Privacy policy

This policy explains how [Company name] (“we”, “us”) handles personal data in GoldenSocial Connect (the “Service”), a tool that brings the leads reaching a real-estate agent on Facebook, Instagram, WhatsApp and X into one queue. The agent who signs up is the “user”.

1. Who is responsible

[Company name], [registered address — to be confirmed], is the controller of user account data. For the comments, messages and lead forms that reach a user’s connected accounts, the user decides what to do with them and we process them on the user’s behalf. Contact: [contact email — to be confirmed].

2. What we collect

• Account data: your email address, your name and a hash of your password (we never store the password itself).
• Connected accounts: the IDs and names of the Facebook Pages, Instagram accounts, WhatsApp business numbers and X accounts you connect.
• Access tokens: the tokens those platforms give us when you connect, stored encrypted.
• Lead content: the comments, direct messages, Lead Ads form answers and posts that reach your connected accounts, that match your keyword searches, or that you save with the Chrome extension, together with the public name and profile ID of the person who wrote them.
• Your work: the keywords you set, the statuses and notes you add to leads, and your CRM webhook address if you set one.

The Chrome extension saves only the single post you click “Save to GoldenSocial” on. It does not crawl, scroll or read pages by itself, and it does not send your browsing history to us.

3. Where the data comes from

We only use the official APIs of each platform, with the permissions you grant when you connect:

• Meta Pages API (Facebook Page comments)
• Messenger Platform (Facebook Page messages)
• Instagram Graph API (Instagram comments, messages and hashtag search)
• WhatsApp Business Cloud API (messages to your business number)
• Meta Marketing API, Lead Ads (Facebook and Instagram lead forms)
• X API (keyword search)

4. Why we use it

We use this data only to provide the Service: to show each lead to the user who owns the connected account, to tag and score leads with rules in our code, to let the user track, note and reply to them, and to forward new leads to the user’s own CRM webhook when the user sets one up.

We never sell your data or the data of your leads, and we never use it for advertising.

5. AI-drafted replies

When you click “Draft reply”, the text of that one lead is sent to our AI provider [AI provider — to be confirmed] to draft a suggested reply. Nothing is sent to the AI provider unless you click. The draft is shown to you only; you choose whether to edit and send it. The Service never sends a message to anyone automatically.

6. How long we keep it

• Account data: until you delete your account.
• Connected accounts and access tokens: until you disconnect the account or delete your account. Disconnecting deletes the tokens.
• Lead content, statuses and notes: until you delete them, disconnect the source account or delete your account. Saved posts are deleted on request.

See Data deletion for how to ask us to delete data.

7. Security

Access tokens are encrypted at rest (AES-256-GCM) and are never shown back through the app. Passwords are hashed. Every lead belongs to the user who connected the account, and every request is checked so a user can only see their own leads.

8. Sharing

We share data only with service providers that help us run the Service (hosting, database, email and, when you ask for a draft, the AI provider), under contracts that limit use to that purpose; with the CRM webhook you set up yourself; or when the law requires it.

9. International transfers

Our providers may process data outside your country. Where that happens we rely on the safeguards required by applicable law. [Hosting location — to be confirmed]

10. Your rights

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the EU General Data Protection Regulation (GDPR), you may ask to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent. You can also complain to your data protection authority.

If you are a person whose comment or message reached one of our users, please contact that user first; you can also write to us and we will pass on or handle your request.

Write to [contact email — to be confirmed]. We answer within 30 days.

11. Children

The Service is for professionals and is not meant for anyone under 18.

12. Changes

We will post any change on this page and update the date at the top. For important changes we will also tell users by email.