Privacy Policy

Who is responsible for what

A shop that uses Magga decides what it sells and what its assistant says. Magga processes that shop’s data on its instructions. For a customer messaging a shop, the shop is the business you are dealing with; Magga is the software it uses.

What we collect from a shop

• The account email and password used to sign in. Passwords are stored hashed by our authentication provider; we never see them.
• The shop name, business type, phone number and how it currently records orders — asked once at sign-up.
• Products, prices, stock levels, promotions and any columns the shop chooses to keep, including files it uploads.
• The instructions the shop writes for its assistant, and the knowledge it adds.
• A Facebook Page access token, when the shop connects a Page. It is stored in a table no browser can read and is used only to receive and send that Page’s messages.

What we collect from a customer messaging a shop

• The message text you send to the shop, and any photo or file you attach.
• Your Facebook page-scoped ID (PSID) and the name shown on your Facebook profile. A PSID is specific to that one Page and cannot be used to identify you elsewhere.
• The replies the assistant sends you, and the time each message was sent.
• Delivery details you give the shop — name, phone, address — when you place an order.

We do not read your Facebook profile beyond your name, we do not access your friends, posts or photos, and we do not use your messages to advertise to you.

Why we use it

• To answer your message with the shop’s real prices and stock.
• To record the shop’s orders and its credit usage.
• To show the shop its own conversations so a person can take over when needed.
• To keep the service working — error logs, abuse prevention, and billing.

Who we share it with

We do not sell data. We share only what a step requires, with:

• Supabase — database and file storage (Singapore region).
• Vercel — application hosting.
• DeepSeek — the AI model that writes the reply. The message text and the matching catalogue rows are sent to generate an answer.
• Meta — to receive and send Messenger messages.

Magga staff do not read a shop’s conversations or orders. Any use of shop data beyond running that shop’s own service requires the shop to opt in, and produces only aggregated, anonymised output covering many shops — never one shop’s numbers and never a customer’s identity.

How long we keep it

• Messages and conversations: kept while the shop’s account is active, so it can serve you and answer questions about your order.
• Orders: kept for as long as the shop needs them for its own records and tax obligations.
• A closed shop account: its data is deleted within 90 days.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Deletion is self-serve and immediate — see Delete my data. When an order exists, we keep the order but remove your name, phone and address from it, because a shop is entitled to its own sales record.

Security

• Each shop’s data is separated inside the database itself, not only in application code.
• Facebook Page tokens and service keys are stored where no browser request can reach them.
• Every Messenger webhook is verified against Meta’s signature before it is accepted.
• Connections are encrypted in transit.

Children

Magga is a business tool and is not directed at children under 13.

Changes

If this policy changes materially we will tell shop owners in the dashboard before the change takes effect.

Contact

Questions or requests: min@bettermyanmar.com