Privacy Policy

1. About Us & Data Controller

This Privacy Policy applies to the services, applications, websites, and APIs provided by KINDLY TECH LTD (operating AICommentReply, "we", "us", or "our"), a licensed private limited company registered in England and Wales (United Kingdom) under Company Number 16459346, with headquarters located at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, UK (Contact Email: [email protected]).

When you (the "Merchant" or "User") connect social channels and configure automated AI Assistants, AICommentReply acts as a Data Processor on your behalf regarding end-customer inquiries and comments, while you remain the Data Controller. With respect to your merchant account details, billing, and direct website usage, AICommentReply acts as a Data Controller under the UK General Data Protection Regulation (UK GDPR), the EU GDPR, and the California Consumer Privacy Act (CCPA/CPRA).

2. Meta Platform Data & Graph API Permissions

AICommentReply accesses Meta platform data exclusively through official, documented Meta Graph API endpoints pursuant to the Meta Platform Terms and Developer Policies.

Below is the complete list of Meta permissions our platform requests, along with the precise business purpose for each:

We strictly do not request, access, or store personal Facebook profiles, personal friend lists, private user timelines, camera rolls, or biometric data.

3. Generative AI Processing & Subprocessor Transparency

AICommentReply utilizes enterprise Generative AI language models provided by OpenAI LLC (San Francisco, CA, USA) as an AI infrastructure subprocessor.

• Ephemeral Inference: Comment text and your knowledge base context are transmitted to OpenAI's API securely over TLS 1.3 exclusively for real-time inference.
• Data Minimization: Only the immediate inquiry text necessary to formulate an accurate answer is transmitted. Sensitive fields (e.g. passwords, payment card numbers) are never processed.
• Sentiment Analysis: AI evaluates whether public comments contain vulgarity, harassment, or spam so our shield can protect your brand reputation.

4. Data Security & Cryptography at Rest

We maintain state-of-the-art technical and organizational measures to safeguard platform data against unauthorized access, loss, or disclosure:

• AES-256-CBC Encryption at Rest: All Meta OAuth access tokens and WhatsApp system tokens are encrypted using AES-256-CBC with application keys before being written to our database. Decryption keys are stored in secure environment secrets separate from database backups.
• TLS 1.3 In-Transit: All communication between end-users, our servers, Meta Graph API endpoints, and payment gateways is encrypted using HTTPS and TLS 1.3.
• Database Isolation: Multi-tenant tenant scoping strictly prevents cross-account data leakage.
• CSRF & Webhook Signature Verification: Inbound Meta webhooks verify SHA-256 HMAC signatures (`X-Hub-Signature-256`) against our app secret before processing any payload.

5. Data Retention & Automated Pruning

We strictly enforce data minimization schedules in accordance with Meta Platform Terms Section 6:

6. Data Deletion Instructions & Self-Service Tools

Pursuant to Meta Developer Guidelines and UK/EU GDPR, you have the absolute right to have your data erased permanently. We provide three accessible pathways:

1. Meta User Data Deletion Callback: Removing the AICommentReply application inside your Facebook account (Settings > Apps and Websites > Remove) automatically triggers our server-to-server deletion webhook. You will receive an official confirmation URL and tracking code. Read the full step-by-step instructions at our dedicated Meta Data Deletion Instructions page.
2. Self-Service Dashboard Purge: Authenticated merchants can execute an instant, complete wipe of all social connections, tokens, and leads at Dashboard > Privacy & Security.
3. Direct DPO Request: Email our privacy engineering team at [email protected] with the subject "Data Erasure Request". Requests are fulfilled within 24 business hours.

7. Your Legal Rights (UK GDPR, EU GDPR & CCPA/CPRA)

Depending on your geographic jurisdiction, you enjoy the following statutory privacy rights:

• Right to Access: You can request a complete copy of all personal data held about you.
• Right to Data Portability: You can export your full platform profile, connected channels, and CRM leads as a machine-readable JSON file directly from your dashboard.
• Right to Rectification: You can correct incomplete or inaccurate data at any time.
• Right to Erasure ("Right to be Forgotten"): You can request the permanent deletion of your data.
• Right to Restriction & Objection: You can object to certain data processing activities.
• Non-Discrimination: We do not discriminate against any user for exercising their statutory privacy rights.

8. Cookies & Tracking Technologies

We use cookies and browser local storage to provide secure session authentication, remember user preferences, and analyze anonymized site traffic. We display an interactive Cookie Consent banner to all first-time visitors allowing you to choose whether non-essential cookies are enabled.

For detailed information regarding cookie lifespans, providers, and settings, please review our comprehensive Cookie Policy or click Cookie Settings to adjust your preferences anytime.

9. International Data Transfers

As an international social media automation service, your information may be processed in the United Kingdom, the European Union, and the United States (where Meta Graph API servers and OpenAI processing nodes reside). Whenever personal data is transferred outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are implemented, including Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Addendum.