Privacy Policy

“MiaoHui” is a web-based SaaS service operated by SIGNALIFE LTD (訊息傳導生命科技有限公司) that helps Instagram / Facebook merchants automatically reply to post comments and send direct messages (replacing traditional manual customer service and ManyChat-style tools). This policy applies to our website, Dashboard, and related APIs.

To provide our auto-reply and auto-DM services, we collect and process the following data within the scope of your authorization:

• Public Instagram comments: The public comment text under posts on your connected account, used to match keywords and trigger automated replies.
• Direct message (DM) content: Direct message text exchanged with your account, used for automated replies and follow-up conversation flows.
• Instagram user identifiers: The Instagram user ID, username (@handle), and public display name of commenters / DM senders, used to identify conversation partners and avoid duplicate replies.
• Your (merchant) account data: The email and contact information you provide at sign-up, along with basic information about your connected Instagram business account / Facebook Page and the access token granted to us.
• Lead email capture (optional): If your automation is set up to “invite the other party to leave an email,” we collect, on your behalf, the email they voluntarily provide, used solely for the purpose you have configured.
• Service usage records: Operational records such as flow trigger counts, reply / DM delivery results, and error logs, used for analytics and debugging.

• Detect the keywords you set and automatically reply publicly to matching comments.
• Automatically send direct messages to matching recipients and run the follow-up conversation flows you design.
• When you enable AI replies, send comment / DM content to an AI provider to generate reply drafts or content.
• Tag contacts, capture leads, and produce performance analytics to help you grow your audience.
• Operate the service, prevent abuse, and ensure security and legal compliance.
• You can export your own contact list to a file (CSV). Once exported, the file has left the Service: storing it, using it and disclosing it to third parties are your responsibility, and remain subject to the data protection laws that apply to you.

We do not sell your comment / DM content or contact data to third parties, nor use it for any purpose unrelated to the above.

To provide the service, we transmit necessary data to the following third parties and require them to comply with the corresponding data protection obligations:

• Meta Platforms (Instagram / Facebook Graph API): We use Meta’s official API to read comments / DMs and to send replies / DMs on your behalf. Your use is also governed by Meta’s Data Policy.
• AI providers: When you enable AI auto-replies, we send the triggering message and your configured instructions to the AI provider you select / we configure (e.g., OpenAI, Anthropic, or a compatible provider) to generate content.
• Cloud hosting and infrastructure providers: Used for website hosting, data storage, and computation (e.g., Vercel and database providers).
• Payment providers: Process charges for paid plans (this edition uses a payment processor appointed by the Company, a Merchant of Record); we do not store your full card number.

Except as necessary to provide the service, with your consent, or as required by law / a competent authority, we will not disclose your personal data to third parties.

• Access tokens and account connections: Retained for the duration of your connection; once you disconnect or delete your account, we stop using and delete them.
• Comment / DM content and contact data: Retained for as long as needed to provide the service; you may request deletion at any time (see Section 7 below and the User Data Deletion Notice).
• Operational logs (events log): We keep only the most recent 500 records per account for debugging and analytics; older entries are automatically overwritten as new ones are written.
• When data is no longer needed for collection / processing, or when you withdraw consent / request deletion, we will delete or anonymize it within a reasonable period.
• What is erased when you delete your account: When you delete your account in the Dashboard, we erase, within the same request: your flow configurations, contacts, conversation records and operational logs; your Instagram connections and their encrypted tokens; any waitlist sign-up you left with us; unused password reset tokens; platform event deduplication records; and the identity binding record of the partner programme. Your service settings are reset to safe defaults (disconnected, demo mode, Instagram account name no longer kept), and the member account itself is deleted last; our published completion deadline is within 30 days.
• Irreversible fingerprints retained after account deletion: To prevent the same Instagram account from being reused to open multiple accounts, we retain a set of irreversible hash fingerprints after you delete your account (each derived by a one-way hash of your email address and of your Instagram account identifier). They contain no plaintext and cannot be reversed into the original data, and we do not use them for any other purpose; their sole purpose is to enforce the binding limit. These fingerprints are not the only records we retain after account deletion; the rest are listed in the next item.
• Other records retained after account deletion: Besides the binding fingerprints described in the previous item, two kinds of records are not erased together with your account: invite code usage records (the primary key is the hash of the code itself, the table has no column pointing back to you, and it only stores that code’s usage counts); and billing mandate records (kept for reconciliation and statutory accounting evidence, and so that an authorization that has not yet been terminated can still be terminated — deleting it with the account would mean the account is gone while the card keeps being charged). Neither contains plaintext personal data such as your name or email address. If you would still like us to handle them, ask us by email — see Section 7 below.

We apply reasonable technical and organizational measures to protect your data, including encryption in transit (HTTPS), least-privilege access, and storing keys / tokens only as environment variables (never in code). However, no internet transmission can be guaranteed absolutely secure, and we will continue to maintain and improve our security measures.

With respect to your personal data, you may exercise the following rights:

• Inquire about and review your personal data.
• Request a copy.
• Request that it be supplemented or corrected.
• Request that we stop collecting, processing, or using it.
• Request deletion (including via Meta’s “User Data Deletion” mechanism; see the User Data Deletion Notice).
• Withdraw consent previously given.

To exercise these rights, please email support@shadowos.ai. We will process your request within a reasonable period.

Our website uses necessary cookies and similar technologies to keep you signed in, remember your preferences, and analyze site usage. You can manage or disable cookies through your browser settings, though some features may not work properly as a result. We do not use cookies for cross-site tracking advertising.

This service is intended for business operators and is not directed at children under the legal age. We do not knowingly collect personal data from children.

We may revise this policy in response to legal, technical, or service changes. For material changes, we will post a notice on our website or notify you by appropriate means. The revised policy takes effect on the date stated in the notice.