Privacy Policy

1. Data We Collect

Account data: name, email address, and phone number you provide when registering or joining the Platform.

Business data: website content, products, orders, bookings, customers, and marketing content you (or your business) create on the Platform.

Third-party authorization data: access tokens and basic account identifiers obtained with your explicit consent when you connect Facebook Pages, Instagram, Google, or LINE accounts to the Platform (see Sections 2 and 3).

Technical data: sign-in records, device and browser information, operation logs, and cookies (for security auditing and troubleshooting).

2. Google User Data

When you connect your Google account to the Platform, we request only the following permissions, each used solely for the stated purpose:

1. Basic identity (openid, email): to identify the connected Google account and show its connection status in your dashboard.

2. Search Console read-only: to read the search performance of your own website (impressions, clicks, position, top search queries), used to present reports to you in your dashboard and to provide the title optimization feature described below.

3. Title optimization and AI processing: to generate title suggestions for your website, your site name, tagline, location, room type names, current page title, and top Search Console queries are processed by the Google Gemini API (an AI model service), solely to provide this feature to you. If you enable "auto optimization", the system applies a generated title to your own website on your behalf based on the evaluation (you can turn it off at any time, and the performance card shows each applied result).

4. Google Analytics read-only: to read the traffic reports of your own website, used solely to present data to you in your dashboard.

5. Business Profile management: to publish or update your own Google Business Profile content when you request it or enable automation.

The use and transfer of information received from Google APIs by the Platform adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: (1) such data is only used to provide or improve user-facing features, is not used for advertising, and is not sold; (2) we do not transfer such data to third parties except: as necessary to provide or improve user-facing features and only with your consent (such as processing by the Gemini API described above when you use the title optimization feature), for security purposes (such as investigating abuse), to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent; (3) we do not allow humans to read such data except with your affirmative agreement for specific data, when necessary for security purposes (such as investigating abuse), to comply with applicable law, or when the data has been aggregated and anonymized for internal operations.

3. Meta and Other Third-Party Platform Data

When you connect a Facebook Page or Instagram account, the Platform acts only within the scope you explicitly authorize and actively request (or automation you enable): publishing or scheduling posts on your behalf; reading the performance data, comments, and live comments of your own Page or account (for features you enable, such as live-sale order creation), and presenting reports only to you.

We do not sell such data or provide it to unrelated third parties, nor use it for any purpose beyond your authorization.

4. How We Use Data

To provide, operate, and improve the Platform; to generate reports in your dashboard; to run automation you enable; to provide customer support; and to comply with legal obligations.

5. Data Sharing

We do not sell your personal data. We share data only with service providers necessary to deliver the service (such as cloud hosting, database services, and the Google Gemini API described in Section 2) to the minimum extent required, when required by law or competent authorities, or with your explicit consent.

6. Retention, Deletion, and Revoking Authorization (Data Deletion Instructions)

1. Disconnecting social accounts: you may disconnect any platform at any time in "Marketing Center - Connected Accounts". Upon disconnection the Platform immediately disables related features and deletes the stored authorization credentials. To also remove the app authorization on the provider side, visit Facebook "Settings and Privacy - Business Integrations" or your Google Account "Security - Third-party access".

2. Deleting your account and data: email kuei.ti.wan@gmail.com to request account deletion. We will delete your personal data and social authorization data within 30 days (except transaction records required to be retained by law).

7. Security

All third-party access tokens and refresh tokens are stored encrypted with AES-256-GCM; plaintext tokens never reach the database. Only controlled server processes necessary for the service can decrypt them, and no external API returns tokens. The Platform uses HTTPS throughout, enforces role-based access control, and fully isolates data between tenants.

8. Cookies

The Platform uses essential cookies to maintain sign-in state and security verification (such as the anti-forgery state in OAuth flows). When a merchant enables marketing tracking (GA4, Meta Pixel, etc.), their storefront or website pages load the corresponding tracking codes per the merchant settings, and related processing follows the policies of those tracking providers.

9. Your Rights

You may access, copy, correct, or delete your personal data as provided by law, and may revoke third-party authorizations at any time as described in Section 6. To exercise these rights, contact: kuei.ti.wan@gmail.com.

10. Changes to This Policy

Updates to this policy will be published on this page with a revised "last updated" date. Material changes will be announced on the Platform or by email.