Who we are
replyFplus is operated by [company legal name], [registered address]. For anything in this policy, write to support@replyfplus.com.
Whose data this covers
Our customers: people who sign in to replyFplus to manage a Facebook Page. We are responsible for their account data.
People who message those Pages: we handle their conversations on behalf of the business that owns the Page. If you messaged a business, that business decides how your conversation is used, so please contact it first.
What we collect
- Your account: your Facebook user ID, name and profile picture, your email address if Facebook provides it, the permissions you granted, and your plan and monthly usage.
- Access to your Pages: each connected Page's name, category and picture, and the access tokens Facebook issues. Tokens are encrypted when stored.
- Conversations: for each person who messages a connected Page, their Page-scoped ID, name and picture where Facebook provides them, plus messages, attachment links, reactions, and read and delivery details. This includes history Facebook makes available when you connect, which is the most recent 20 messages of each conversation.
- What you create: labels, saved templates, campaigns and their per-person results.
- Developer settings: a scrambled (hashed) copy of each API key, usage dates, webhook addresses, encrypted webhook secrets and a log of webhook deliveries.
- Cookies: one cookie that keeps you signed in for up to 30 days and one that protects the sign-in step for 10 minutes. We use no advertising or analytics cookies.
How we use it
We use this data only to run the service: to show your conversations, send the replies and campaigns you ask for, enforce plan limits, deliver events to webhook addresses you set up, keep the service secure, and answer support requests. We don't post to your Page, sell personal data, or use it for advertising.
Who we share it with
- Meta, because replyFplus reads and sends Messenger messages through Meta's platform.
- Google (Firebase), which stores our database in the United States.
- Vercel, which hosts the website and application.
- Addresses you choose: webhook endpoints and API integrations you set up receive the data you direct to them.
- A payment provider, once paid plans begin. We will name it here first.
We may also disclose data if the law requires it. Because these providers are abroad, your data may be processed outside your own country.
How long we keep it
- Account data, conversations, labels, templates and campaigns: until you ask us to delete them.
- Webhook delivery logs: 14 days. Raw event records from Meta, kept for troubleshooting: 7 days.
- Disconnecting a Page or removing the app stops new data, but stored history stays until you request deletion.
Deleting your data
You have two ways to do this:
- In your Facebook settings (Settings & privacy › Apps and websites), remove replyFplus and send a data deletion request. Facebook notifies us, we delete the data, and you get a confirmation code to check on the data-deletion status page.
- Or email support@replyfplus.com from the address on your account.
This deletes your account, API keys and webhook settings, and any Page only you had connected, along with its conversations. A Page other people also connected stays available to them.
Your rights
You can ask us for a copy of your data, or ask us to correct or delete it, by writing to support@replyfplus.com. You may have further rights under the law where you live.
Security
Access tokens and webhook secrets are encrypted when stored, API keys are kept only as hashes, and browsers can't reach the database directly. No system is perfectly secure, so please keep your Facebook account and API keys safe.
Children
replyFplus is a business tool and isn't meant for anyone under 18.
Changes
We will post any changes on this page with a new date, and tell account holders about important ones.