Privacy Policy

a. Meta Data Accessed: When a creator connects their Instagram account, ProfileBundle accesses the account's professional ID, username, public media/reels metadata, and public comment events posted on the creator's posts. When an Instagram user comments on a creator's post, we temporarily process the user's public Instagram username, user-scoped ID (IGSID), and comment text solely to evaluate keyword automation triggers. When a creator connects Facebook Pages, we access the Page ID, Page name, a Page access token, the creator's app-scoped Facebook user ID (used only to honour deauthorization and data deletion requests), and comments on the Page's posts (commenter name, page-scoped ID and comment text), and we send the requested reply to the commenter through Messenger. Automated replies are only sent in response to a person's own comment or message, and never later than 24 hours after it.

b. Purpose of Processing: We process this data strictly to deliver the specific automated response requested by the user — such as transmitting a direct private message containing a product link or discount code, and posting an optional public reply confirming dispatch.

c. Data Protection & Non-Monetization: We do not sell, rent, monetize, or transfer Instagram user data or commenter information to advertising networks, data brokers, or unauthorized third parties. All API access tokens are encrypted and securely stored. Webhook payloads are processed in real-time, and deduplication IDs are automatically purged after processing.

d. Revocation & Deletion: Creators can disconnect their Instagram account at any time from the AutoDM dashboard, which immediately revokes tokens and halts all automation. Users may also revoke access at any time through Instagram Settings (Settings and privacy > Website permissions > Apps and websites) or Facebook Settings (Settings & privacy > Settings > Business integrations). When access is removed or data deletion is requested there, Meta notifies us and we delete the connection and its AutoDM data automatically. Step-by-step instructions for data deletion are available at our dedicated Data Deletion Instructions page.

a. Zoom Data Accessed: We request only two permissions: user:read:user (to read the connecting creator's Zoom user ID, email and account type) and meeting:write:meeting (to create a scheduled meeting for a confirmed booking). We store the encrypted OAuth access and refresh tokens, the creator's Zoom user ID, and the meeting ID and join URL of each booked session.

b. What We Do Not Access: We do not access, store, or process meeting recordings, audio/video content, chat messages, transcripts, participant lists, contacts, or any other Zoom account data.

c. Purpose & Sharing: Zoom data is used solely to schedule the booked consultation and to deliver the join link to the creator and the buyer by email and in their dashboards. Zoom data is never sold, used for advertising, or shared with any other third party.

d. Security: Zoom OAuth tokens are encrypted at rest using AES-256-GCM with keys held separately from the database, and are transmitted only over TLS 1.2+. Incoming Zoom webhook events are verified using Zoom's signed x-zm-signature header.

e. Revocation & Deletion: Creators can click Disconnect on the Zoom card in Dashboard > Consultations at any time, which revokes the token with Zoom and immediately erases the stored tokens. If you remove ProfileBundle from the Zoom App Marketplace (Zoom > Manage > Added Apps > Remove), we receive Zoom's deauthorization notification and erase the stored tokens automatically. Meeting links for sessions that were already booked remain part of the order record so that both parties can still attend.

a. Google Sign-In Data Accessed: If you choose "Continue with Google" to sign in, we request only the basic profile and email scopes and receive your name, email address, Google account ID, and profile photo solely to authenticate your ProfileBundle account.

b. Google Calendar & Google Meet Integration (1:1 Consultations): Creators who sell 1:1 consultation sessions may optionally click Connect Google Meet in Dashboard > 1:1 Bookings. When you explicitly connect Google Meet, we request https://www.googleapis.com/auth/userinfo.email (to display your connected Google email) and https://www.googleapis.com/auth/calendar.events (solely to create a scheduled calendar event with an auto-generated Google Meet video conference link when a buyer books a 1:1 consultation). We do not read, view, modify, or delete any existing events on your Google Calendar, and we never access Gmail, Google Drive, or Google Contacts.

c. Google API Services User Data Policy (Limited Use Disclosure): ProfileBundle's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising or profiling, never used to train AI/ML models, and never transferred to third parties except as strictly necessary to schedule the booked session between creator and buyer. All Google OAuth tokens are encrypted at rest using AES-256-GCM.

d. Revocation & Deletion: Creators can click Disconnect on the Google Meet card in Dashboard > 1:1 Bookings at any time, which immediately revokes the OAuth token with Google and erases the stored tokens from our database. You can also remove ProfileBundle's access at any time from myaccount.google.com/permissions, and view full setup and removal instructions at profilebundle.com/docs/google-meet or our Data Deletion page.

a. Data Processed: When a buyer purchases or claims a Telegram VIP membership, we generate a personal single-use invite link via the official Telegram Bot API. When the buyer joins (or requests to join) the creator's channel, we record their Telegram numeric user ID and public username (if any), along with the plan, membership start and expiry dates, and membership status.

b. Purpose: This data is used only to verify that the person joining is the paying buyer, approve their join request, send renewal reminders, and automatically remove access from the channel when the membership ends. We never read channel messages or send marketing messages through Telegram.

c. Sharing: The creator who owns the channel can see the member list (name, email, Telegram username, plan and expiry) to manage their community. Telegram itself processes data under the Telegram Privacy Policy.

d. Deletion: Buyers can request deletion of their Telegram identifiers by email; this also ends channel access for any active membership.

a. Order messages: When you buy a paid product, we send one order confirmation with your access link to the mobile number you enter at checkout, through the official WhatsApp Business Platform (Cloud API) operated by Meta. We do not send marketing messages on WhatsApp.

b. Support conversations: If you message our WhatsApp number, we receive and store your WhatsApp number, profile name and the messages you send (including any photos or files), together with our replies, so our support team can help you. We reply only within WhatsApp's 24-hour customer service window.

c. Opting out: Reply STOP at any time to stop order messages (reply START to resume). Once you reply STOP, we no longer send order confirmations to that number.

d. Sharing & processing: Messages are carried by Meta as our WhatsApp Business service provider under the WhatsApp Business Terms. We never sell WhatsApp data or use it for advertising. Retention and deletion are described below and on our Data Deletion page.