Privacy Policy
Last updated:
Summary
This page explains what data MessengerMate Pro collects, how we use it, and how you can ask us to delete it. We try to use plain language. If anything here is unclear, email privacy@messengermatepro.com and we will rewrite the section.
MessengerMate Pro is an AI-powered customer-conversation assistant for Philippine SMEs. The service is built and operated by S RANK Computer Programming Services, a software development studio based in Biñan, Laguna, Philippines. "We" and "us" throughout this policy refer to S RANK Computer Programming Services.
1. What we collect
MessengerMate Pro has two kinds of users: business owners, who sign in to our dashboard and connect their Facebook Page, and their customers, who message that Page on Messenger or its linked Instagram account. We collect only what the service needs.
From business owners
- Sign-in details — your email address and password (passwords are handled by our authentication provider and never stored in plain text), or your Google or Facebook sign-in
- Business details you enter — business name, description, location, operating hours, delivery and pickup settings, your product and service catalog with photos, and the payment channels you choose to share with your customers (for example a GCash account name, number, and QR code)
- Your Facebook connection — when you connect a Page: the app-scoped Facebook user ID of the person who connected it, the Page ID and Page name, the Page access token (stored encrypted), and the ID and username of the Instagram Professional account linked to that Page
From customers who message a connected business
- Messenger or Instagram sender ID — the page-scoped ID Meta gives us for that conversation
- Display name — read once from Meta when the conversation starts, so the business owner's inbox shows who is writing (on Instagram, the name or username)
- Message content — the messages customers send to the connected Page or Instagram account, the images they attach, and the replies sent back
- Order details — what a customer tells us when they order or book: items and quantities, delivery or pickup, delivery address, preferred time, and payment method
We do not read customers' profile photos, posts, comments, followers, or anything else from their Facebook or Instagram accounts.
From visitors to this website
- Email address — if you join the waitlist
- IP address and basic browser metadata — captured by Cloudflare on every request, used only for security and abuse prevention
2. How we use your data
- To answer customers. A customer's message, the recent conversation, the customer's orders with that business, and the business's own catalog and details are sent to our AI provider to write a reply, which we send back through Meta on the business's behalf. Customer names are not sent to the AI.
- To run the business owner's inbox. The owner sees each conversation with the customer's name, can reply themselves, and manages the orders customers place in the chat.
- To keep the connection working. The Page access token is used only for the Meta API calls the service needs: listing your Pages when you connect, subscribing the chosen Page to our webhook, sending and receiving messages, reading the Page name and its linked Instagram account, and reading a new customer's display name.
- Email is used to tell waitlist subscribers when MessengerMate Pro is ready and to send service notices (e.g. "your account has been deleted as requested"). We do not send marketing emails to waitlist subscribers.
- We do not use message content to train AI models.
- We do not sell your data. Ever. Not in aggregate, not anonymized, not at all.
- We do not use your data for advertising to you or anyone else.
3. Sub-processors
We share data with these vendors strictly to deliver the service. Each handles only what they need.
- Supabase — database, sign-in, and file storage: business accounts, conversations, orders, images customers send, and payment QR codes
- Cloudflare — hosting, CDN, request logs, bot protection (Turnstile)
- OpenAI — AI reply generation. It receives message text, order details, and the business's details, never customer names. Data sent to OpenAI is governed by their API terms (no training on submitted data). We will update this list if we change providers.
- Resend — email delivery (waitlist confirmations, transactional notices)
- Meta — message delivery through the Messenger and Instagram messaging APIs
When you connect a Meta account, your data also flows through Meta per their terms.
4. How long we keep your data
| Data | Retention |
|---|---|
| Customer conversations (names, messages, images) and orders | Kept while the business's account exists, so the owner can see the history. Deleted when the business owner asks us to delete them, or when Meta sends us a data deletion request for the person who connected the Page. Disconnecting a Page stops new messages but keeps existing conversations, which come back if the same Page is reconnected. |
| A message the customer unsends | Deleted from our inbox as soon as Meta tells us it was unsent |
| Page access token, Page ID and name, linked Instagram account | Deleted when you disconnect the Page or remove our app from your Facebook account |
| Business account and catalog | Until you ask us to delete your account |
| Waitlist email | Until you ask us to delete it, or until the product launches and you choose not to convert |
| Account/billing records | 7 years after account closure (Philippine tax law requirement) |
| Server logs | Up to 30 days |
5. Your rights
Under the Philippine Data Privacy Act of 2012 (RA 10173) and aligned with GDPR principles, you have the right to:
- Access — request a copy of all data we hold about you
- Correct — fix inaccurate data
- Delete — request that we erase your data
- Object — refuse certain processing
- Withdraw consent — at any time, with effect going forward
To exercise any of these, use the Data Deletion Request page or email privacy@messengermatepro.com.
We will respond within 30 days. Most requests are completed in under 7 days.
6. Lawful basis for processing
- Consent — when you join the waitlist or connect a Meta account, you are consenting to the processing described here
- Contract — once you become a paying customer, we process your data to deliver the service you paid for
- Legitimate interest — for security, fraud prevention, and basic service operation
7. Security
- All data is transmitted over HTTPS
- We use Cloudflare's standard security posture (WAF, bot protection, DDoS mitigation)
- Meta access tokens are stored encrypted at rest (AES-256-GCM)
- Every message Meta sends to our webhook is checked against Meta's signature before we process it
- Each business can only see its own conversations, orders, and settings
- We follow the principle of least privilege internally — only engineers who need access to a system have it
- We will publish post-incident reports for any breach affecting customer data
We are a small team and we take this seriously. We are not making claims of ISO 27001 or SOC 2 compliance — we are not certified, and we will tell you when we are.
8. International transfers
Our database and file storage (Supabase) are hosted in Japan, and some sub-processors (notably OpenAI, Cloudflare, Resend) operate primarily in the United States; Cloudflare also serves requests from data centers close to you, including in the Philippines. Your data may be transferred to and processed in those countries. These vendors use standard contractual clauses or equivalent mechanisms.
9. Children
MessengerMate Pro is a B2B service. It is not intended for use by anyone under 18. We do not knowingly collect data from children. If you believe a child has shared data with us, email privacy@messengermatepro.com and we will delete it.
10. Cookies
The waitlist site uses one functional cookie set by Cloudflare Turnstile to verify you are not a bot when you submit the form. We do not use analytics cookies, advertising cookies, or third-party tracking on the marketing site.
The MessengerMate Pro dashboard keeps your sign-in session in your browser's local storage so you stay signed in. It uses no analytics, advertising, or third-party tracking cookies either.
11. Changes to this policy
When we update this Privacy Policy, we will:
- Update the "Last updated" date at the top of this page
- Email all active customers and waitlist subscribers about material changes (not minor wording fixes)
- Keep an archive of previous versions available on request
12. Contact
- Privacy questions: privacy@messengermatepro.com
- Data deletion requests: /data-deletion
- General contact: hello@messengermatepro.com
You also have the right to lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph).