Privacy notice

• From Meta, subject to permissions: Page names, identifiers and access tasks; post and comment identifiers, text, timestamps, links and available author information; conversation identifiers, participants, message text and timestamps.
• Authorization credentials, granted permissions, selected Page and conversation identifiers needed to verify access and retrieve the information requested by authorized staff.
• Webhook event source, type, asset identifiers, receipt time and event payload. Payloads can include account identifiers, message content and other event fields. Redacting credential fields does not make this data anonymous.
• Operational records such as request path, method, response status, duration, errors and limited Page-discovery diagnostics. Request paths and diagnostics may contain identifiers.
• Information you send to our contact mailbox, including your email address and the details needed to handle a privacy, security or deletion request. Review recordings and troubleshooting copies may also contain displayed data.

The current interactive review flow is Facebook-only. Earlier Instagram integration records may remain in storage and are also covered by the contact and deletion process; this does not mean Instagram permissions have been approved or that Instagram is enabled in the current flow.

We process this information to let authorized company staff review customer inquiries and feedback, verify their access to company assets, maintain the integration, diagnose faults, demonstrate actual functionality to Meta for review, and handle privacy and security requests. Page subscription controls register this application's permitted Webhook event fields; they do not send messages or change Page content.

Data access depends on the permissions granted by the relevant account and the company's configured assets. The review console does not provide a public customer-data directory or guarantee a complete historical archive. Its implemented data flow does not sell data, target advertising or send message content to an AI service.

New Facebook login credentials for the review console are held in server memory. A review session becomes invalid after one hour or a server restart. Expired entries are removed when the session service next checks them. Ending a session does not revoke authorization at Meta.

The current post, comment and conversation read paths display Meta responses without writing those responses into a business-data table. Webhook events are stored separately in a local SQLite database, and operational logs are written to local files. Historical configuration, recordings, exports or backups may also require separate handling.

Necessary records may be retained for continuing customer-inquiry review, integration operation, security and troubleshooting, not solely until app review ends. Retention is based on whether the specific data is still needed for these purposes and any applicable legal obligation. It is not permission to keep all records indefinitely.

The operator handles cleanup manually when data is no longer needed, when the relevant service stops, or in response to a valid deletion request or a requirement from Meta or applicable law. There is no fixed 30-day automatic expiry in this console. Records are not automatically cleared when you disconnect. Relevant logs, recordings, exports and backups must be considered separately; a deletion response will explain any unresolved copy or legally required retention.

Business-data access in the console requires an authorized session and an approved company Page. The public privacy and deletion pages do not expose company conversations. Staff and administrators must use data only within their authorized responsibilities.

The current review environment runs on an operator-managed computer and uses ngrok for public HTTPS connectivity. Requests and responses pass through this network service. Meta processes login, authorization and API interactions. Your email service and the service hosting our contact mailbox process correspondence you send. These providers may process data in countries other than yours; this notice does not promise storage in a particular country.

Selected screencasts and submission information are provided to Meta for app review. Relevant data may be disclosed when required by applicable law. Privacy or security concerns can be reported to the contact address above. Do not include passwords, access tokens or unrelated private messages.

The console uses an HttpOnly session cookie and a short-lived login-state cookie to maintain authorized access and validate login. Secure cookies are used on the configured HTTPS origin. New Meta access tokens are not returned to browser storage. Requests to change local selection or event subscription require session and request-origin protections.

The application does not add advertising or analytics trackers to these public information pages. Meta and ngrok may use their own cookies or notices. Security controls reduce risk but do not constitute a guarantee that no incident can occur.

For questions, correction, access concerns or a request to delete your data held by this application, email the address above. Provide only enough information to locate your data and verify your identity or authority. We review requests manually and respond with the outcome or the limited additional information needed. Applicable rights depend on your circumstances and local law.

Read the data deletion instructions. Deletion from this application does not delete your original Meta account, Page, posts, comments or messages. Disconnecting, revoking Meta permissions, unsubscribing Webhooks and removing historical copies are separate actions.

We update this notice when relevant practices change and show the revision date above. This notice does not replace Meta's terms or authorize processing beyond the permissions and lawful purposes that apply.