Privacy Policy

MySalesFlow — Automotive Lead Operations Hub · Operated by TheCarCo

1. Introduction

This Privacy Policy describes how MySalesFlow, operated by TheCarCo ("we", "our", or "us"), collects, uses, and protects information when you connect your Instagram Business Account or Facebook Page to our platform, or when you message one of our connected Facebook Pages or Instagram accounts.

By connecting your Instagram account or Facebook Page, or using our services, you agree to the practices described in this policy. If you do not agree, please disconnect the integration from your settings.

2. Information We Collect

When you authorise our app through Instagram Business Login, we collect:

  • Your Instagram Business account profile information (name, username, account ID)
  • All incoming Direct Messages (DMs) received in your Instagram Business inbox — including the full message text, the sender's Instagram-scoped user ID (IGSID), and the timestamp
  • Outgoing replies sent from our platform — the message text, recipient IGSID, and timestamp are stored to keep conversation threads coherent
  • Basic profile information of senders (Instagram username and display name), fetched from the Graph API to label conversations in our dashboard
  • Phone numbers extracted from incoming messages, stored separately as sales leads together with the source message text and sender identifier

When a Page administrator connects a Facebook Page through Facebook Login, we collect:

  • The Facebook Page's ID and name, and a Page access token used to receive and send messages on the Page's behalf
  • All Messenger messages sent to the connected Page — the message text and attachments, the sender's Page-scoped user ID (PSID), and the timestamp
  • Replies sent from our platform — the message text, recipient PSID, and timestamp
  • The sender's name and profile picture as made available by Messenger, used only to label conversations in our dashboard
  • Phone numbers extracted from incoming messages, stored as sales leads as described above

We store the full text of every incoming and outgoing message processed through our platform in order to display complete conversation threads and enable your sales team to reply. Message data is retained for as long as the Instagram or Facebook integration remains connected; it is deleted upon disconnection or upon request (see Data Deletion Requests).

3. Permissions Used

Our application requests only the following Instagram and Facebook permissions, which are the minimum required to operate our features:

Permission Purpose
instagram_business_basic Read the basic profile information of the connected Instagram Business account (name, username, account ID) to identify and associate the account within our platform.
instagram_business_manage_messages Receive real-time webhook notifications for every Direct Message that arrives in your Instagram Business inbox, store the full conversation thread in our platform, and send replies back to customers on behalf of the connected Instagram Business account — all from within our sales dashboard. We also scan incoming messages for phone numbers and save any found as sales leads for follow-up.
pages_show_list List the Facebook Pages you manage so you can choose which Page to connect to our platform.
pages_messaging Receive Messenger messages sent to the connected Facebook Page, store the conversation thread in our platform, and send replies to customers on the Page's behalf from within our sales dashboard.
pages_manage_metadata Subscribe the connected Page to real-time webhook notifications so new messages appear in our dashboard as they arrive.
pages_read_engagement Read the connected Page's basic details (its id and name) so it can be listed and identified in our dashboard when you connect it. We do not read, store or publish the Page's posts, comments or followers.
Human Agent Allow a member of your sales team to manually reply to a customer's own enquiry up to seven days after their last message, when it could not be resolved within the standard 24-hour messaging window (for example over a weekend, or while a valuation or finance decision is pending). Replies sent this way are always written by a person, never automated.

We request only the minimum permissions necessary. No other permissions are requested or used.

4. How We Use Your Information

  • To identify which Instagram Business account or Facebook Page is connected to our platform
  • To receive real-time notifications of incoming messages via Meta's webhook system
  • To store and display complete conversation threads in our internal dashboard, enabling your sales team to read and respond to messages
  • To send replies to customers directly from our platform on behalf of the connected Instagram Business account or Facebook Page
  • To scan incoming message text for phone numbers and store any found as sales leads
  • To display captured phone leads and full conversation histories in our admin dashboard for sales team follow-up
  • To cache sender profile information (username, display name) to make conversations easier to identify
  • To authenticate and maintain a secure connection to the Meta Graph API

We do not sell, rent, or share your Instagram data with any third party for marketing, advertising, or profiling purposes.

5. Data Storage & Security

Access tokens obtained during the OAuth flow are encrypted at rest using AES-256 encryption before being stored in our database. We use HTTPS/TLS for all data in transit.

We retain access tokens and associated account data only for as long as the Instagram or Facebook integration remains connected. Disconnecting the integration immediately removes all stored tokens from our system.

6. Data Sharing

We do not share your Instagram or Facebook data with third parties except:

  • Where required by law or a valid legal order
  • With service providers acting on our behalf who are bound by confidentiality agreements and who process data only as instructed by us

We do not use Instagram or Facebook data to train AI models or for any purpose outside the stated scope of this policy.

7. Your Rights

You may at any time:

  • Disconnect the Instagram or Facebook integration via our platform settings, which deletes all stored tokens immediately
  • Revoke access directly in your Instagram or Facebook account settings under "Apps and Websites"
  • Request deletion of any data we hold about you by following the steps in Data Deletion Requests below
  • Request a copy of the data we process on your behalf

8. Data Deletion Requests

You can ask us to delete the data we hold about you at any time, whether you are a business that connected an Instagram account or Facebook Page to MySalesFlow, or a person who has messaged one of our connected Pages or accounts. To make a request:

  1. Email aryan@thecarco.co.uk with the subject line "Data deletion request".
  2. Tell us who you are so we can find your data: for a connected business, the name of the Facebook Page or Instagram account; for a customer, the name you use on Facebook or Instagram and the Page or account you messaged.
  3. We will acknowledge your request within 7 days and delete the data within 30 days of receiving it. We will confirm by email once the deletion is complete.

What we delete on request:

  • Access tokens and connection details for the Instagram account or Facebook Page
  • Stored Messenger and Instagram conversation threads, including message text and attachments
  • Cached sender profile information (name, username, profile picture)
  • Sales leads created from your messages, including any phone number extracted from them

We may keep a minimal record where the law requires it (for example, records of a vehicle purchase). You can also remove MySalesFlow's access yourself at any time from your Facebook settings under Settings & privacy → Settings → Apps and Websites, or from your Instagram settings under Apps and Websites. Removing the app revokes our access token; any data already stored is deleted by request as described above.

9. Cookies

Our platform uses session cookies solely to maintain your authenticated session and to store temporary OAuth state parameters during the Instagram and Facebook login flows. We do not use tracking or advertising cookies.

10. Children's Privacy

Our services are intended for business use only and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the bottom of this page will reflect the most recent revision. Continued use of the integration after a change constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or your data, please contact:

Last updated: 27 October 2026