Privacy Policy

Engageefy is operated by Adsvertising Ltd., the data controller for the personal data described in this policy. This policy explains what we collect when you use Engageefy, why, how long we keep it and what rights you have.

Account data. Username, email address, password (stored as a hash), optional Telegram handle, billing details you provide (company name, address, VAT number), plan and subscription status. Payments are processed by Stripe; we never see or store full card numbers.

Connected platform data. When you connect a Facebook Page, an Instagram account or a TikTok account we receive, through the official APIs: the account's identifiers, name and profile picture; access tokens (stored encrypted); the list of your posts, videos and ads; comments and replies on them, including the commenter's name, identifier, profile picture and the text and attachments of the comment; direct messages sent to your account, including the sender's name and identifier; and basic advertising data such as campaigns and spend if you connect an ad account.

Data generated by the Service. AI analysis of comments (sentiment, intent, tone, language, moderation category), moderation actions and their reasons, replies generated or sent, automation runs, contacts created through direct-message automations, click statistics for links you create, and usage counters.

Technical data. IP address, browser and device information, timestamps, request logs and error reports needed to run and secure the Service. We do not log the content of comments or messages in our technical logs.

• To provide the Service: read comments and messages, apply the rules you configure, hide or delete comments, publish replies and send messages on your behalf, and show you the results.
• To generate AI analyses and replies. The text of comments, messages and your instructions is sent to our AI provider (OpenAI) for processing. It is not used to train models.
• To operate your account: authentication, billing, quota management, support and service emails such as activation, password reset, quota warnings and weekly notices about disconnected accounts.
• To keep the Service secure and reliable: abuse prevention, error monitoring and debugging.
• To comply with legal obligations and with the platform policies of Meta and TikTok.

The legal bases are performance of our contract with you, our legitimate interest in operating and securing the Service, and, where required, your consent.

Data received from Meta (Facebook, Instagram) is used only to provide the features you enable, in line with the Meta Platform Terms and Developer Policies. Data received from TikTok is used only in line with the TikTok for Business API terms. We do not sell platform data, use it for advertising, or share it with third parties except the processors listed below. If a platform asks us to delete data, we do so.

If you remove Engageefy from your Facebook or Instagram account, Meta notifies us and we delete the tokens for that account. You can also request deletion of all data related to a connected account at any time from inside the Service.

We use a small number of service providers who process data on our behalf under contract: cloud hosting and database providers, Stripe (payments), Resend (email delivery), OpenAI (AI analysis and reply generation), Cloudflare (custom domains and link redirects) and an error-monitoring service. Team members you add to your account can see the data of the accounts you share with them. We disclose data to authorities only when legally required.

Some providers are located outside the European Economic Area. Where that is the case, transfers are covered by standard contractual clauses or an equivalent safeguard.

• Comments and replies: kept for the history period of your plan (between 30 days and 12 months), then deleted. Comments you delete or that are marked as spam are removed after 90 days.
• Webhook deliveries: 7 days. Internal activity logs: 14 days. Detailed usage and click events: 90 days, after which only monthly totals are kept.
• Direct messages and contacts: for as long as the account is connected and you keep them; you can delete conversations at any time.
• Access tokens: until you disconnect the account, revoke access or close your account.
• Account and billing records: for the life of your account and afterwards as long as tax and accounting law requires.

When you close your account, connected platform data is deleted within 30 days and backups expire within 90 days.

Depending on where you live, you have the right to access, correct, export and delete your personal data, to restrict or object to certain processing, and to withdraw consent. You can exercise most of these rights directly inside the Service (account settings, disconnecting accounts, deleting conversations, closing your account). You also have the right to lodge a complaint with your local data protection authority.

Commenters and message senders whose data we process on behalf of our customers should contact the business that owns the page or account; we act as a processor for that data and will assist the business with any request.

Access tokens are encrypted at rest, passwords are hashed, traffic is encrypted in transit, and access to production systems is restricted to authorised staff. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you as required by law.

Engageefy uses a session cookie that is strictly necessary to keep you signed in. We do not use advertising cookies. If we add analytics, it will be privacy-friendly and described here.

The Service is intended for businesses and is not directed at children under 16. We do not knowingly collect data from children.

We may update this policy as the Service changes. Material changes are announced inside the Service or by email before they take effect. The date at the top shows when it was last updated.