Privacy Policy for Meta Platform Integrations

Effective 30 September 2026. Version 2026-09-30.

1. Who we are

FRIDAY HOLDING, TOO ("we", "us") is a company registered in the Republic of Kazakhstan (BIN 230140044231; Kazakhstan, Almaty, Bostandyk district, Abay avenue 52, office 802-65, 050008). We own the RevBack app on Meta platforms and operate the RevBack integrations with Instagram, Facebook and WhatsApp.

Contact for privacy questions: support@revback.ai. Phone: +7 707 929 15 13.

2. What this policy covers

RevBack is a customer messaging platform for businesses. A business connects its own accounts — an Instagram professional account, a Facebook Page or a WhatsApp Business number — alongside its other channels, so that its team can read and answer customer messages in one place.

This policy describes how we handle the data we receive from Meta platforms through these integrations. The business that connected the account decides why and how this data is used; we process it on that business's behalf and at its direction.

The integrations become available as each one is released and Meta grants the required access.

3. What data we receive

Through a connected account we receive:

messages sent to the business and the business's replies, including attachments (images, video, audio, files);
comments on the business's posts, and a preview of the post a comment or message refers to;
the name and platform identifier of the person who wrote, and their profile picture;
the person's phone number (for WhatsApp);
delivery and read receipts;
the access token issued by the platform when the business authorizes the connection.

We do not ask for or store the login or password of a Meta platform account. A connection is made only through the platform's own authorization.

We do not import conversations that took place before the account was connected to RevBack.

4. How we use the data

We use the data only to provide the service to the business that connected the account:

to show incoming messages and comments to the business's team;
to send the replies the team writes;
to keep the conversation history available to the business.

If the business turns on the optional AI features, which are off by default, the data is also used:

to suggest draft replies, which a team member reviews before sending;
to identify the topics of conversations and prepare summaries for the business;
to assess the quality of the business's conversations, including per team member;
to build and maintain that business's own knowledge base from its conversations, which is used only to prepare replies for that same business.

5. What we do not do

We do not:

sell, license or distribute data received from Meta platforms;
use it for advertising or audience targeting;
build or augment profiles of people;
use it for surveillance;
use it to make eligibility determinations about people, including for hiring, dismissal, pay, credit, insurance, housing, education, government benefits or immigration status, and we contractually prohibit our customers from doing so; conversation assessments are advisory analytics for the business;
use it to create, develop, train or improve machine learning or artificial intelligence models, either our own or third-party;
use it for our own analytics or any other purpose of our own.

Adding to a business's knowledge base is not model training: the language model is not changed, and what is learned is stored in that business's project, used only there and deleted together with it.

6. Who we share the data with

The data is shared only with service providers that process it for the purposes in section 4:

Individual Entrepreneur Denis Safiulin (Russia), who operates the RevBack service, its servers and databases on our behalf;
infrastructure providers, for hosting and data transmission;
the AI provider (Anthropic, PBC, United States), listed at revback.ai/subprocessors (in Russian), only if the business has turned on AI features. Message texts are sent to the AI provider after automatic masking of names, phone numbers, email addresses, payment card and account numbers, document numbers and links; masking is automatic and may be incomplete. Images are sent as they are. Voice messages, documents and video are not sent. The AI provider's commercial terms prohibit it from using this data to train its models.

Service providers are required to follow the same data protection requirements as we do.

We also disclose data where the law requires it.

7. Where the data is stored

Data is stored in databases located in the Russian Federation. When AI features are on, data is transferred to the AI provider in the United States as described in section 6. Data of different businesses is kept separately.

8. How long we keep the data

We keep the data for as long as the business needs it to handle its conversations: until the business deletes it, deletes the project or account, or another case in section 10 occurs. Disconnecting a channel does not by itself delete the history.

Copies of requests sent to the language model and of its responses, and the AI call log, are kept for 90 days, to handle the business's requests about how the AI features worked.

9. Security

We use encryption in transit, encrypted storage of access tokens, access control and access logging, and backups.

To report a security vulnerability, write to support@revback.ai.

10. Data deletion

Data received from Meta platforms is deleted:

at the request of the business that connected the account;
at the request of the person the data relates to: we pass the request to the business they contacted and delete the data once the business confirms; if the business does not reply within 10 business days, or refuses without naming a legal duty to keep the data, we delete it ourselves;
at Meta's request;
when the business deletes its project or account, or its agreement with us ends;
when the data is no longer needed to provide the service;
when we stop supporting the channel.

How to request deletion.

If you are a business using RevBack: delete the data in your RevBack account, or write to support@revback.ai.

If you wrote to a business through Instagram, Facebook or WhatsApp: contact that business — it decides how your data is used. You can also write to us at support@revback.ai and name the business you contacted; we will pass your request to that business and let you know. If the business does not reply within 10 business days, or refuses without naming a legal duty to keep the data, we will delete your data ourselves and let you know. If the business names such a duty, we will tell you what it is.

Data is deleted from the main database within 10 business days: at the business's request, from the day we receive it; at your request, from the day the business confirms it or, if the business does not reply or refuses without naming a legal duty to keep the data, from the day its 10 business days to reply expire; in other cases, from the day the case listed above occurs. Data is deleted from backups no later than 30 days after that. Data that the law requires us to keep is kept for the period the law sets.

Disconnecting an account from RevBack stops new data from being received. The business can disconnect its Instagram, Facebook or WhatsApp account at any time and request deletion of the conversation history.

11. Your rights

You can ask what data about you is processed, ask for it to be corrected or deleted, and withdraw your consent. Write to the business you contacted or to us at support@revback.ai. You can also complain to the data protection authority of your country.

12. Changes to this policy

We publish changes on this page and notify our business customers of material changes at least 15 days before they take effect. We change the scope of processing of data received from Meta platforms only after Meta approves the change.

13. Contact

FRIDAY HOLDING, TOO
BIN 230140044231
Kazakhstan, Almaty, Bostandyk district, Abay avenue 52, office 802-65, 050008
Phone: +7 707 929 15 13
Email: support@revback.ai