Privacy policy

Who we are

Inbox Agent is operated by [Operator legal name] ("we"). We provide businesses with an AI assistant that replies to their customers in Facebook Messenger and Instagram Direct. For the messages we process on a business's behalf, that business is the data controller and we act as its processor.

What we collect

• Business users: email address, password hash and workspace membership.
• From Meta, with the business's permission: Facebook Page and Instagram professional account ids and names, Page access tokens (stored encrypted), and the app-scoped id of the person who connected them.
• Customer conversations: the Page-scoped or Instagram-scoped id of each customer, message text, timestamps and the raw webhook event Meta sends.

How we use it

• To receive messages sent to the business and generate replies with Anthropic's Claude models.
• To show conversations to the business's staff and let them reply or take over.
• To keep the service secure and to troubleshoot problems.

We do not sell personal data or use customer conversations for advertising.

Who we share it with

• Meta Platforms, to receive and send messages through the Messenger Platform and Instagram Messaging API.
• Anthropic, which processes conversation text to generate replies.
• Supabase (database and authentication) and our hosting provider, which store and serve the data.

Retention and deletion

We keep conversation data while the business keeps its workspace. A business can disconnect a channel at any time, which deletes its stored access token. If you remove Inbox Agent from your Facebook account, Meta notifies us and we delete the tokens you granted and your app-scoped id; see the data deletion page for the status of a request. Customers who want their conversation deleted can ask the business they messaged or contact us directly.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, and object to its processing. Contact us at [privacy contact email]. You can also complain to your local data protection authority (in Lithuania, the State Data Protection Inspectorate).