This Privacy Policy explains how Tact (“Tact”, “we”, “us”) collects, uses, shares and protects information when businesses use Tact to manage comments and messages on their Instagram and Facebook accounts, and when people interact with those accounts. It also explains the choices you have, including how to delete your data.
1. Who this policy covers
- Customers: businesses that create a Tact workspace and connect their Facebook Page and/or Instagram professional account.
- Commenters: people who comment on, or message, a Customer’s ads and posts. Tact processes this data on the Customer’s behalf, as their service provider (data processor). The Customer is responsible for its own customer relationship.
- Visitors: people who use our website, including the public demo.
2. Information we collect
From Meta, when a Customer connects their accounts
- Facebook Page ID and name, Instagram professional account ID and username.
- Access tokens that Meta issues to us for those accounts. We store them encrypted (AES-256-GCM) and never display them.
- Comments on the Customer’s posts and ads: comment ID, text, time, the post or ad it belongs to, and the commenter’s Meta-scoped ID and public name or username.
- Messages we send on the Customer’s behalf (private replies), and their delivery status.
From Customers
- Account details: name, email address, business name and website. Your password is stored only as a one-way hash (scrypt) that cannot be turned back into the password. If you sign in with Google or Facebook, we store the account ID they give us.
- Store information: product titles, prices, availability, images and public policy pages (shipping, returns, FAQ) read from the website the Customer gives us.
- Settings: tone of voice, languages, automation switches and “never say” rules.
From Visitors
- Text you type into the public demo and any store URL you enter. The demo does not store this text.
- Basic technical data needed to run and secure the site (IP address, browser type), and a cookie that remembers your language choice.
3. How we use information
- To classify comments (for example buying intent, spam or complaint) and detect their language.
- To draft and, when the Customer has turned automation on, publish public replies, hide spam or abusive comments, and send one private reply with product information to a commenter who asked about buying.
- To show Customers their dashboard, review queue and reports.
- To secure the service, prevent abuse, and fix problems.
- To meet legal obligations.
We do not sell personal information, use Meta Platform Data for advertising or profiling unrelated to the Customer’s own account, or use comment content to build marketing lists. We use Meta Platform Data only as allowed by the Meta Platform Terms and Developer Policies.
4. AI processing
To understand comments and draft replies, comment text and the Customer’s store information may be sent to an AI model provider (currently Anthropic, and optionally OpenAI) that processes it on our behalf under contract. These providers may not use this data to train their models. When no provider is configured, processing happens inside our own servers.
5. How we share information
- Meta: to publish replies, hide comments and send private replies through the Graph API, as the Customer instructs.
- Service providers: hosting, database, and AI providers that process data for us under confidentiality and data-protection terms.
- Legal reasons: when required by law, or to protect the rights, safety and security of users and the public.
- Business transfers: if Tact is merged or sold, under this policy’s protections.
6. Retention
- Comment and message records are kept while the Customer’s workspace is active, so the Customer can review them.
- When a Customer disconnects an account or deletes their workspace, we delete its access tokens immediately and its comment data within 30 days.
- Data deletion requests from Commenters are processed as soon as we receive them (see section 9).
- Backups are overwritten on a rolling basis within 35 days.
- To give each shop only one free trial, we keep a one-way fingerprint (a salted hash) of the Facebook account, Pages, Instagram accounts, website and WhatsApp number used for a trial, also after deletion. It cannot be turned back into the original information and is used only to prevent repeat free trials.
7. Security
Data is encrypted in transit (TLS) and access tokens are encrypted at rest. Webhook calls from Meta are verified with a cryptographic signature before we process them. Access to production data is limited to staff who need it to run the service.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict certain processing. This includes rights under the EU General Data Protection Regulation (GDPR) and French law in France, Moroccan Law No. 09-08, Algerian Law No. 18-07, Saudi Arabia's Personal Data Protection Law, the UAE's Federal Decree-Law No. 45 of 2021, and the data protection laws of Qatar, Bahrain, Kuwait and Oman. Commenters can also contact the business whose account they interacted with. To exercise a right, email support@tact.app. We answer within 30 days.
If you are in the European Union, you can also complain to your data protection authority. In France, this is the CNIL (cnil.fr). In Morocco, it is the CNDP.
9. Deleting your data
You can ask us to delete your data at any time. Full instructions, including how to do it from your Facebook settings, are on our Data deletion page.
10. International transfers
We and our providers may process data in countries other than yours, including the United States. Where required, we rely on safeguards such as Standard Contractual Clauses.
11. Children
Tact is a business tool and is not directed at children under 16. We do not knowingly collect their information.
12. Changes
We will post changes on this page and update the date above. If a change is significant, we will tell Customers by email or in the app before it takes effect.
13. Contact
Tact
support@tact.app