Privacy Policy

“秒回 MiaoHui” is a web-based SaaS service operated by 訊息傳導生命科技有限公司 that helps Instagram / Facebook merchants automatically reply to post comments and send direct messages (replacing traditional manual customer service and ManyChat-style tools). This policy applies to our website, Dashboard, and related APIs.

To provide our auto-reply and auto-DM services, we collect and process the following data within the scope of your authorization:

• Public Instagram comments: The public comment text under posts on your connected account, used to match keywords and trigger automated replies.
• Direct message (DM) content: Direct message text exchanged with your account, used for automated replies and follow-up conversation flows.
• Instagram user identifiers: The Instagram user ID, username (@handle), and public display name of commenters / DM senders, used to identify conversation partners and avoid duplicate replies.
• Your (merchant) account data: The email and contact information you provide at sign-up, along with basic information about your connected Instagram business account / Facebook Page and the access token granted to us.
• Lead email capture (optional): If your automation is set up to “invite the other party to leave an email,” we collect, on your behalf, the email they voluntarily provide, used solely for the purpose you have configured.
• Service usage records: Operational records such as flow trigger counts, reply / DM delivery results, and error logs, used for analytics and debugging.

• Detect the keywords you set and automatically reply publicly to matching comments.
• Automatically send direct messages to matching recipients and run the follow-up conversation flows you design.
• When you enable AI replies, send comment / DM content to an AI provider to generate reply drafts or content.
• Tag contacts, capture leads, and produce performance analytics to help you grow your audience.
• Operate the service, prevent abuse, and ensure security and legal compliance.

We do not sell your comment / DM content or contact data to third parties, nor use it for any purpose unrelated to the above.

To provide the service, we transmit necessary data to the following third parties and require them to comply with the corresponding data protection obligations:

• Meta Platforms (Instagram / Facebook Graph API): We use Meta’s official API to read comments / DMs and to send replies / DMs on your behalf. Your use is also governed by Meta’s Data Policy.
• AI providers: When you enable AI auto-replies, we send the triggering message and your configured instructions to the AI provider you select / we configure (e.g., OpenAI, Anthropic, or a compatible provider) to generate content.
• Cloud hosting and infrastructure providers: Used for website hosting, data storage, and computation (e.g., Vercel and database providers).
• Payment providers: Process charges for paid plans (we do not store your full card number).

Except as necessary to provide the service, with your consent, or as required by law / a competent authority, we will not disclose your personal data to third parties.

• Access tokens and account connections: Retained for the duration of your connection; once you disconnect or delete your account, we stop using and delete them.
• Comment / DM content and contact data: Retained for as long as needed to provide the service; you may request deletion at any time (see Section 7 below and the User Data Deletion Notice).
• Operational logs (events log): Only recent records are retained for debugging and analytics; older entries are automatically overwritten / purged.
• When data is no longer needed for collection / processing, or when you withdraw consent / request deletion, we will delete or anonymize it within a reasonable period.

We apply reasonable technical and organizational measures to protect your data, including encryption in transit (HTTPS), least-privilege access, and storing keys / tokens only as environment variables (never in code). However, no internet transmission can be guaranteed absolutely secure, and we will continue to maintain and improve our security measures.

With respect to your personal data, you may exercise the following rights:

• Inquire about and review your personal data.
• Request a copy.
• Request that it be supplemented or corrected.
• Request that we stop collecting, processing, or using it.
• Request deletion (including via Meta’s “User Data Deletion” mechanism; see the User Data Deletion Notice).
• Withdraw consent previously given.

To exercise these rights, please email support@shadowos.ai. We will process your request within a reasonable period.

Our website uses necessary cookies and similar technologies to keep you signed in, remember your preferences, and analyze site usage. You can manage or disable cookies through your browser settings, though some features may not work properly as a result. We do not use cookies for cross-site tracking advertising.

This service is intended for business operators and is not directed at children under the legal age. We do not knowingly collect personal data from children.

We may revise this policy in response to legal, technical, or service changes. For material changes, we will post a notice on our website or notify you by appropriate means. The revised policy takes effect on the date stated in the notice.