Privacy Policy

1. What this app does

AI Sales Inbox is a software service (SaaS) for online sellers in Bangladesh who sell on Facebook, Instagram, WhatsApp, TikTok and YouTube. It brings a seller’s messages and comments from those channels into one inbox, lets an AI sales assistant answer customers, show products, and take orders, and lets the seller manage orders, coupons, stock, scheduled posts, couriers and billing from one dashboard.

The app is used by sellers (our customers). The people who message a seller’s Page or channel — the buyers — are not our direct users; their messages reach us only because the seller connected their Page or channel to our app.

2. Data we collect

2.1 Data from sellers (people who sign up)

• Name, email address, password (stored as a secure hash, never in plain text), business name.
• Products the seller adds: product names, descriptions, prices, stock, photos.
• Orders, coupons, scheduled posts, and billing/wallet records the seller creates — including the amount and transaction ID (TrxID) the seller submits for a manual bKash, Rocket or Nagad Send Money top-up.

2.2 Data from Facebook and Instagram (via Meta’s APIs)

When a seller connects their Facebook Page or Instagram account, and only with the permissions the seller approves, we receive:

• Page messages (Messenger): the text of messages buyers send to the seller’s Page, the sender’s Facebook user ID and name, and the Page ID.
• Facebook comments: comments on the seller’s Page posts — comment text, comment ID, the commenter’s name and Facebook user ID, and the post ID.
• Instagram direct messages: the text of messages sent to the seller’s Instagram account, the sender’s Instagram user ID and name.
• Page and account identifiers: Page ID, Instagram account ID, and the access tokens needed to receive and reply to messages. Access tokens are stored encrypted (AES-256-GCM) and are never shown to anyone.

We do not collect buyers’ Facebook passwords, private friend lists, or any data from Pages or accounts the seller has not connected.

2.3 Data from YouTube (via Google’s APIs)

When a seller connects their YouTube channel, and only with the scopes the seller approves on Google’s consent screen (read channel and videos, upload videos, reply to comments), we receive:

• The Google account’s name and email address used for the connection, and the channel’s ID, name and handle.
• The channel’s videos (titles, descriptions, video IDs) and comments on those videos (comment text, commenter name and channel ID) so the seller can read and reply to them.
• The access and refresh tokens needed to upload videos and reply to comments on the seller’s behalf. Tokens are stored encrypted and are never shown to anyone.

We do not collect the seller’s Google password, and we do not read or store videos or comments from channels the seller has not connected.

2.4 Data from TikTok (via TikTok’s APIs)

When a seller connects their TikTok account, and only with the scopes the seller approves, we receive:

• The TikTok account’s open ID, username and display name.
• The account’s videos (video IDs, titles) and comments on those videos, so the seller can read and reply to them, and schedule video posts.
• Direct messages sent to the seller’s TikTok Business account (where the seller has Business Messaging access), so they appear in the seller’s inbox and can be replied to.
• The access tokens needed for these actions. Tokens are stored encrypted and are never shown to anyone.

2.5 Data from WhatsApp (via Meta’s WhatsApp Business API)

When a seller connects their WhatsApp Business number, and only with the seller’s approval, we receive:

• The WhatsApp Business phone number ID and display name.
• Messages customers send to that number (text and images) and the sender’s phone number and profile name, so they appear in the seller’s inbox and can be replied to.
• The access token needed to send replies. Tokens are stored encrypted and are never shown to anyone.

2.6 Data buyers give while ordering

When a buyer places an order through chat, the AI assistant asks only for what is needed to deliver the order: name, phone number, and delivery address. This information is stored with the order and shown to the seller. When the seller books a courier, the buyer’s name, phone number and address are shared with the courier (Steadfast or Pathao) so the parcel can be delivered.

2.7 Cookies and browser storage

We store a login token in your browser’s local storage so you stay signed in to the dashboard. We do not use third-party advertising cookies, and we do not track you across other websites.

2.8 Data we do not collect

• We do not collect full payment card numbers or CVV. Wallet top-ups are confirmed manually by our team; no live payment gateway is connected yet.
• We do not collect the passwords of any Facebook, Instagram, Google, TikTok or WhatsApp account.
• We do not sell any personal data to anyone, and we do not use buyers’ messages for advertising.

3. Why we use the data

• Messages and comments (Facebook, Instagram, WhatsApp, TikTok, YouTube): show them in the seller’s unified inbox; let the AI assistant reply; let the seller reply.
• Buyer name, phone, address: create and deliver orders; contact the buyer about their order; book a courier.
• Product data: show product cards in chat; check price and stock before answering.
• Videos and scheduled posts: publish the seller’s scheduled videos and posts to the channels the seller connected, only when the seller scheduled them.
• Seller account data: log in; manage the seller’s workspace and team.
• Wallet and AI-usage records: charge the seller per AI reply (as shown in the dashboard); keep a billing ledger.
• Access tokens: receive messages and send replies on the seller’s behalf, only for connected Pages, accounts and channels.

The AI assistant only answers from the seller’s own product data (price and stock from the product table). It never invents prices, stock, or discounts. If it is not confident about an answer, it hands the chat to a human.

4. How long we keep data

• Chat messages, comments, orders, and customer records are kept while the seller’s workspace is active, so the seller can see order history and past conversations.
• When a seller asks us to delete their data, we delete their workspace data (messages, customers, orders, products, tokens) within 30 days of the request.
• Billing/ledger records needed for accounting may be kept longer in anonymised form (without names, phone numbers, or addresses).
• A buyer can ask for their own messages and order details to be deleted (see section 6). We delete them within 30 days.

5. Who we share data with

• The seller: a buyer’s messages and order details are shown to the seller whose Page or channel the buyer messaged. That is the purpose of the app.
• AI providers: message text and product data are sent to the AI provider configured in the dashboard (Google Gemini by default) so the AI can draft a reply. The AI provider does not receive the seller’s password or access tokens.
• Meta Platforms, Inc.: messages and comments are received from and sent back through Meta’s Graph API and webhooks (Facebook, Instagram, WhatsApp).
• Google (YouTube): channel, video and comment data are received from and sent back through Google’s YouTube Data API.
• TikTok: account, video, comment and message data are received from and sent back through TikTok’s APIs.
• Couriers (Steadfast and Pathao): when the seller books a delivery, the buyer’s name, phone number and delivery address are shared with the courier so the parcel can be delivered.
• We do not share data with advertisers, data brokers, or any other third party.

6. How to ask for deletion (buyers and sellers)

Full instructions are on the Data Deletion page.

Sellers: write to us through the Contact page with the subject “Delete my data” and the email address you signed up with. We delete your workspace data within 30 days and confirm when it is done.

Buyers: if you messaged a seller’s Page or channel and want your messages or order details deleted, use Facebook’s own flow — go to Facebook Settings → Apps and Websites → AI Sales Inbox → Remove, then follow the data deletion link provided there. Meta sends the request to our system automatically and we delete your messages, conversations and customer record within 30 days. You can also tell the seller the name of the Page you messaged, your name, and what you want deleted (messages / order details / everything).

7. Security

• Page, channel and account access tokens are encrypted at rest (AES-256-GCM).
• Passwords are stored as hashes, never in plain text.
• Each seller’s data is separated by workspace; one seller cannot see another seller’s inbox, orders, or customers.
• Access to our servers is limited to our team.

8. Children’s data

The app is for sellers running a business. It is not directed at children under 13, and we do not knowingly collect data from children.

9. Your rights

You can ask us what personal data we hold about you, ask us to correct it, or ask us to delete it (see section 6). Sellers can also disconnect a Page, account or channel at any time from the Channels page — disconnecting stops new messages from arriving, and the stored data for that channel is deleted when you ask us to delete it.

10. Changes to this policy

If we change this policy, we will update the “Last updated” date above and notify sellers by email. The current version is always at ai-sales-inbox-web.vercel.app/privacy.

11. Contact

AI Sales Inbox is operated by Year Media. Questions about this policy or about your data: email us at info.yearmedia@gmail.com, or contact us through the Contact page. You can also visit ai-sales-inbox-web.vercel.app.