Privacy Policy

Effective 2026-10-16

MyBotX is a tool that businesses use to manage their Facebook Pages and Instagram professional accounts: reading and answering comments and messages, automating replies, and sending permitted messages to their customers. It is operated by the operator of app.mybotx.app ("we"). This policy explains what information the service handles, why, and the choices people have.

Two kinds of people

• Business users — people who sign up and use MyBotX for their business (owners, admins, agents).
• Customers of those businesses — people who comment on, or message, a Facebook Page or Instagram account that a business has connected to MyBotX.

For customers' information, the business that connected its Page decides why and how it is used; we process it on that business's behalf, only to provide the service to it.

What we collect

About business users:

• name, email address, a hashed password (never the password itself), two-factor authentication settings, team roles and the workspaces they can open;
• when they connect a Page: the Facebook or Instagram user ID that authorized the connection, the Pages and accounts they chose, and the access tokens Meta issues for them;
• billing records (plan, invoices and payment status) and a log of important actions (audit log) for security.

About customers, from Meta's APIs, only for the Pages and accounts a business connected:

• the ID Meta assigns to that person for that Page (a page-scoped ID), and the name, username and profile picture Meta makes available;
• the messages and comments they send to the Page, the pictures in them (we keep a copy, because Meta's links expire), and when they were sent;
• the replies the business sends them, and whether Meta reports them as delivered or read;
• what the business adds itself: tags, notes, email or phone number if the customer gives it, and custom fields.

We do not collect customers' passwords, their friends, their personal profile pages, or anything from Pages that are not connected.

How we use it

• to show each business its own conversations and comments, send the replies and messages it chooses, run the automations it sets up, and show it statistics about its own Pages;
• to keep the service secure and working (signing in, preventing abuse, fixing problems) and to meet legal obligations.

We do not sell information, do not use it for advertising, and do not combine one business's customers with another's. Information received from Meta is used only to provide the service to the business that connected the Page, as Meta's Platform Terms require. Messages are sent only within the limits Meta sets (for example the 24-hour messaging window).

Who it is shared with

• Meta, to deliver the replies and messages a business sends, and to read the comments and messages of its connected Pages.
• Google, only when a business connects its Google account to send leads to Google Sheets: MyBotX writes the rows the business set up (for example a customer's name and phone number) into spreadsheets it created in that account. It can only open spreadsheets it created (Google's drive.file permission), reads the account's email address to show which account is connected, and does nothing else with Google data. MyBotX's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: it is not sold, not used for advertising, and not read by people except to fix a problem the business reports or when the law requires it. Disconnecting the account in MyBotX revokes the access.
• Service providers that run the service for us under confidentiality: our hosting provider (servers and backups) and our email provider (account emails such as sign-in links and alerts); a payment provider when a business pays online.
• Authorities, only when the law requires it.

Each business's information is kept separate from every other business's, enforced in the database itself.

How long we keep it

• Account information: while the account exists.
• Conversations, comments and contacts: until the business deletes them, deletes the Page from MyBotX with everything it collected, or closes its account.
• Pictures customers send: until the business deletes them (the operator may set a shorter period).
• Step-by-step logs of automations: 90 days.
• Access tokens: until the Page is disconnected, the person who connected it removes the app in Facebook, or Meta asks us to delete them.
• Database backups: kept for the backup period (14 days unless the operator changes it), then overwritten.

Choices and deletion

• Businesses can export their contacts, erase a single person and everything about them, disconnect a Page, or delete a Page together with everything it collected.
• Customers who want their information removed can ask the business they wrote to, or contact us; we will pass the request on or act on it.
• Anyone who connected a Page can remove MyBotX in their Facebook settings and request deletion; see Data deletion for how, and to check the status of a request.

Security

Connections use HTTPS. Access tokens and two-factor secrets are encrypted (AES-256-GCM) in the database; passwords are stored only as Argon2 hashes. Team members see only the workspaces they are given, and important actions are recorded in an audit log.

Children

MyBotX is a business tool and is not intended for children. Business users must be adults.

Changes

If this policy changes, the new version is published here with a new effective date; important changes are also announced to business users by email.