Privacy Policy

Crescendo Lab (“we”, “us”, “our”) operates the Social Automation platform (the “Service”) available at social-automation.cresclab.com. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service, including data obtained through Facebook and Instagram APIs.

2.1 Account Information

• Email address and password (hashed) when you register
• Organization/tenant name
• At sign-up, we use the request IP locally to estimate a country for onboarding. Our operational notification includes only the estimated country and a masked IP prefix, not the full IP. This is not nationality or verified residence, and a VPN or proxy can change the estimate.

Country lookup uses a local GeoFeed/Whois/ASN snapshot distributed by ip-location-db, including statistics from the Number Resource Organization (NRO) under CC BY 4.0. Only country codes are used.

2.2 Facebook & Instagram Data

When you connect your Meta account via OAuth, we access:

• Page & Account Info — Facebook Page name, Page ID, Instagram Business account name and ID
• Posts & Comments — Post IDs, comment text, commenter IDs (for keyword matching only)
• Messages — We send automated DMs/Messenger messages on your behalf; message content is generated from your configured templates
• Access Tokens — OAuth tokens are encrypted with AES-256-GCM and stored securely
• Marketing message subscriptions(only if you turn this feature on) — when someone taps the subscribe button in a Messenger conversation, Meta gives us a notification messages token for that person, together with their Page-scoped ID, the subscription topic title, their time zone, and the token's expiry date. We also store the ad account ID you choose to pay for delivery, the resulting message campaign ID, and per-message delivery, read and failure status.

2.3 Activity Logs

• Trigger events (comment received, reply sent, DM sent)
• Timestamps, success/failure status
• Aggregated usage metrics (trigger counts per month)

• Automation — To match keywords in comments and send automated replies and DMs as configured by you
• Dashboard & Analytics — To display activity logs, trigger counts, and account status
• Service Operation — To authenticate your sessions, enforce plan limits, and prevent abuse

We do not use your data for advertising, sell it to third parties, or train AI models.

One clarification, because it involves an ad account: if you enable marketing messages on Messenger, Meta charges your own ad account for each message it delivers. We do not run ads, build audiences, or target anyone. We store only the ad account ID you selected, the message campaign ID, and the spend figure Meta reports back, so we can show you what a send cost and stop at the budget cap you set.

If you enable this optional feature, we help you send promotional Messenger messages to people who asked for them. The rules are set by Meta and enforced by us:

• Opt-in only— a person is added to your subscriber list only after they tap Meta's subscribe button inside their own Messenger conversation. We never import, buy, or infer subscribers.
• One message per person per Page per day — anything beyond that is held back automatically.
• Unsubscribing is built into every message by Meta and cannot be removed or styled by you or by us. When someone stops notifications, we mark them unsubscribed immediately and never contact them again unless they resume.
• Delivery is billed to your ad account by Meta, and stops at the budget cap you set.

We share data only with:

• Meta Platforms, Inc. — API calls to Facebook/Instagram to execute automations on your behalf
• Google Cloud Platform — Hosting provider (Cloud Run, asia-east1 region)
• Google Cloud SQL / PostgreSQL — Database hosting (asia-east1 region)
• Slack — Internal sign-up notifications containing account information, estimated country and a masked IP prefix. We do not send the full sign-up IP to an external geolocation service.
• Google Analytics 4 — Website traffic and marketing funnel analytics. This runs only on our public pages (landing, sign-up, login, and these policy pages). It is not loaded inside the signed-in dashboard, so your campaigns, activity logs, and connected accounts are never sent to Google Analytics.

We do not sell or rent your personal data.

We use two kinds of cookies, and nothing else:

• Session cookie (ig-auth-session) — Strictly necessary. Keeps you signed in. httpOnly, so it cannot be read by scripts.
• Google Analytics cookies (_ga, _ga_*) — Set only on our public pages to measure how people find and move through our website. They record a random identifier, not your name or email. Retained for up to 2 years by Google.

We do not use advertising or cross-site tracking cookies, and Google Signals is disabled on our property. To opt out of Google Analytics you can install Google's opt-out browser add-on or block cookies in your browser settings. Blocking them does not affect any part of the product.

• Account data — Retained while your account is active; deleted within 30 days of account deletion
• Activity logs — Retained for 90 days, then automatically purged
• Access tokens — Encrypted at rest; revoked and deleted when you disconnect your Meta account
• Comment/message content — Processed in real-time for keyword matching; not permanently stored
• Marketing message subscriptions — Kept while the subscription is active. When someone unsubscribes, or their notification messages token expires, we keep the record for up to 90 days so we can honour the opt-out and reconcile billing, then delete it

You can request deletion of your data at any time by:

• Disconnecting your Meta account from the Dashboard (Settings → Connections → Remove)
• Contacting us at privacy@cresclab.com
• Using our data deletion endpoint: POST /api/data-deletion

Upon receiving a deletion request, we will remove all associated data within 30 days and confirm via email.

Disconnecting a Page, deleting your account, or removing our app from your Facebook settings deletes that Page's marketing message subscribers, scheduled and sent messages, broadcasts and sequencesalong with its activity logs and automations. No subscription tokens are retained afterwards.

• Access tokens encrypted with AES-256-GCM
• Passwords hashed with bcrypt
• Webhook payloads verified with HMAC SHA-256 signatures
• All connections over HTTPS/TLS
• JWT session tokens in httpOnly cookies

Depending on your jurisdiction (GDPR, CCPA, PDPA), you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Withdraw consent for data processing

To exercise any of these rights, contact privacy@cresclab.com.

Our use of information received from Facebook and Instagram APIs adheres to the Meta Platform Terms and Developer Policies. Specifically:

• We only request permissions necessary for the Service to function
• We do not sell, license, or otherwise commercialize any data obtained from Meta APIs
• We do not use Meta data to build or augment user profiles for advertising
• We do not transfer Meta data to any data broker or advertising network
• Users can revoke access at any time through Facebook Settings → Apps and Websites

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date.

If you have questions about this Privacy Policy, please contact:

• Crescendo Lab
• Email: privacy@cresclab.com
• Website: www.cresclab.com