Meta Platform Data Policy

On This Page

• 1. Scope & Who We Are
• 2. Meta Products & Permissions We Use
• 3. Information We Receive From Meta
• 4. How We Use Meta Platform Data
• 5. What We Never Do
• 6. When We Share Information
• 7. How We Secure Your Data
• 8. Data Retention
• 9. User Data Deletion Instructions
• 10. Your Privacy Rights
• 11. Children’s Privacy
• 12. Changes To This Policy
• 13. Contact Us

1. Scope & Who We Are

Applantics is a software development company registered in Sri Lanka as APPLANTICS (PVT) LTD (Company Reg. No. PV 00334797), with its registered office at No 2, UB Wijekoon Mawatha, Narammala 60100, Sri Lanka. We build AI, web, mobile, and social media management solutions. This policy applies to every Applantics application and service that integrates with Meta technologies, including Facebook Login, the Facebook Pages API, the Instagram Graph API, the Messenger Platform, the WhatsApp Business Platform (Cloud API), and the Marketing API.

Data received through these integrations (“Platform Data”) is processed only to provide the features you have asked for. Where we operate a Meta integration on behalf of a client business, that business is the data controller and Applantics acts as its data processor.

2. Meta Products & Permissions We Use

We only request the permissions a feature actually needs, and Meta shows you every requested permission before you grant access. Depending on the features you enable, our apps may request:

• pages_show_list, business_management: to list the Facebook Pages and business assets you manage, so you can choose which ones to connect.
• pages_messaging, pages_manage_metadata: to receive Messenger conversations with your Page through webhooks and let your team reply from the Applantics CRM shared inbox.
• pages_read_engagement, pages_read_user_content, pages_manage_engagement: to show comments on your Page posts and let your team reply to, hide or delete them.
• pages_manage_posts: to publish or schedule the posts you create in the CRM publisher.
• read_insights: to show Page and post performance in your CRM reports.
• instagram_basic, instagram_manage_messages: to identify your connected Instagram professional account and handle its Direct messages in the shared inbox.
• instagram_manage_comments, instagram_content_publish: to moderate comments and publish the posts you create.
• whatsapp_business_messaging, whatsapp_business_management: to send and receive WhatsApp messages for your business and manage your message templates and phone numbers.

3. Information We Receive From Meta

Depending on the permissions you grant, we may receive:

• Basic profile data: the app-scoped user ID of the person who connects the account.
• Account & asset data: names and IDs of the Facebook Pages, Instagram accounts, WhatsApp Business accounts you connect, plus the access tokens Meta issues for them.
• Content you manage: posts, captions, images, videos, and comments you create, schedule, or moderate.
• Messages: Messenger, Instagram Direct, and WhatsApp messages exchanged between your business and its customers, including the sender’s name or phone number, so we can deliver them to your inbox.
• Insights: aggregated reach, engagement, and follower data for your Pages, posts and Instagram account.
• Technical data: webhook event metadata, timestamps, and API request logs used to operate and secure the service.

We do not receive or store your Facebook, Instagram, or WhatsApp password.

4. How We Use Meta Platform Data

We use Platform Data only for the purpose you connected your account for:

• Connecting the accounts you choose and keeping that connection secure.
• Publishing and scheduling content, managing comments, and running the messaging inbox or automated replies you configure.
• Producing the performance reports you request.
• Writing AI reply suggestions or automatic replies, only when your business turns the AI assistant on.
• Providing customer support and troubleshooting when you ask us to.
• Meeting our legal obligations and the requirements of the Meta Platform Terms.

5. What We Never Do

In line with the Meta Platform Terms, Applantics will never:

• Sell, license, rent, or purchase Platform Data.
• Share Platform Data with data brokers, ad networks, or any third party for their own purposes.
• Use Platform Data to build or enrich profiles of people beyond the service you requested, or to track people across other apps and websites.
• Use Platform Data to discriminate against anyone, or to make decisions about eligibility for housing, employment, credit, insurance, education, or healthcare.
• Use Platform Data for surveillance or share it with law enforcement except where legally required.
• Use Platform Data to train artificial intelligence or machine-learning models.
• Send WhatsApp or Messenger messages to people who have not opted in to receive them.

6. When We Share Information

We share Platform Data only in these limited cases:

• Your own business: the client business that authorized the connection and the team members it grants access to.
• Service providers: cloud hosting and database providers that store data on our behalf, and, when your business turns on AI replies, the Google Gemini API (a paid Google Cloud service), which receives the message text needed to write a reply and does not use it to train its models. Providers are bound by written terms that require confidentiality and security at least as protective as this policy, and they may not use the data for any other purpose.
• Legal requirements: when we are compelled by valid law, regulation, or court order. Where permitted, we will notify you first.
• Business transfers: if Applantics is involved in a merger or acquisition, any successor must honour this policy, and we will notify you before your data is transferred.

7. How We Secure Your Data

We protect Platform Data with administrative, technical, and physical safeguards, including:

• Encryption in transit: all traffic to our apps, APIs, and webhook endpoints uses HTTPS with TLS 1.2 or higher. Plain HTTP requests are redirected to HTTPS.
• Encryption at rest: databases, file storage, and backups that hold Platform Data are encrypted at rest using AES-256.
• Protection of tokens & secrets: app secrets and access tokens are stored only on our servers in encrypted storage. They are never placed in browser code, mobile app bundles, URLs, logs, or source code repositories. Server-side Graph API calls use appsecret_proof, and tokens are revoked as soon as they are no longer needed.
• Webhook verification: every webhook request from Meta is checked against its X-Hub-Signature-256 signature, and requests that fail verification are rejected.
• Access control: access follows least-privilege, role-based rules, limited to staff who need it to deliver the service. Multi-factor authentication is required for admin panels, cloud consoles, code repositories, and remote access. Access is revoked promptly when it is no longer needed and is reviewed at least once a year.
• Vulnerability management: we run automated dependency and vulnerability scanning, apply security patches promptly, and test our apps and infrastructure for vulnerabilities at least once every 12 months.
• Monitoring & logging: access to Platform Data is logged and monitored for suspicious activity. Logs never contain access tokens or message content.
• Separate environments: production data is kept apart from development and testing, which use sample data only.
• Incident response: we keep a documented incident response plan and test it at least once a year. If a security incident affects Platform Data, we will notify Meta and affected users promptly, as required by the Meta Platform Terms and applicable law.
• People: everyone with access to Platform Data signs a confidentiality agreement and completes security and privacy training.

8. Data Retention

We keep Platform Data only while your account is connected and the data is needed to provide the service. Access tokens are deleted immediately when you disconnect your account, remove our app, or request deletion. All other Platform Data is permanently deleted within 30 days of any of the following: your deletion request, disconnecting your account, closing your account, Meta asking us to delete it, or the data no longer being needed for the service. Remaining copies in encrypted backups are overwritten automatically within 90 days and are never restored for any other purpose.

9. User Data Deletion Instructions

You can ask us to delete any data we have received about you from Meta at any time, at no cost. Choose either option below.

Option 1: Remove our app from your Facebook or Instagram account

• Facebook: go to Settings & privacy → Settings → Apps and websites, find the Applantics app, and select Remove. For Page connections, also check Settings → Business integrations.
• Instagram: go to Settings and activity → Website permissions → Apps and websites, find the Applantics app, and select Remove.
• Removing the app stops our access straight away. To make sure the data we already hold is also erased, send us a request using Option 2.

Option 2: Email us a deletion request

• Email contact@applantics.com with the subject line “Meta Data Deletion Request”.
• Include your full name and the Facebook account, Instagram account, or WhatsApp Business phone number you connected. If possible, send it from the email address linked to your account.
• We will acknowledge your request within 72 hours, verify that it is yours, and delete your data within 30 days. We will email you a confirmation once deletion is complete.

What we delete: your profile information, access tokens, connected Page, Instagram, and WhatsApp data, messages, content, insights, and any copies we hold. We keep only a minimal record that the deletion was completed (the request date and confirmation), plus any records the law requires us to keep, such as invoices, which do not contain Platform Data.

Request Data Deletion

10. Your Privacy Rights

Depending on where you live, you have the right to access, correct, delete, restrict, or export your personal data, to object to its processing, and to withdraw your consent at any time. We honour these rights under Sri Lanka’s Personal Data Protection Act No. 9 of 2022, the EU and UK GDPR, the California Consumer Privacy Act, and other applicable laws.

Send requests to contact@applantics.com. We will verify your identity and respond within 30 days. You may also lodge a complaint with your local data protection authority.

11. Children’s Privacy

Our Meta integrations are built for businesses and are not directed at children. We do not knowingly collect data from anyone under the age of 16. If you believe a child’s data has reached us, contact us and we will delete it.

12. Changes To This Policy

We update this policy when our integrations, Meta’s requirements, or the law change. The effective date at the top of this page shows the latest version. We will announce material changes by email or in-app notice before they take effect.

13. Contact Us

For questions about this policy, data deletion, or to report a security vulnerability, contact:

• Company: APPLANTICS (PVT) LTD (Reg. No. PV 00334797)
• Address: No 2, UB Wijekoon Mawatha, Narammala 60100, Sri Lanka
• Email: contact@applantics.com
• Phone: +94 70 524 3021
• WhatsApp: +94 77 271 8001
• Related policies: Privacy Policy · Terms & Conditions