Business Integration & Data Policy

1. Scope

This policy applies when a business owner, administrator, or authorized team member connects a Facebook Page, Instagram professional account, ad account, catalog, WhatsApp Business Account, Messenger integration, or another Meta business asset to a Connect with Bayezid service or a service we operate for a client business.

This policy supplements our Meta Privacy Policy, which explains broader website, application, Pixel, Conversions API, and Meta Platform data practices. If the two policies address the same subject, the more specific business-integration explanation applies to the connection described here.

2. Authorization and permissions

Business Login presents the permissions and business assets configured for the relevant Meta app. Before approval, the person completing the flow should review the permissions and confirm that they have authority to connect the business asset. We do not ask for a Facebook password.

Available permissions vary by the integration and Meta’s current review and access rules. A permission may be unavailable, limited, or subject to Meta App Review. We do not represent that every listed Meta capability is active for every client or product.

3. How we use connected data

We use connected information only to provide the service or integration that the business selected, including account setup, publishing, customer support, reporting, approved advertising operations, troubleshooting, security, and compliance. We may use aggregated or de-identified information to monitor reliability and improve our systems.

We do not use a client’s connected business data for an unrelated client, sell it, or use private messages for unrelated advertising. A client business may independently control how it uses information received through its own Page, account, or customer-service channel.

4. Tokens, credentials, and security

Authorization codes are exchanged server-to-server where the integration uses the Business Login code flow. App secrets and long-lived access tokens are not placed in public HTML, browser JavaScript, or GitHub source. Where token storage is required for an active integration, we use server-side secret storage and encryption controls appropriate to the service.

No internet transmission or storage system is completely secure. Businesses should promptly tell us if an administrator leaves the organization, a token may be exposed, an asset is connected by mistake, or a permission is no longer needed.

5. Sharing and service providers

We may share or transmit connected data to Meta as required to operate the selected integration and to infrastructure, database, email, analytics, or security providers that process data on our behalf. We limit provider access to the services needed and require appropriate confidentiality and security commitments. We may disclose information when required by law, legal process, or an urgent security or safety need.

6. Retention and deletion

We retain connected data and tokens only for as long as the active service, client instruction, security requirement, or legal obligation requires. When a connection ends, we revoke or stop using the token where possible and delete or de-identify associated data according to the applicable retention need.

To request deletion, email info@sayadbayezid.com with “Business Integration Data Deletion Request” in the subject line. Include the business name, connected asset or app, and an administrator contact. We may request reasonable information to verify authority before deleting business data.

7. Disconnecting an integration

A business administrator can request disconnection from us at any time. You can also remove the app from Facebook’s Apps and Websites settings or remove the relevant business asset or permission through Meta’s business settings. Disconnection may stop automation, reporting, messaging, or publishing features and does not erase records that a client business or Meta is independently required or authorized to retain.

8. Rights and responsibilities

Businesses are responsible for obtaining authority and any required notices, permissions, or lawful bases before connecting customer data or business assets. Individuals may have access, correction, objection, portability, or deletion rights under applicable law. Requests can be sent to the contact below, and we may coordinate with the relevant client business when it is the data controller for the underlying customer information.

9. Changes

We may update this policy when the integration, Meta requirements, services, or applicable law changes. The effective date at the top indicates the latest revision. Material changes will be communicated through a reasonable notice on the relevant website, service, or client channel.