Privacy Policy

Crescendo Lab ("we", "us", "our") operates the Meta Social Automation platform (the "Service") available at social-automation.cresclab.com. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service, including data obtained through Facebook and Instagram APIs.

2.1 Account Information

• Email address and password (hashed) when you register
• Organization/tenant name

2.2 Facebook & Instagram Data

When you connect your Meta account via OAuth, we access:

• Page & Account Info — Facebook Page name, Page ID, Instagram Business account name and ID
• Posts & Comments — Post IDs, comment text, commenter IDs (for keyword matching only)
• Messages — We send automated DMs/Messenger messages on your behalf; message content is generated from your configured templates
• Access Tokens — OAuth tokens are encrypted with AES-256-GCM and stored securely

2.3 Activity Logs

• Trigger events (comment received, reply sent, DM sent)
• Timestamps, success/failure status
• Aggregated usage metrics (trigger counts per month)

• Automation — To match keywords in comments and send automated replies and DMs as configured by you
• Dashboard & Analytics — To display activity logs, trigger counts, and account status
• Service Operation — To authenticate your sessions, enforce plan limits, and prevent abuse

We do not use your data for advertising, sell it to third parties, or train AI models.

We share data only with:

• Meta Platforms, Inc. — API calls to Facebook/Instagram to execute automations on your behalf
• Vercel, Inc. — Hosting provider (servers located in the US)
• Neon / PostgreSQL — Database hosting

We do not share, sell, or rent your personal data to any other third party.

• Account data — Retained while your account is active; deleted within 30 days of account deletion
• Activity logs — Retained for 90 days, then automatically purged
• Access tokens — Encrypted at rest; revoked and deleted when you disconnect your Meta account
• Comment/message content — Processed in real-time for keyword matching; not permanently stored

You can request deletion of your data at any time by:

• Disconnecting your Meta account from the Dashboard (Settings → Connections → Remove)
• Contacting us at privacy@cresclab.com
• Using our data deletion endpoint: POST /api/data-deletion

Upon receiving a deletion request, we will remove all associated data within 30 days and confirm via email.

• Access tokens encrypted with AES-256-GCM
• Passwords hashed with bcrypt
• Webhook payloads verified with HMAC SHA-256 signatures
• All connections over HTTPS/TLS
• JWT session tokens in httpOnly cookies

Depending on your jurisdiction (GDPR, CCPA, PDPA), you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Withdraw consent for data processing

To exercise any of these rights, contact privacy@cresclab.com.

Our use of information received from Facebook and Instagram APIs adheres to the Meta Platform Terms and Developer Policies. Specifically:

• We only request permissions necessary for the Service to function
• We do not sell, license, or otherwise commercialize any data obtained from Meta APIs
• We do not use Meta data to build or augment user profiles for advertising
• We do not transfer Meta data to any data broker or advertising network
• Users can revoke access at any time through Facebook Settings → Apps and Websites

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

If you have questions about this Privacy Policy, please contact:

• Crescendo Lab
• Email: privacy@cresclab.com
• Website: www.cresclab.com