Privacy Policy

1. Who we are

Incepxion AI is operated by Incepxion Services Inc., Philippines (“Incepxion,” “we,” “us”). It provides a customer conversation inbox and configurable chatbot workflows for connected Facebook Pages.

This policy covers information processed by this application, including during development and testing. It applies to workspace users and people who communicate with a connected Page. When a separate business operates that Page, it also determines how it uses the messages it receives; its own privacy notice applies to that business's activities.

2. Information we collect

• Messenger conversations: messages you send, Page and chatbot replies, timestamps, Facebook Page IDs, Page-scoped sender IDs, message IDs, delivery and read events, button or quick-reply responses, and attachment types and links supplied by Meta.
• Information you choose to share: your name, contact details, delivery address, product questions, order details, or other information included in your messages or answers to a chatbot.
• Workspace records: conversation tags, internal notes, customer fields, chatbot steps, keywords, saved settings, and test conversations entered by the workspace user.
• Account information: the account identifier, name, and email (when available) from Facebook or the account details you provide, used to identify the workspace user and control access. Facebook sign-in uses an app-scoped Facebook account ID and name to identify the customer separately from Messenger contacts. Email is not required for Facebook sign-in. Administrator and invited team passwords are stored as salted password hashes. Each customer account and its assigned Pages have separate access controls.
• Page connection information: the Meta App ID, Page ID, connection and subscription status, the authorizing Facebook user ID, Page names and tasks returned during Facebook authorization, and access tokens and App Secrets supplied through authorization or by an authorized administrator. Page selection sessions expire after 15 minutes. Tokens and secrets are stored encrypted on the server and are not returned to the browser.
• Technical records: request times, message and recipient identifiers, API error details, and diagnostic reference IDs. Hosting and authentication providers may also process network, device, and security information necessary to operate the service.

We receive this information from you, the connected Page, its authorized workspace user, Meta's Messenger APIs, and the hosting or sign-in service. We do not ask customers for Facebook passwords, payment card credentials, or government identification through the chatbot.

3. How and why we use information

We use information to:

• Display and organize conversations, respond to inquiries, and help the Page manage customer requests.
• Run configured chatbot workflows and retain information you provide during a conversation.
• Connect an authorized Page, receive its messaging events, and send replies through Messenger.
• Authenticate workspace users, protect the service, prevent duplicate messages, and diagnose delivery or connection problems.
• Handle privacy requests and meet applicable legal obligations.

Depending on the activity, processing is based on steps you request before a transaction, performance of a service, legitimate interests in providing secure customer communications, legal obligations, or consent where required. Where we rely on consent, you may withdraw it by contacting us. This does not affect earlier lawful processing.

4. Facebook Messenger access

The integration uses pages_messaging for Page messaging and pages_manage_metadata to manage the Page's webhook subscriptions. Facebook Page selection also requests pages_show_list and pages_read_engagement to identify available Pages. Access is limited to the connected Page and the permissions authorized through Meta. Connecting a Page does not give us access to unrelated personal Messenger conversations.

Workspace administrators can manage the app's authorization in their Facebook or Meta business settings, or disconnect a Page in Connections. Disconnecting stops new messaging in this app and clears that Page’s saved access token; its history and other workspace data are kept. Removing authorization does not, by itself, erase conversation records already stored inIncepxion AI. To request removal of those records, use the data deletion instructions below.

5. Chatbot replies

Replies may be written by a person or generated from rules and message templates configured by the workspace user. If that user enables AI features and configures an AI provider, relevant customer messages, conversation context, configured instructions, and selected field values may be sent to OpenAI to generate a response. Human takeover pauses automated replies. You can ask the Page for a person to review your question or correct information collected by the bot.

6. Who can receive information

The authorized workspace owner and assigned team members can access the conversations and records in that workspace. Information is also processed by providers needed to operate the service:

• Meta: provides Facebook and Messenger and processes messages exchanged with the connected Page. See the Meta Privacy Policy.
• OpenAI: processes requests to its API when the workspace enables AI features. See the OpenAI Privacy Policy.
• Railway: provides application hosting, database, and storage infrastructure. See Railway's Privacy Policy.

We may disclose information when required by law or when necessary to investigate abuse or protect legal rights and the security of the service. We do not sell Messenger conversation data or use it for unrelated advertising. This app does not use your Messenger content to train general-purpose AI models.

Providers may process information outside the Philippines. Their handling of information is subject to the applicable service terms, privacy policies, and data protection obligations.

7. Security and browser technologies

The site uses HTTPS, authenticated workspace access, encrypted storage for Page tokens and App Secrets, and signature verification for incoming Meta webhooks. Saved tokens and App Secrets are not returned to the frontend, and application diagnostics redact these credentials. No system can guarantee absolute security.

Short-lived security cookies bind Facebook authorization to the browser that started them. Essential sign-in cookies identify app sessions for up to seven days and are revoked on sign-out. Facebook user tokens are used for identity verification and Page discovery; selected Page tokens are stored encrypted for Messenger. Hosting and sign-in services may use cookies or similar technologies for authentication and security. Incepxion AI does not add advertising pixels or third-party marketing analytics to this site. You can manage cookies in your browser; blocking essential cookies may affect sign-in.

8. How long information is kept

Conversation and workspace records remain stored until removed. Retention is determined by the purpose of the conversation, ongoing customer support, verified deletion requests, and any applicable legal requirements. The app does not currently apply an automatic age-based deletion schedule. Marking a conversation “Done” does not delete it.

Raw webhook event payloads are cleared after successful processing; the resulting conversation records, message content, and identifiers remain in the workspace. Logs and any infrastructure backups are subject to the hosting provider's retention controls.

9. Your rights and data deletion

Subject to applicable law, you may request access to your personal information, correction, deletion or blocking, object to processing, withdraw consent, or request a portable copy. You may also raise a concern with the Philippine National Privacy Commission. Read about these rights in the Philippine Data Privacy Act.

Deletion from Incepxion AI does not delete copies held by Meta or a separate business in its own systems. Contact those providers separately about records they control.

10. Children's information

Incepxion AI is a business communication tool and is not directed to children. We do not intentionally solicit children's personal information. If you believe a child has provided information that should be removed, contact us using the details below.

11. Changes to this policy

We will update this page when our data handling changes and revise the date at the top. Where required, we will provide additional notice or obtain consent before a materially different use of your information.