Privacy Policy

How Smart Ecom collects, uses, and protects data from connected Facebook Pages and Instagram professional accounts.

Who we are

Smart Ecom (smartecomdz.com) helps merchants manage their Facebook Page and Instagram comments and messages automatically: AI replies in local dialect, comment moderation, and cash-on-delivery (COD) order capture. We act only on Pages that the Page owner explicitly connects and grants us permission to manage.

Data we access

• Public Page information (name, ID, picture) after the owner connects the Page.
• Public comments on the Page's posts (text, public author, timestamp) to moderate and reply.
• Messages sent to the Page inbox, to generate replies and assist the merchant.
• Order details a customer voluntarily provides in chat (name, phone, address) to complete the order.

We never request or store end-user passwords or any payment-card data.

How we use it

• Generate automated replies to comments and messages on behalf of the merchant.
• Hide abusive or spam comments according to the merchant's settings.
• Organize orders in the merchant's dashboard (and a linked Google Sheet, if enabled).

We do not sell your data or share it for third-party advertising.

Meta Platform data and permissions used

We integrate with the Meta Platform through Facebook Login for Business and Instagram Login, and request only the permissions required for the visible service features:

• public_profile — to sign the merchant in through Facebook Login for Business and identify their account while they connect a Page.
• pages_show_list — to list the Pages the merchant manages so they can choose which one to connect to the service.
• business_management — to reach Pages held inside a Business portfolio, and to discover the Page's ad posts that customers comment on so those comments are not missed.
• pages_manage_metadata — to subscribe the Page to Meta's realtime webhooks (feed and messages) so a customer's comment or message reaches the merchant as it arrives, instead of waiting for a periodic poll.
• pages_read_engagement — to read the Page's posts and their public comments so we can display them to the merchant and generate context-aware replies.
• pages_read_user_content — to read the content of the customer's own comment (its text, author and time) so it can be classified and then replied to or hidden.
• pages_manage_engagement — to publish the merchant's replies to customer comments and to hide abusive or spam comments per the merchant's settings.
• pages_messaging — to receive customer messages sent to the Page inbox and send automated replies within Meta's messaging policy.
• instagram_business_basic — to connect an Instagram professional account directly and show its basic identity and media to the merchant.
• instagram_business_manage_messages — to receive and display customer messages sent to the connected Instagram professional account and reply within Meta's policy.
• instagram_business_manage_comments — to read, reply to, and hide comments on the connected Instagram account's posts and Reels according to the merchant's settings.

We use this data solely to operate the features above on the connected Page — for no other purpose — and we do not request any permission whose function is not visible in the service.

Third-party sharing

We rely on technical providers solely to operate the service: Meta (source of comments and messages), database and server hosting, and an AI model provider to generate replies. Each processes data on our behalf under data-processing terms, not for their own purposes.

Cookies & analytics

We use only cookies that are necessary to run the service — never for advertising or resale:

• Session & authentication cookies to keep you securely signed in to the dashboard.
• active_tenant to remember the selected store when you manage more than one.
• se-locale to remember the interface language.

We use Vercel Analytics to measure page performance in aggregate and anonymously — no advertising trackers and no data resale.

Data residency

Your data is processed and stored on Supabase infrastructure within the European Union (EU region), alongside hosting and AI-model providers that process data solely on our behalf.

Sub-processors

These are the only providers that process your data on our behalf, each for one stated purpose:

• Supabase Inc. — database and authentication (EU region): stores the account, comments, messages and the Page access token.
• Vercel Inc. — hosting for the dashboard; data passes through it in transit while a merchant views it.
• Contabo GmbH (Germany) — the server that receives Facebook webhooks and sends replies through the Meta Graph API.
• Google LLC — Gemini API: the text of a customer's comment or message is sent to generate the merchant's reply and to classify the comment (enquiry / complaint / abuse) so the system can decide whether to reply or hide it. A payment-receipt image (BaridiMob/CCP) uploaded by the merchant is also sent, to read its amount and reference. None of it is used for advertising or profiling, and no data is sold.
• Google LLC — Sheets & Drive: if the merchant links a Google Sheet, we write the full order into it — the customer's name, phone, wilaya, commune and address, plus product, quantity and amount. The spreadsheet belongs to the merchant and stays in their own Google account; we only write to it on their behalf.
• Telegram Messenger LLP — operational alerts to our team (failures, usage limits, a new store signing up). It receives the alert title and the store name; no end-customer name, phone, address or message text.

Retention and deletion

We retain data while the Page is connected and the service is active. A merchant can disconnect a Page at any time from the dashboard (Settings → Connection), after which we immediately delete the stored data associated with it, and can also delete their entire account from (Settings → My data).

To request deletion of your data:

• Email yoravia.smilix@gmail.com with the subject "Data Deletion Request" and the Page name or a link to your comment/conversation, or
• Remove our app from your Facebook settings (Settings & Privacy → Settings → Business Integrations) — we receive the signal and process it automatically, or
• If you are the merchant, disconnect the Page or delete your account directly from the dashboard.

We complete deletion within 30 days. See the Data Deletion page to track your request.

Contact

For any privacy question: yoravia.smilix@gmail.com.