Privacy Policy

Crescendo Lab (“we”, “us”, “our”) operates the Social Automation platform (the “Service”) available at social-automation.cresclab.com. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service, including data obtained through Facebook and Instagram APIs.

2.1 Account Information

• Email address and password (hashed) when you register
• Organization/tenant name

2.2 Facebook & Instagram Data

When you connect your Meta account via OAuth, we access:

• Page & Account Info — Facebook Page name, Page ID, Instagram Business account name and ID
• Posts & Comments — Post IDs, comment text, commenter IDs (for keyword matching only)
• Messages — We send automated DMs/Messenger messages on your behalf; message content is generated from your configured templates
• Access Tokens — OAuth tokens are encrypted with AES-256-GCM and stored securely

2.3 Activity Logs

• Trigger events (comment received, reply sent, DM sent)
• Timestamps, success/failure status
• Aggregated usage metrics (trigger counts per month)

• Automation — To match keywords in comments and send automated replies and DMs as configured by you
• Dashboard & Analytics — To display activity logs, trigger counts, and account status
• Service Operation — To authenticate your sessions, enforce plan limits, and prevent abuse

We do not use your data for advertising, sell it to third parties, or train AI models.

We share data only with:

• Meta Platforms, Inc. — API calls to Facebook/Instagram to execute automations on your behalf
• Google Cloud Platform — Hosting provider (Cloud Run, asia-east1 region)
• Google Cloud SQL / PostgreSQL — Database hosting (asia-east1 region)
• Google Analytics 4 — Website traffic and marketing funnel analytics. This runs only on our public pages (landing, sign-up, login, and these policy pages). It is not loaded inside the signed-in dashboard, so your campaigns, activity logs, and connected accounts are never sent to Google Analytics.

We do not share, sell, or rent your personal data to any other third party.

We use two kinds of cookies, and nothing else:

• Session cookie (ig-auth-session) — Strictly necessary. Keeps you signed in. httpOnly, so it cannot be read by scripts.
• Google Analytics cookies (_ga, _ga_*) — Set only on our public pages to measure how people find and move through our website. They record a random identifier, not your name or email. Retained for up to 2 years by Google.

We do not use advertising or cross-site tracking cookies, and Google Signals is disabled on our property. To opt out of Google Analytics you can install Google's opt-out browser add-on or block cookies in your browser settings. Blocking them does not affect any part of the product.

• Account data — Retained while your account is active; deleted within 30 days of account deletion
• Activity logs — Retained for 90 days, then automatically purged
• Access tokens — Encrypted at rest; revoked and deleted when you disconnect your Meta account
• Comment/message content — Processed in real-time for keyword matching; not permanently stored

You can request deletion of your data at any time by:

• Disconnecting your Meta account from the Dashboard (Settings → Connections → Remove)
• Contacting us at privacy@cresclab.com
• Using our data deletion endpoint: POST /api/data-deletion

Upon receiving a deletion request, we will remove all associated data within 30 days and confirm via email.

• Access tokens encrypted with AES-256-GCM
• Passwords hashed with bcrypt
• Webhook payloads verified with HMAC SHA-256 signatures
• All connections over HTTPS/TLS
• JWT session tokens in httpOnly cookies

Depending on your jurisdiction (GDPR, CCPA, PDPA), you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Withdraw consent for data processing

To exercise any of these rights, contact privacy@cresclab.com.

Our use of information received from Facebook and Instagram APIs adheres to the Meta Platform Terms and Developer Policies. Specifically:

• We only request permissions necessary for the Service to function
• We do not sell, license, or otherwise commercialize any data obtained from Meta APIs
• We do not use Meta data to build or augment user profiles for advertising
• We do not transfer Meta data to any data broker or advertising network
• Users can revoke access at any time through Facebook Settings → Apps and Websites

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date.

If you have questions about this Privacy Policy, please contact:

• Crescendo Lab
• Email: privacy@cresclab.com
• Website: www.cresclab.com