Privacy policy

Only what the product needs to run your pages.

• Account details: your name, email address and password hash, the name of each workspace you create, and the email address and role of anyone you invite. If you sign in with Google, we receive your name, email address and Google account identifier.
• Your Meta account, when you connect it: your Facebook user ID, name, email address and profile picture link, the permissions you granted, and the access tokens Meta issues, which we encrypt before storing.
• Meta platform data we read with your permission: page and Instagram account identifiers, names, handles and follower counts, posts, comments, direct messages, reaction and comment counts, page-level metrics, and — if you use the ads features — ad accounts and campaigns.
• Of that Meta data we store only a little: page details and tokens; for each direct-message thread, the other person's page-scoped ID with read, delivery and unread markers, but not the message text; and the IDs of comments an auto-reply rule has answered. Message and comment text is fetched from Meta when you open it and is not kept in our database.
• Content you create in the product: posts and scheduled posts with their images, who created and approved them, and the auto-reply rules you write.
• Service logs: technical records of events such as incoming Meta webhooks and automatic replies, which can include page names and page-scoped IDs — used to run the service and troubleshoot faults.

We do not buy data, we do not scrape profiles, and we do not build advertising profiles of the people who comment on your clients' pages.

To show your pages' comments and messages in one place, to publish and schedule the posts you approve, to run the auto-reply rules you write, to show your analytics, to run the ad campaigns you create, and to answer your support requests. We do not use your content or your customers' messages to train models.

Access to Facebook and Instagram data comes from the permissions you grant when you connect, and is used only to provide the features you use for those pages. You can disconnect your Meta account from the Accounts screen at any time: we delete the access tokens we hold for it and stop receiving updates from its pages. Removing a single page from a workspace stops updates for that page. To withdraw the permissions on Meta's side as well, remove Social Zakio in your Facebook settings under Business Integrations. We follow Meta's Platform Terms and Developer Policies, including their limits on retention and onward transfer.

A short, fixed list of processors, each under contract and each used for one job.

• Cloud hosting and database providers that run the service.
• Meta, which receives the posts, replies and campaigns you send through the product, under Meta's own terms.
• Authorities, only where we are legally required, and we tell you unless the law forbids it.

Data is held on servers run by our hosting provider. The text of messages and comments stays with Meta and is not stored on our servers.

Your account, workspace, connected pages, rules and posts stay for as long as the workspace exists, or until you delete them — posts and rules can be deleted, and team members removed, in the product at any time. Meta access tokens are deleted as soon as you disconnect. When you ask us to delete your account or a workspace, we remove it from live systems within 30 days, and it rolls out of backups within 90 days.

Wherever you are, you can ask us to show you the data we hold, correct it, export it, or delete it, and you can object to processing or withdraw a permission — message us on WhatsApp at +971 54 486 6783, giving the email address of the account concerned. In the product you can change your name, delete posts and rules, remove team members and disconnect Meta yourself; exporting data or deleting a whole account or workspace is done on request.

Traffic is encrypted in transit, passwords are stored only as hashes, and Meta access tokens are encrypted before they are stored. Repeated failed sign-in attempts lock the account for a few minutes. Inside a workspace, what each person can do depends on their role. We notify you within 72 hours of confirming a breach that affects your data.

If we change something material, we email the workspace owner at least 14 days before it takes effect. The date at the top always reflects the current version.