Privacy Policy — Daf Agency

Daf Agency ("we", "us") operates a software platform that lets businesses ("Businesses") answer their customers on Facebook Messenger and Instagram Direct Messages with the help of an AI assistant and their own staff. This policy explains what data we process, why, and the choices available to Businesses and to the people who message them ("Customers"). Questions: support@dafagents.com.

Our role

For Customer conversations, the Business that owns the Facebook Page or Instagram account is responsible for its customer relationship, and Daf Agency processes that data on the Business's behalf to provide the service. For Business user accounts on our dashboard, Daf Agency is responsible for the data.

Data we receive from Meta

When a Business connects its Facebook Page and/or Instagram professional account to Daf Agency using Facebook Login for Business, and only for the assets it selects, we receive:

• Page and Instagram account identifiers, names and an access token to operate them.
• Messages Customers send to the connected Page or Instagram account, including text, images and attachments, plus delivery events.
• Basic public profile fields of Customers who message the Business (such as name or username and profile picture), so staff and the assistant can address them.

We do not request access to personal Facebook timelines, friends lists, or ad accounts, and we do not use Meta data for advertising or sell it.

Other data

• Order details a Customer chooses to share in the chat (name, phone number, delivery address) so the Business can fulfil the order.
• Business user account details (email, name, role) and an activity log of actions in the dashboard.
• Product and store information the Business provides to train its assistant.

How we use data

• To receive and reply to Customer messages on the Business's behalf, automatically or by its staff.
• To help the Business create, track and ship orders through the store and courier services it connects.
• To keep conversation history visible to the Business for support and quality review.
• To secure, maintain and improve the service. We do not use a Business's Customer data to serve another Business.

Sharing

We do not sell personal data. We share data only as needed to run the service: with Meta (to send and receive messages), with AI model providers that generate draft replies, with hosting providers, and with the store and courier services a Business chooses to connect. Each Business's data is kept separate from other Businesses'.

Security

Access tokens and other secrets are encrypted at rest. Webhook deliveries from Meta are verified. Dashboard access requires an authenticated account, and each account only sees its own Business's data.

Retention

We keep conversation and order data while the Business uses the service and as needed to complete or dispute orders. When a Business disconnects its Page or Instagram account, we stop receiving new data from it immediately and delete its access tokens; the Business can ask us to delete its stored data, which we do within 30 days.

Your rights and data deletion

Customers can ask the Business they messaged, or us directly, to access or delete their data. Businesses can remove Daf Agency's access at any time from their Facebook or Instagram settings. See our Data Deletion page or email support@dafagents.com.

Changes

We will post updates to this policy on this page and change the date above.