1. Data We Collect

• Account data — name, email, and password (stored bcrypt-hashed; nobody, including us, can read it).
• Business profile you enter — business name, category, keywords, target audience, pain points.
• Leads you import yourself — from Excel/CSV files or pasted text. You are the controller of this data and responsible for collecting it lawfully.
• Facebook data — only after you explicitly connect via OAuth — the list of Pages you manage, public comments on your own Page posts, and your own ad campaign metrics, retrieved through the official Meta Graph API under the permissions you granted (ads_read, pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_posts). We never collect your Facebook password and never read other people's pages or groups.
• Basic usage data — API call and AI usage logs, kept for security and quota enforcement.

2. How We Use Data

• Scoring and analyzing your leads to support your decisions (analysis is decision support, not verified fact).
• Generating insight reports, competitor SWOTs, and content drafts for your business.
• Publishing content to your Facebook Page only when you enable auto-post and select the Page yourself — you can turn it off at any time.
• Sending email/LINE activity digests if you enable them.

We never sell, rent, or share your data with third parties for advertising or any other purpose. Data is passed to external processors only as strictly required to operate the service: the AI provider (Google Gemini, or a provider whose key you supply yourself — only the content being analyzed is sent) and our infrastructure (Vercel, Neon PostgreSQL).

3. Storage & Security

• PostgreSQL with per-account Row-Level Security — no other account can access a single row of your data.
• All access tokens (Facebook / Google / AI keys) are encrypted with AES-256-GCM at rest.
• All connections use HTTPS.
• Data is automatically deleted per the retention period configured in your account (default 365 days).

4. Your Rights

• Access / rectify — anytime via the Settings and Business pages.
• Withdraw consent — disconnect Facebook anytime in the Connections menu; the token is deleted immediately.
• Full deletion — follow the steps at /data-deletion; deleting the account cascades and removes all your data across every table immediately.
• Complaints — contact us (section 6); we respond within 30 days.

5. Cookies & Sessions

We use only strictly necessary cookies for login (httpOnly session cookie). No behavioral tracking or third-party advertising cookies.

6. Data Controller & Contact

Chujai Radar · email hearhui@gmail.com — all personal-data requests are answered within 30 days.

7. Changes to This Policy

Material changes will be announced on this page with an updated date. Continued use after a change constitutes acknowledgement of the new policy.