Privacy Policy

When you register, we collect your name, email address, and a hashed password. This information is used solely to authenticate you and manage your account.

When you connect a Facebook Page or Instagram Business/Creator account, we collect and store your Meta access tokens, page IDs, Instagram account IDs, and page names. We use this data exclusively to receive webhooks and send automated direct messages on your behalf through the Meta Graph API.

We store keyword rules you create (including which Facebook/Instagram post a rule targets, if any), message templates, scheduled campaigns, and logs of direct messages and comment replies sent through our platform. These logs include commenter IDs, timestamps, matched keywords, and delivery status. We also automatically create a contact record (name, platform ID, tags, notes, DM count) for each person who receives a DM, so you can manage them from your CRM.

Billing is handled by Stripe or PayPal, depending on which you choose. We do not store your credit card or PayPal account details. We store only your Stripe customer ID or PayPal subscription ID, subscription status, and transaction history.

We collect basic usage metrics such as DM counts, rule trigger frequency, and campaign statistics to power your analytics dashboard.

Each time you sign up or log in, we record the IP address the request came from and an approximate location derived from it (country, region, city), for fraud prevention and account security.

If a rule or campaign message includes a link, we automatically shorten it and track click counts. Each click also logs the visitor's IP address and timestamp — this applies to whoever clicks the link, which may include people who have never signed up for SpidyChat themselves.

If you invite teammates (Agency plan), we store their email address and the role you assign them (Viewer, Editor, or Manager).

If you contact support, we store your ticket subject, category, priority, and message history so we can respond to and track your request.

We request the following Meta permissions: pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_metadata, pages_manage_engagement, pages_messaging, instagram_basic, instagram_manage_messages, instagram_manage_comments, and public_profile. These are the permissions required to receive comment webhooks, subscribe pages to our app, send direct messages, and publish public comment replies through the Meta Graph API.

Meta access tokens are used only to subscribe to webhooks and send direct messages or comment replies as instructed by you through your automation rules and campaigns. We do not read, store, or analyze the content of private conversations beyond what is necessary to log DM delivery status.

When you create a rule or schedule a campaign, SpidyChat fetches a list of your recent posts (captions, images, timestamps) directly from the Meta Graph API so you can pick a target post. We store only the ID of the post you select — not its full content.

Meta tokens are stored securely and associated with your account. You can disconnect your Meta accounts at any time from the Settings page, which immediately revokes our access.

We do not sell, share, or transfer your Meta platform data to any third party for advertising or analytics purposes.

If you remove our app from your Facebook account via Facebook Settings → Apps and Websites, Meta automatically notifies us via a data deletion callback. Upon receipt, all data associated with your Facebook account — including access tokens, rules, DM logs, contacts, and payment history — is immediately and permanently deleted from our systems. You can verify the status of a deletion request at any time by visiting /data-deletion?id=[confirmation-code] (the code is provided in the Facebook deletion confirmation).

We retain your account data for as long as your account is active. If you delete your account yourself, or if Meta notifies us of a Facebook/Instagram data-deletion request, all automation data tied to that account — including Meta access tokens, rules, templates, scheduled campaigns, DM logs, CRM contacts, tracked-link data, and payment history — is deleted immediately and permanently. This is not a 30-day process; deletion happens as soon as the request is received. We do not currently enforce a fixed retention period on DM logs before that point — they are kept until account deletion rather than purged on a schedule.

Two categories of data are kept separately and are not covered by the automatic deletion above: login/signup security records (IP address and approximate location) and support-ticket history. We retain these for fraud prevention and support continuity. Email support@spidychat.com if you would like these removed as well, and we will process the request manually.