Privacy Policy

We collect what you give us, and what you authorise us to read from Meta:

• Account information: your name, email address and password
• Business information: business name, industry, offers and target audience
• Instagram and Facebook data: the connected account's username and profile information, and the direct message conversations on it, with your authorisation
• Knowledge base: the content you write for your AI assistant to answer from
• Payment information: handled by our payment provider, Whop. We never see or store your card details

• To run the Service and answer your Instagram and Facebook DMs on your behalf
• To train your own AI assistant on your knowledge base
• To send you account and service notices
• To improve the Service and build new features
• To meet our legal obligations

When you connect an Instagram account or a Facebook Page, we access:

• The profile information of that Business or Creator account, or that Page
• Direct messages that account or Page receives
• Permission to send messages from it

We do not read your personal Instagram or Facebook messages, post to your feed, or access your followers' private information. Access tokens are stored encrypted, and you can revoke them at any time in your Meta settings or by disconnecting the account inside the Service.

• Encryption in transit (TLS) and at rest
• Meta access tokens encrypted with AES-256-GCM
• Row-level security, so one account cannot read another account's data
• Limited employee access to personal data

We do not sell your personal data. We use a small number of processors to run the Service, and each only sees what it needs to do its job:

• Meta: Instagram and Facebook messaging
• Supabase: database, authentication and storage
• Vercel: application hosting
• Whop: payments and subscriptions
• n8n: the automation that moves a message from Meta to the AI and back
• OpenRouter and the AI model providers it routes to: generating the replies. Message content sent to them is not stored by them and is not used to train their models
• Sentry: error monitoring. Secrets are stripped before anything is sent
• Legal requirements: where the law requires it, or to protect our rights

You can ask us to:

• Access: give you a copy of your personal data
• Correct: fix information that is wrong
• Delete: remove your account and its data
• Export: hand your data over in a machine-readable format

You can also disconnect Instagram or Facebook at any time inside the Service, which stops all access immediately.

We keep your data for as long as your account is active. After you delete your account we remove your personal data within 30 days, except where the law requires us to keep something longer.

We use essential cookies for signing in and keeping you signed in. We may use analytics to understand how the Service is used. You can control cookies in your browser settings.

The Service is not intended for anyone under 18 and we do not knowingly collect personal information from children.

Privacy questions, or to exercise any of the rights above: privacy@theperfectsetter.com

Data Protection Officer: dpo@theperfectsetter.com