1. Who this policy covers
Safi Al Sunnah CRM is a staff-operated customer relationship management service at smssafi.lovable.app. This policy covers information processed through the CRM about people who interact with connected business accounts, customers placing orders, and authorized staff.
The operator responsible for this information is: [Insert legal operator or business name]. Privacy and deletion contact: [Insert monitored privacy and deletion email address].
Bracketed entries identify business information the operator has not yet supplied. They are not real contact details.
2. Information we collect
- Facebook Pages and Business Portfolios: authorized account and Page identifiers, names, profile images where available, business association, granted permissions, connection status, and synchronization timestamps and errors. Access credentials are stored separately for server-side integration use.
- Messenger and Page comments: conversation, message, post and comment identifiers; message and comment text; timestamps; attachments such as images or voice messages; read and reply status; and sender names or platform-scoped identifiers only when Meta provides them.
- Instagram and WhatsApp: if separately enabled through authorized official integrations, relevant business account and phone identifiers, conversation and message content, attachments, sender identifiers, timestamps and delivery status. A Facebook Page connection does not automatically connect WhatsApp or Instagram, and this policy does not mean those integrations are currently available.
- Customer and order records: names, phone numbers, delivery addresses, tags, notes, assignments, ordered items, quantities, cash-on-delivery amounts, delivery instructions, order status and courier tracking references provided by customers or entered by staff.
- Staff and operational information: staff account details, roles and access permissions, moderation and ban history, audit records, webhook events and diagnostic information used to run and secure the service. Hosting and platform providers may also process connection details such as IP addresses and request logs.
We do not use a comment ID as a person's ID or create identities Meta has not supplied. We do not request Facebook account passwords; authorization takes place through official Meta login.
3. How information is used
Information is used to display authorized conversations and comments; answer customer inquiries; organize customer records; assign work to staff; carry out permitted moderation; confirm and deliver orders; synchronize connected accounts; troubleshoot failures; and protect the service from misuse.
When staff request an AI reply suggestion, selected message or comment context is sent to the configured AI service to generate a draft. Staff remain responsible for reviewing replies. Integration access is limited by the permissions granted, Meta platform rules and the CRM's staff permissions.
4. Storage and security
CRM records are stored in the service's Lovable Cloud database and applicable hosting infrastructure. Message attachments are transmitted to Meta; the CRM stores Meta-hosted media links and associated metadata rather than maintaining its own attachment archive. Meta account credentials and integration secrets are held in restricted server-side storage rather than public customer records. Access to operational data is controlled by staff authentication, roles and database access rules. Server-to-service communication uses HTTPS.
Diagnostic records support security and troubleshooting; access tokens and app secrets must not be included in public pages or user-facing diagnostics. No internet service can guarantee absolute security. Platform-hosted media and information may also remain with Meta or a courier under that provider's own policy.
5. Sharing and service providers
- Authorized staff access information needed for their customer service and operational duties.
- Meta receives API requests and messages or moderation actions performed through Facebook, Messenger and any separately enabled Instagram or WhatsApp integration.
- Lovable Cloud and hosting providers process information to operate and store the service. Lovable AI Gateway and its configured model provider receive selected recent message text or comment context when an AI suggestion is requested.
- When an order is dispatched through an enabled courier, such as Pathao, necessary recipient, address, parcel and payment details are sent for delivery and tracking.
- Information may be disclosed where required by applicable law or necessary to investigate misuse and protect legitimate rights.
The purposes described here do not include selling customer information. Providers may process information in other countries under their own privacy terms. The operator should review provider terms and applicable transfer requirements.
6. Retention and disconnection
Records are retained for customer service, order fulfillment, troubleshooting and applicable recordkeeping needs. Retention schedule: [Insert retention periods for messages, comments, customer records, orders, logs and backups].
Disconnecting a Page stops future CRM synchronization and removes its records from active views, but does not itself delete previously stored history. Revoking access in Meta also does not automatically erase CRM records. Verified deletion requests are handled separately. Data may persist in backups until their applicable retention cycle expires; lawful recordkeeping exceptions may apply.
7. Your choices and deletion requests
You can request access, correction or deletion of information associated with you, subject to applicable law and proportionate identity verification. Contact [Insert monitored privacy and deletion email address] and identify the relevant Page, account, conversation or order so the operator can find your records. Do not send passwords, access tokens or unnecessary identity documents.
See the Meta user data deletion instructions for the request process and how to remove an integration from your Meta account.
Deletion-request response timeframe: [Insert deletion-request response timeframe]. If some information must be retained, the operator should explain the reason and scope in its response. Deletion from this CRM does not automatically remove messages, comments or order records held independently by Meta, couriers or other providers.
8. Cookies and local storage
The CRM uses authentication-related browser storage to keep authorized staff signed in. This public policy page does not require a staff login or ask visitors to connect a Meta account. Hosting and third-party font delivery may process ordinary browser request information. This policy does not claim that advertising tracking is installed.
9. Updates and contact
Changes to this policy will be published here with an updated date. For privacy questions, rights requests or concerns about information handling, contact [Insert legal operator or business name] at [Insert monitored privacy and deletion email address].