Privacy Policy

Last updated: 19 October 2026

This Privacy Policy explains how Inboxgent ("Inboxgent", "we", "us") collects, uses, stores, shares and deletes information when you use our automated messaging service for Facebook Pages and Instagram professional accounts, and when you visit inboxgent.online.

Inboxgent is operated from 70/A Jigatola, Dhaka 1209, Bangladesh. For any privacy question or request, contact contact@inboxgent.online or call +880 1842 545663.

1. Who this policy covers

• Customers — businesses that connect a Facebook Page or Instagram professional account to Inboxgent.
• End users — people who send a message to, or comment on, a Page or Instagram account managed by Inboxgent.
• Website visitors — anyone browsing inboxgent.online.

For end-user message data, the connected business is the data controller and Inboxgent acts as a processor on that business's instructions.

2. Information we collect

2.1 Account information you give us

• Your name, business name, email address and (optionally) phone number.
• Business details you enter so the agent can answer correctly: products, prices, delivery terms, opening hours, policies and preferred tone.
• Billing details, where a paid plan applies. Card data is handled by our payment processor; we do not store full card numbers.

2.2 Information received from Meta Platforms

When you connect your accounts via Facebook Login, we receive only the following:

• Page and account identity — Page ID, Page name, Instagram professional account ID and username, and the access tokens needed to act on your behalf.
• Message content and metadata — the text, attachments, timestamps and thread identifiers of messages sent to your Page's Messenger inbox and your Instagram Direct inbox.
• End-user identifiers — the scoped, app-specific user ID (PSIGU/IGSID) of the person messaging you, and the public profile name and profile picture where Meta makes them available, so the agent can address the person correctly.
• Comments and post context — comments on your posts and ads, and the post text they relate to, so replies make sense.

We do not request or receive your friends list, email address of end users, payment information from Meta, ad performance data, or any Page insight beyond what is listed above.

2.3 Information collected automatically

• Technical logs: IP address, browser type, pages visited, timestamps and error traces, kept for security and debugging.
• Strictly necessary cookies for session login. We do not use advertising or cross-site tracking cookies.

3. Why we use the information (limited use)

We use data received through the Meta APIs only to provide and improve the user-facing features of Inboxgent. Specifically:

Permission	Single purpose of use
pages_show_list	Show your list of Pages so you can select which to connect.
pages_messaging	Receive messages sent to your Page and send automated replies.
pages_manage_metadata	Subscribe your Page to message and comment webhooks.
pages_read_engagement	Read comments and post context needed to generate a correct reply.
instagram_basic	Identify the connected Instagram professional account.
instagram_manage_messages	Receive Instagram Direct messages and send automated replies.
instagram_manage_comments	Read and reply to comments on your Instagram content.
business_management	Confirm that the connected assets belong to your business.

We expressly do not:

• sell, rent or licence Platform Data to anyone;
• use message content for advertising, ad targeting or audience building;
• transfer Platform Data to a data broker, information broker or ad network;
• use Platform Data to build or enrich profiles of individuals for purposes unrelated to replying to their message;
• use Platform Data to train general-purpose AI models for third parties.

Where a third-party AI model provider is used to generate a reply, the message content is sent only for that single request, under contractual terms that prohibit the provider from using it to train their models.

4. Legal bases

Where the GDPR or a similar law applies, we rely on:

• Contract — to deliver the service you signed up for.
• Legitimate interests — security, abuse prevention and service reliability.
• Consent — where you grant Meta permissions through Facebook Login, and for optional communications. You may withdraw consent at any time.
• Legal obligation — where retention or disclosure is required by law.

5. Sharing your information

We share data only with service providers acting on our instructions, and only as needed to run Inboxgent:

• Cloud hosting and database providers — to store and process your data.
• AI model providers — to generate reply text, under no-training terms.
• Payment processors — to take payment on paid plans.
• Error and performance monitoring — to keep the service working.

We may also disclose information where required by valid legal process, or to protect our rights, safety or property. If Inboxgent is involved in a merger or acquisition, data may transfer to the successor under this same policy; we will notify you first.

6. Data retention

Data	Retention period
Message and comment content	Up to 90 days from receipt, then permanently deleted
End-user scoped IDs and conversation state	While the account is connected; deleted within 30 days of disconnection
Meta access tokens	Deleted immediately when you disconnect or revoke access
Account and business profile information	While your account is active, then 30 days
Billing records	As required by applicable tax and accounting law
Technical and security logs	Up to 12 months

When you remove Inboxgent from your Facebook or Instagram account, we stop processing immediately and delete the associated Platform Data within 30 days.

7. Your rights and data deletion

You may, at any time:

• Access — request a copy of the data we hold about you.
• Correct — ask us to fix inaccurate information.
• Delete — ask us to erase your data.
• Export — receive your data in a portable format.
• Object or restrict — object to processing based on legitimate interests.
• Withdraw permissions — remove Inboxgent from your account at any time.

How to request deletion

Choose either route:

1. Email us. Send a message to contact@inboxgent.online with the subject Data Deletion Request, naming the Facebook Page or Instagram account concerned. We confirm within 7 days and complete the deletion within 30 days.
2. Remove the app from Meta. In Facebook, go to Settings & Privacy → Settings → Apps and Websites and remove Inboxgent; for Instagram, remove the business integration in your account settings. Revocation reaches us automatically and we delete the associated data within 30 days.

End users who have messaged a business using Inboxgent may also email us directly to request deletion of their conversation data. We will act on the request and inform the business concerned.

8. Security

• All data is encrypted in transit with TLS and at rest.
• Access tokens are stored encrypted and never exposed in client-side code or logs.
• Access to production systems is restricted to authorised personnel, on a need-to-know basis, with multi-factor authentication.
• We log administrative access and review it regularly.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority without undue delay, and in any case as required by applicable law.

9. International transfers

Our providers may process data in countries other than yours, including the United States and the European Union. Where required, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.

10. Children

Inboxgent is a business tool and is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect data from children. If we learn that we have, we delete it.

11. Changes to this policy

We may update this policy. The "Last updated" date above always reflects the current version, and we will notify customers by email of any material change before it takes effect.

12. Contact

Inboxgent
70/A Jigatola, Dhaka 1209, Bangladesh
Email: contact@inboxgent.online
Phone: +880 1842 545663

If you are not satisfied with our response, you may lodge a complaint with your local data protection authority.