Privacy Policy
This policy explains what data OM CRM receives from Meta (Facebook, Messenger, Instagram) and other sources, why, where it is stored, who it is shared with and how to have it deleted. It describes what the software actually does today.
1. Who we are
OM CRM (the "Service") is a business tool for managing customer messages, leads and marketing. It is provided by Individual Entrepreneur Oleh Volodymyrovych Morozov, registered in the Unified State Register of Ukraine under record No. 25560000000083744, address: 188 Kerchenska St., Odesa, 65025, Ukraine (the "Operator", "we").
Contact for any privacy question or request: support@omcrm.pro.
Our customers are businesses. When a business connects its Facebook Page or Instagram professional account, that business decides whose messages it processes and why — it is the controller of its customers’ data, and we act as its processor. For the personal data of the people who use OM CRM (the business’s staff) we are the controller.
2. Data we receive from Meta
Only after a business administrator connects a Page or Instagram account through Facebook Login (or Instagram Login) and grants permissions. We receive:
| Category | What exactly | Why |
|---|---|---|
| Connection data | Facebook/Instagram user ID and name of the person who connected the account; granted and declined permissions; access tokens | To keep the connection working and show which permissions are active |
| Pages and accounts | Page ID and name, Instagram professional account ID and username | To know which inbox a message belongs to |
| Messages | Text of Messenger and Instagram Direct messages sent to the business; the link to the first image attachment (the file itself is not downloaded; other attachment types are not stored, only a placeholder); replies sent by the business | To show the conversation to the business and let it reply |
| Sender profile | Page-scoped / Instagram-scoped ID, name or username, profile picture (a copy is saved on our server and refreshed at most once every 30 days) | To show who wrote the message |
| Lead Ads form submissions | Only if the business turns on “Lead Ads”: the answers a person submitted in the business’s Meta lead form (typically name, phone number, email, city and the form’s own questions), the submission time, the form name and ID, and — when Meta provides them — the platform (Facebook/Instagram), ad, ad set and campaign IDs and names. We keep a normalised phone and email only to detect repeat submissions | To create a lead in the business’s CRM (or add a note to an existing lead when the same person submits again) and to notify the business’s team |
| Comments and mentions | Only if the business turns on “Comments”: text and time of comments (and replies in the thread) under the business’s Facebook Page posts and Instagram posts/Reels; Instagram mentions of the business account (the comment or caption text and a link to the post); the post’s ID, link, caption and preview image; replies the business sent publicly or privately, who sent them and when | To show comments to the business and let it reply, hide or delete them, or send one private reply |
| Comment authors | Page-scoped / Instagram-scoped ID, name (Facebook) or username (Instagram) of the person who commented or mentioned the business | To show who wrote the comment and, at the business’s request, to create a lead card |
| Publishing and media library | Only if the business uses the “Content plan”: photos and videos uploaded by the business’s staff with technical metadata (size, resolution, aspect ratio, duration, codecs), titles, tags and folders; post texts, the selected accounts, the publishing date and time; the result (ID and link of the published post, error reason) | To publish a post, at the business’s command, on behalf of the business’s OWN Facebook Page, Instagram or Threads account at the chosen time |
| Threads connection | ID, username and name of the Threads account the business connected; granted permissions; access token (valid 60 days, refreshed automatically); Threads account and post statistics — only if the business turns on “Page analytics” | To publish posts to Threads and show their statistics |
| TikTok connection | ID (open_id), username, display name and avatar of the TikTok account the business connected; granted permissions; access token (24 hours) and refresh token (365 days); creator data for the posting form (available privacy levels, whether comments, Duet and Stitch are allowed, maximum video duration); account statistics (followers, following, likes, number of videos) and metrics of the latest videos (views, likes, comments, shares) | To publish videos and photos to TikTok at the command of the business and to show its account statistics |
| Page and account insights | Only if the business turns on “Page analytics”: daily aggregated metrics of the business’s own Facebook Page and Instagram professional account (followers, reach, views, interactions, profile visits, link and contact taps, new follows and unfollows); statistics of the business’s own posts, Reels and Stories (views, reach, likes, comments, saves, shares, watch time) together with the post caption, link and preview; aggregated audience (age ranges, gender, top cities and countries — counts only) | To show the business its Page statistics, compare periods and produce a report or CSV. These are aggregates without personal data: we do not receive the individual people who viewed or followed |
| Ad accounts | Only the business’s OWN ad accounts that it connected (permission ads_read): ad account ID, name, status, currency, time zone, business name; the structure of campaigns, ad sets and ads (names, IDs, status, objective, optimization goal, budget — for display only); aggregated statistics for the selected period and by day (spend, impressions, reach, frequency, clicks, CTR, CPC, CPM, results and cost per result); ad creative preview (title, text and a thumbnail link — the thumbnail is shown to the business’s staff directly from Meta’s servers and is not stored by us, except in the ad data store described below) | To show the business its advertising results and the REAL cost of a lead: the business’s own leads that came from Lead Ads (ad, ad set and campaign IDs) or carry a campaign tag (utm_campaign) are matched to its campaigns inside its CRM, and the spend is divided by the number of these leads and by how far they progressed in the business’s sales funnel. Nothing is sent back to Meta. The Service only reads statistics — it does not create, change, pause or fund ads. These are aggregates without personal data about the people who saw the ads |
| Ad data store (hub owner only) | Only in the OM CRM hub and only for an ad account where the administrator turned on the “data store”: the history Meta still provides (up to 37 months) of the same aggregated statistics — by day for each ad, and by month split by age and gender, placement and device, region and hour of day; settings of campaigns, ad sets and ads (objective, budgets, bid strategy, targeting — locations, age, gender, interests, custom and lookalike audience names, exclusions, placements); creative texts (primary text, headline, description, call to action, link) and a stored copy of the creative thumbnail (JPEG up to 200 KB) | Analysis of the administrator’s own advertising over a long period. Read-only; aggregates without personal data about the people who saw the ads |
| Technical logs | Metadata of webhook notifications (type, time, result — without message content; only the last 500 events are kept); log of Graph API calls (endpoint without token, status, error codes, rate-limit counters) | Security, troubleshooting, respecting Meta rate limits |
Comment and mention events are stored only when the business has turned on “Comments”; otherwise they are logged only as technical metadata and their content is not stored. The business’s own comments are not stored as incoming. Lead Ads submissions are received only when the business has turned on “Lead Ads”; otherwise the notification is logged only as technical metadata. Submissions from the last 90 days (the period Meta keeps them) can be imported once by a staff member; imported leads do not trigger notifications.
Page insights are collected only when the business has turned on “Page analytics”: once a day, and hourly for Stories while a Story is available (24 hours). After it is turned on, we import the history Meta still keeps (about 90 days for Instagram, up to 2 years for Facebook Pages). Meta provides Instagram audience data only for accounts with at least 100 followers and no longer provides age and gender for Facebook Pages.
Posts are published only at the business’s command: a staff member chooses the accounts, text, media and time — the Service never publishes on its own initiative. So that Meta or Threads can fetch a media file, a temporary link with an unguessable key is created for the duration of publishing (valid for at most 48 hours and revoked right after publishing); there is no other way to access the files from outside.
A staff member can create a lead card from a comment (the author’s name or username, the comment text and a link to the post). A private reply to a comment is sent at most once and no later than 7 days after the comment; the conversation then continues in the inbox under the normal messaging windows.
If a person shares a phone number in the conversation, the business’s CRM may create a lead card with the name, phone number and the answers given in the conversation.
3. Other data
- Staff accounts: name, login, role, password hash, activity in the CRM.
- Early-access waitlist on omcrm.pro: if you leave your email in the form on omcrm.pro, we store the email address, the language of the page and the campaign tags of the link you came from (utm_source, utm_medium, utm_campaign), plus only the domain of the site that referred you, with the date. We do not store your IP address or browser details. The only purpose is to notify you once when early access to OM CRM opens — no newsletters or other mailings. The data is stored on our IONOS server in Germany together with the rest of the Service data, is not shared with third parties and is kept until early access opens or until you ask us to delete it: write to support@omcrm.pro. The omcrm.pro site uses no cookies, analytics or trackers.
- Other channels the business may connect (Telegram, OLX, website forms): processed the same way and for the same purposes.
- Browser storage: the web app keeps a sign-in token and theme settings in your browser’s local storage. We use no advertising or analytics cookies and no third-party trackers; these legal pages contain no scripts at all.
4. How we use the data
- to provide the Service: a shared inbox, replying to customers, lead management and advertising reports for the business that connected the account;
- to generate automatic replies or reply suggestions with AI — only if the business turns this feature on (see “AI providers” below);
- to notify the business’s team about new conversations and leads;
- to keep the Service secure and working (logs, rate limits, diagnostics).
We do not sell data, do not use it for advertising, do not build profiles of people across businesses, do not pass it to data brokers and do not use data of one business for another. Data received from Meta is used only to provide the Service to the business that connected it, in line with the Meta Platform Terms and Developer Policies.
Legal basis (GDPR Art. 6): performance of our contract with the business (Art. 6(1)(b)); our legitimate interest in security and diagnostics (Art. 6(1)(f)); for data of the business’s own customers we process on the business’s instructions (Art. 28). The Service also complies with the Law of Ukraine “On Personal Data Protection”.
5. AI providers
The Service has an optional AI agent that can reply to incoming messages or prepare replies. It is off by default and is turned on and configured by the business. When it is on, the following is sent to the AI provider selected by the business:
- the text of the last messages of the conversation (up to 20) and the new incoming message;
- the business’s own instructions: sales script, price list, knowledge-base excerpts.
The contact’s name, username, profile picture and attachments are not sent. If a knowledge base is attached to the agent, the incoming message text is also used as a search query in it.
Automatic replies to comments are a separate setting per account, also off by default. With keyword rules, nothing is sent to an AI provider: replies come from the business’s own templates. Only in the “agent” mode is the following sent to the chosen AI provider: the comment text, the post caption, up to 20 comments of the thread and the commenter’s name or username (so the reply can address the person). The AI suggests a public reply, a private reply, hiding (only if the business allowed it) and — only if the business turned this on — creating a lead. Automatic actions are limited per hour, at most one public and one private reply per comment, and are cancelled if a staff member has already replied, hidden or deleted the comment.
AI assistant in the content planner (drafting post texts, adapting them for Instagram / Facebook / Threads, suggesting hashtags and carousel texts, suggesting a brand style from reference images, generating background images) works only when a staff member presses the button. It sends to OpenAI, L.L.C. only what the business prepared itself: the brief or draft text, the brand style (tone, signature, call to action, mandatory hashtags) and, for a style suggestion, the reference images the business uploaded. Data received from Meta (messages, comments, followers, statistics) is not sent; the “best time to post” is calculated from the business’s own statistics on our servers, without AI. Generated content is marked “AI” and must be reviewed by a person before it can be scheduled.
Sub-processors for this feature: Anthropic, PBC (USA) and OpenAI, L.L.C. (USA) — only the one the business has chosen. Under their API terms, data sent via the API is not used to train their models by default.
Connecting your own AI service (MCP). Data of connected ad accounts (from the ad data store) may, on the administrator’s initiative, be transferred read-only to an AI service the administrator connected through the Model Context Protocol (MCP), such as Claude by Anthropic, PBC — only for accounts the administrator marked “available via MCP”; access is granted and revoked by the administrator.
The CRM also has an internal AI assistant for staff that can read lead cards (name, phone, status) and advertising statistics when a staff member asks it; conversations from Messenger/Instagram are not passed to it.
6. Where data is stored and who receives it
All data of the Service is stored on servers of IONOS SE in a data centre in Germany (EU).
| Recipient | Role | Data |
|---|---|---|
| IONOS SE (Germany) | Hosting | All data of the Service |
| Anthropic, PBC / OpenAI, L.L.C. (USA) | AI processing, only if enabled | As described in “AI providers” |
| Telegram (Telegram FZ-LLC) | Notifications to the business’s own team chat, only if configured | Contact name or username and a link to the card; message text is not sent |
| Meta Platforms Ireland Ltd (Facebook, Instagram, Threads) | Publishing on behalf of the business — only at its command | Texts and media files of the posts the business scheduled or published |
| TikTok (TikTok Technology Limited, Ireland / TikTok Pte. Ltd.) | Publishing on behalf of the business — only at its command; statistics of its own account | Texts and media files of the posts the business scheduled or published; statistics requests for the business’s own account |
| Umnico (umnico.com) | Messaging relay for Instagram Direct and Facebook Messenger — only if the business has connected its accounts through it | Incoming and outgoing messages of these conversations and the contact's public profile (name, username, avatar) |
| SendPulse (sendpulse.com) | Messaging relay for Instagram Direct and Facebook Messenger (chatbots) — only if the business has connected its accounts through it | Incoming and outgoing messages of these conversations and the contact's public profile (name, avatar) |
| GitHub, Inc. (USA) | Storage of backups | Only encrypted database backups (AES-256); the key is held by the Operator and never leaves our control |
Transfers outside the EU/Ukraine rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework offered by these providers. We may disclose data if required by law, and only to the extent required.
7. Security
- all traffic is encrypted with HTTPS/TLS;
- Meta access tokens and integration keys are encrypted with AES-256-GCM; the encryption key is kept separately from the database;
- tokens are never written to logs;
- every webhook from Meta is verified by its HMAC-SHA256 signature — unsigned requests are rejected;
- access inside the CRM is role-based; application processes are not exposed to the internet directly;
- backups are encrypted before leaving the server.
8. How long we keep data
- Conversations, contact profiles and leads are kept while the business uses the Service. We do not currently apply automatic deletion by age. They are deleted at the request of the business or within 30 days after the business stops using the Service.
- Access tokens of a Page/account are erased immediately when the business disconnects it in OM CRM; the conversation history stays until the business asks to delete it. Revoking the app in Facebook/Instagram settings makes all tokens invalid at once.
- Connection records (the connecting person’s ID, name, granted permissions, encrypted user token) are deleted on request.
- Ad statistics cache (responses of Meta’s Marketing API per ad account and period) is refreshed at most every 15 minutes for today’s data and less often for past periods; cached custom date ranges are removed after 30 days, the rest is deleted together with the business’s data or at its request.
- Ad data store (hub only, only for ad accounts where the administrator turned it on): history of up to 37 months — older data is removed automatically every day; kept while the store is on; the administrator can delete a store (including creative thumbnails) at any time; otherwise it is deleted together with the business’s data.
- Page and post insights accumulate day by day while the business uses the Service and are deleted together with the business’s data or at its request; the collection log (no personal data) is kept for 90 days.
- Content plan media library and posts are kept while the business uses the Service; a file a staff member deletes from the library is erased from disk immediately. Temporary links for Meta/Threads are valid for at most 48 hours.
- TikTok statistics snapshots accumulate day by day while the business uses the Service (TikTok returns no history — the series is built from our daily snapshots) and are deleted together with the business’s data or at its request; the TikTok API call log (technical records without post content) is kept for diagnostics until the business’s data is deleted.
- Webhook log: the last 500 events (metadata only). API call log: technical records without message content, kept for diagnostics until the business’s data is deleted.
- Backups: encrypted daily copies are kept for 30 days, so deleted data disappears from them within 30 days. Rare encrypted archive snapshots made before major maintenance may be kept longer; they are available only to the Operator and are used only for disaster recovery.
9. Your rights
You have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format and withdraw consent. Write to us at support@omcrm.pro. We reply within 30 days.
If you wrote to a business that uses OM CRM, that business controls your data: you can contact it directly, or contact us and we will pass your request on and help carry it out.
You can also complain to a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EU — the data protection authority of your country.
How to delete data step by step: Data Deletion Instructions.
10. Children
The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect data of children.
11. Changes
We will update this page when the processing changes — for example, before launching new Meta features (ad management). The date of the latest version is shown at the top.