Channel Integration Privacy Policy
Who we are and our role
Businesses using a Sassly application ("clients") connect their own business accounts on platforms (Instagram, Facebook, Threads, TikTok, X, Google Business Profile, YouTube, Google Play, App Store) through our connect page. We process data on behalf of those clients, only to show public conversations and customer messages in the Sassly application the client uses, and to send the replies written by the client's team.
Data we process
| Data | Source | Purpose |
|---|---|---|
| Identity of the connected business account (platform ID, name, username, profile photo) | The platform, when the client grants permission | Showing the connected account and routing messages to the right client |
| Access & refresh tokens, granted permissions (scopes) | The platform (OAuth) or keys uploaded by the client (App Store) | Reading and replying on the client's behalf; stored encrypted |
| DMs, comments, replies, mentions, and reviews for the client's account, with sender name/username and attachments | Platform webhooks or APIs | Shown in the client's Sassly inbox so they can be answered |
| Content context (the post/video commented on, rating, app version of a review) | Platform APIs | Helping the client's team understand the message |
| Replies and moderation actions sent by the client's team | The client's Sassly application | Forwarded to the platform and their status recorded |
| Technical logs (time, status codes, IDs — no message content and no tokens) | Our systems | Security, troubleshooting, auditing |
We do not sell data, use it for advertising or profiling, or share it with anyone other than the Sassly application the client connected. We do not request permissions beyond what the features above need.
Permissions per platform
- Instagram: instagram_business_basic, instagram_business_manage_comments, instagram_business_manage_messages
- Facebook: pages_show_list, pages_manage_metadata, pages_read_engagement, pages_read_user_content, pages_manage_engagement, pages_messaging, business_management
- Threads: threads_basic, threads_read_replies, threads_manage_replies, threads_manage_mentions
- TikTok: user.info.basic, video.list, comment.list, comment.list.manage, mention.list, message.list.read, message.list.send
- X: tweet.read, tweet.write, users.read, dm.read, dm.write, offline.access
- Google Maps: https://www.googleapis.com/auth/business.manage
- YouTube: https://www.googleapis.com/auth/youtube.force-ssl
- Google Play: access granted by the client from their developer console (no OAuth)
- App Store: access granted by the client from their developer console (no OAuth)
How long data is kept
- Raw platform payloads: 30 days.
- Conversations, messages, events, delivery status, and attachments: 90 days (client applications copy what they need to keep longer).
- Access tokens: while the account is connected; deleted immediately when the account is disconnected or permission is revoked.
- Audit logs without message content: 1 year.
Your rights and how to delete data
Clients can disconnect an account at any time from their Sassly application, or revoke permission directly in the platform's settings (e.g. Instagram → Settings → Apps and Websites; Facebook → Business Integrations). Revoking permission deletes that account's tokens and data. Customers whose messages are processed can request deletion through the business concerned or contact us. Full instructions: Data deletion.
Security
Tokens and keys are stored encrypted (libsodium), dashboard access is limited to specific internal team members, all connections use HTTPS, and platform webhooks are signature-verified. Each destination application can only access accounts connected to its own application and workspace.
Contact
Privacy questions: [email protected].