may retain the following for legal or compliance purposes only:
– Records of the deletion request itself (for audit purposes), for up to 90 days
– Anonymized aggregate statistics that cannot be linked to any individual

PROCESSING TIME

We will process and confirm data deletion within 30 days of receiving a valid request. You will receive a confirmation email upon completion.

CONFIRMATION CODE

Upon completing your deletion request, you will receive a confirmation code that you can use to verify the status of your request. To check the status of your request, email us at [YOUR DELETION EMAIL] with your confirmation code.

========================================================
PART 2: TECHNICAL SPECIFICATION — CALLBACK ENDPOINT
(For Meta App Dashboard Configuration)
========================================================

DATA DELETION REQUEST CALLBACK — TECHNICAL SPEC

This section describes the technical implementation of the Data Deletion Request Callback endpoint required by Meta for app publication.

ENDPOINT URL (to enter in Meta App Dashboard):
https://[YOUR-DOMAIN]/meta/data-deletion

METHOD: POST

AUTHENTICATION:
Meta sends a signed_request parameter. Validate using HMAC-SHA256 with your App Secret.

REQUEST FORMAT (from Meta):
POST /meta/data-deletion
Content-Type: application/x-www-form-urlencoded

Body parameter:
signed_request=[BASE64_ENCODED_SIGNED_REQUEST]

SIGNED REQUEST PAYLOAD STRUCTURE (after decoding):
{
“user_id”: “[META_USER_ID]”,
“algorithm”: “HMAC-SHA256”,
“issued_at”: [UNIX_TIMESTAMP]
}

REQUIRED PROCESSING STEPS:
1. Decode and validate the signed_request using your App Secret
2. Extract the user_id from the decoded payload
3. Queue or immediately execute deletion of all data associated with user_id
4. Generate a unique confirmation_code for this deletion job
5. Return a JSON response (see below)

REQUIRED RESPONSE FORMAT (HTTP 200):
Content-Type: application/json

{
“url”: “https://[YOUR-DOMAIN]/meta/deletion-status?id=[CONFIRMATION_CODE]”,
“confirmation_code”: “[UNIQUE_CONFIRMATION_CODE]”
}

DELETION STATUS PAGE (url field above):
This URL must display the status of the deletion job to the user.
Acceptable statuses: “pending”, “in_progress”, “completed”, “failed”

Example status page response (JSON or HTML):
{
“status”: “completed”,
“confirmation_code”: “[UNIQUE_CONFIRMATION_CODE]”,
“completed_at”: “[ISO_8601_TIMESTAMP]”
}

ERROR HANDLING:
– If the signed_request is invalid: return HTTP 400
– If the user_id is not found: return HTTP 200 with confirmation_code (no data to delete)
– If deletion fails: return HTTP 200, queue for retry, update status page to “failed”

TRIGGER CONDITIONS FOR DELETION:
Per Meta’s Developer Policies, data must be deleted when:
1. A user sends a deletion request via Meta’s platform
2. A user deauthorizes the App (Deauthorization Callback)
3. A user deletes their Meta/Facebook account
4. Data is no longer needed to provide the service
5. Meta requests deletion
6. Applicable law or regulation requires deletion

========================================================
PART 3: DEAUTHORIZATION CALLBACK SPEC
========================================================

DEAUTHORIZATION CALLBACK ENDPOINT

URL (to enter in Meta App Dashboard — Business Login Settings):
https://[YOUR-DOMAIN]/meta/deauthorize

METHOD: POST

This endpoint is called by Meta when a user removes your App from their connected apps.

REQUEST FORMAT:
POST /meta/deauthorize
Content-Type: application/x-www-form-urlencoded

Body parameter:
signed_request=[BASE64_ENCODED_SIGNED_REQUEST]

PAYLOAD (after decoding signed_request):
{
“user_id”: “[META_USER_ID]”,
“algorithm”: “HMAC-SHA256”,
“issued_at”: [UNIX_TIMESTAMP]
}

REQUIRED PROCESSING:
1. Validate the signed_request
2. Revoke and delete all stored access tokens for user_id
3. Schedule or immediately execute full data deletion for user_id
4. Log the deauthorization event for audit

REQUIRED RESPONSE: HTTP 200 (empty body or {“status”: “ok”})

========================================================
PART 4: URLS TO ENTER IN META APP DASHBOARD
========================================================

Navigate to: Meta App Dashboard > App Settings > Business Login

Enter the following:

1. Data Deletion Request URL:
https://[YOUR-DOMAIN]/meta/data-deletion

2. Deauthorization Callback URL:
https://[YOUR-DOMAIN]/meta/deauthorize

3. Privacy Policy URL (App Settings > Basic):
https://[YOUR-DOMAIN]/privacy-policy

Requirements for URLs:
– Must be publicly accessible (no authentication required to reach the URL)
– Must use HTTPS
– Must not be geoblocked
– Must be crawlable by Meta’s systems
– Must remain active and updated at all times

========================================================
CONTACT
========================================================

For questions about data deletion:
Email: [YOUR DELETION/PRIVACY EMAIL]
Company: [YOUR COMPANY NAME]
Address: [YOUR FULL ADDRESS]