Privacy Policy

• Subscribers: business owners who have a Deraa account and connect their own Pages.
• Commenters and senders: people who comment on, or message, a Page or Instagram account that a subscriber connected to Deraa.

• Sign-up and account details: name, business name, email address, phone number, and notes written in the sign-up request.
• Password, stored only as a one-way hash that we cannot read.
• Access tokens granted through Meta when a Page is connected, stored encrypted with AES-256-GCM.
• Content the subscriber enters to configure the assistant: knowledge sources, post details, reply rules, tone, and the shop’s WhatsApp number.
• An audit log of administrative actions in the account, and monthly usage counts.

After a subscriber connects a Page and grants the permissions, Meta sends us the following, for that Page only:

• The text of comments and messages sent to the Page, with their comment, post and message IDs.
• The commenter’s or sender’s display name and their Page-scoped ID.
• The Page name and ID, and the text of a post when needed to understand a comment on it.
• If the subscriber connects an Instagram professional account: the account ID and username, the captions of its posts, the comments and direct messages sent to it, and the commenter’s username.
• When the subscriber chooses “Import from my Page”: the Page’s public About information, posts and reviews, and the subscriber’s own earlier replies to comments and messages.
• If the subscriber connects a WhatsApp number: customers’ messages to that number, and the sender’s phone number and WhatsApp name.
• If the subscriber turns on order taking: what the customer writes in the private chat to complete an order — the product, quantity, name, phone number and address.

We never ask for or receive Facebook or Instagram passwords, friend lists, or any messages outside the connected Page or Instagram account.

• To prepare a reply to a comment or message and publish it as the subscriber’s Page or Instagram account.
• To hide abusive or spam comments, according to the subscriber’s settings.
• To alert the subscriber to complaints that need a human follow-up.
• To show the Page owner which commenters are likely customers (interested in buying, has a complaint, not serious), based only on their comments and messages to that Page.
• To show the subscriber logs and statistics, and to count usage.
• If the subscriber enables them: a message to the customer about their order’s status, and one follow-up to someone who asked in a private chat and did not order, within what Meta’s policies allow.
• Notes and labels the Page owner writes about their own customers; they stay in that account and are deleted with the customer’s data on request.

We do not sell data, use it for advertising, or share it between subscribers. Each subscriber’s data is isolated from every other subscriber. Conversations and orders are visible only to the account owner and the employees they add to their own team.

• Meta (Facebook and Instagram): we receive comments and messages from Meta and publish replies through Meta.
• AI provider: we send the text of a comment or message together with the subscriber’s knowledge sources, so it can choose the right answer and classify the comment. When the subscriber uses “Import from my Page”, we send the Page’s content and the subscriber’s earlier replies, without commenters’ names or IDs, so it can suggest knowledge sources that the subscriber reviews before saving. We never send access tokens or passwords.
• Email provider: to send account alerts to the subscriber, if enabled.
• Telegram: if the subscriber links Telegram alerts, we send their chat an alert with the Page name, the customer’s name and the text of their comment or message when someone wants to buy or complains.
• Hosting provider: where our servers and database run.

• Comment and reply text and commenter names in logs: 90 days, after which the text and names are erased and only statistical counts remain.
• A commenter’s classification profile: deleted 90 days after their last comment.
• Orders: kept as the subscriber’s sales record while the account exists, and deleted with the account or at the customer’s request.
• Account data and assistant settings: for as long as the account exists.
• Encrypted backups: 30 days.

• Access tokens are encrypted in the database, and all connections to the service use HTTPS.
• Backups are encrypted with a separate key.
• Administrative access is restricted and recorded in an audit log.

• Subscribers can export their data, disconnect any Page, and permanently delete their account from the “Settings → Privacy & security” screen. Deleting the account deletes its Pages, settings, logs and access tokens.
• Commenters and senders can ask us to delete what we hold about them, as described on the Data Deletion page.
• Subscribers can revoke Deraa’s access at any time from Facebook Settings → Business Integrations.

If we make a material change, we will publish the new version here with its date and notify subscribers in the dashboard.

For any question or request about your data, email support@deraa.app.