Wacky Sheep UGC — Privacy

Last updated: 2 November 2026.

Who operates this app

Wacky Sheep UGC is operated for Wacky Sheep / Ćaknuta Ovca by WSD DESIGN DOO, Cara Dušana 212, Beograd, Serbia (registration number 21300527; PIB 110114892).

Contact for this app, privacy requests, removal requests and security concerns: hello@wackysheep.com. Include “UGC privacy” in the subject. Do not send passwords, access tokens, identity documents or payment information.

What the app does

This app is for Wacky Sheep's own business account, @wackysheep. It is not a service for connecting customers' personal Instagram accounts. An authorized staff member can use their Facebook business identity to authorize access to the Wacky Sheep Page and linked Instagram account. That does not make the staff member's personal Instagram account a source for this app.

The integration is currently a private development pilot. A bounded API test collected metadata for posts tagging @wackysheep; no photos were downloaded or published through that test. Further collection and publication are paused while the intended use and compliance requirements are resolved.

The proposed service lets staff review eligible community photos, obtain permission, match the garments to Wacky Sheep products and choose which approved photos to show on the website. No photo is approved merely because it tags the brand or matches a product name.

Data handled

Connection data: the brand's Instagram and Facebook Page identifiers, authorization credentials, permission information and connection diagnostics needed to operate the integration. Meta handles the Facebook/Instagram sign-in; this app does not collect those account passwords.
Candidate-post data returned by the authorized API: post ID, public creator username when supplied, caption, media type, original-post link and temporary media URL when supplied. The private pilot does not download the media from that URL.
Review data: the selected product references, review decisions and proposed credit, captions and image descriptions.
When supplied by a creator or staff member: the selected original photo, evidence of permission and correspondence needed to confirm rights or answer a removal request.

The collector does not read direct messages, publish to Instagram, comment, like, follow people or collect a staff member's personal Instagram feed. The tagged-post permission includes comment-management capability, but the collector only performs reads. An unused messaging permission was removed from the app configuration on 2 November 2026. Older diagnostic credentials remain out of use pending cleanup.

Use and disclosure

We use candidate and review information to assess whether a photo is eligible for the community gallery, identify the relevant product and manage permission and removal requests. Caption suggestions are reviewed by staff; they are not proof of what the person is wearing. The pilot does not send photos to an external AI service or perform face recognition.

Private pilot files are stored locally with restricted filesystem permissions and excluded from source control. If website display is later enabled, approved images and display content will be stored with Shopify and served through Shopify's infrastructure. Public display can include the approved image, agreed credit, original Instagram link, product links and approved descriptive text. Credentials and private permission correspondence must never be placed in public gallery fields.

Authorized staff and service providers needed to operate the integration may process the relevant data for that purpose. Meta processes API authorization and requests under its own policies. Clicking an Instagram link opens Instagram, where Meta's policies apply. This notice does not replace the store's checkout/customer privacy notice.

Retention and removal

We delete unselected or unresolved candidate batches within 30 days of collection. We delete rejected candidates and unnecessary credentials promptly when they are no longer needed. We do not use a fresh import to silently reinstate a removed photo.

For an approved photo, we retain the selected content and necessary permission record only while needed for its authorized use, handling withdrawal or a dispute, or a documented legal obligation. We stop displaying the photo after a verified withdrawal. We keep any necessary legal record separate with restricted access; it is not permission to continue displaying the photo. We review remaining records periodically and delete those no longer needed.

Requests and choices

Email hello@wackysheep.com to request access, correction, removal or deletion of information about you, or to withdraw permission to feature your photo. Include your Instagram handle and the relevant post or website link so we can find it. We may ask for proportionate evidence that you control the account or have rights to the photo; never send your Instagram password or token.