Privacy Policy

Account & business data — the name, email, and password (stored as a salted hash, never in plain text) of anyone with a dashboard login, plus the business profile info a client enters (business name, industry, contact details) to ground their AI-generated content.

Website visitors — for a client’s own public site, we record page path, referrer, a rotating per-tab session ID, and coarse device type (desktop/mobile/tablet) for anyone who visits. We do not store IP addresses, precise location, or a persistent cross-site identity.

Leads — when a visitor clicks an ordering channel (WhatsApp, Call, Swiggy, Share) or a dashboard user manually logs an inquiry, we store a name (or “Website Visitor” for a click-only signal), the channel it came from, and an optional message.

Connected Meta (Facebook/Instagram) data — if a business connects their account, we store an encrypted access token, which ad account and Facebook Page they selected, the permissions Meta actually granted, and a log of the actions taken through our dashboard (e.g. a post scheduled, a campaign paused). We do not read a Page’s or Instagram account’s private messages, and we only act on the Page/ad account the business explicitly selected during connection.

AI-generated content — when a business uses the AI caption/image tools, we log the prompt, the provider used, and the resulting image URLs, so usage against their plan’s quota can be tracked and past generations can be reused.

We don’t sell personal data to third parties. We don’t use a client’s connected Meta data for anything beyond operating the features they connected it for (publishing posts they schedule, reporting on campaigns they run). We don’t share one client’s data with another — every organization’s data is isolated in our database and only reachable by that organization’s own logged-in users.

A client’s own team members (as invited by their account owner) can see that organization’s data. Web2Sale’s own administrators can see account and usage data across organizations for support and billing purposes, but do not use a connected Meta account on a client’s behalf without being asked to.

Website analytics events are automatically deleted after 30 days. Account, business profile, lead, and scheduled-content data is kept for as long as the account is active, and deleted on request (see below) or when an account is closed.

See our Data Deletion page for how to ask us to delete your data, including anything associated with a connected Facebook or Instagram account.

Questions about this policy, or about your data: yashwantsinghrandhir@gmail.com.