Privacy policy
Last updated 20 October 2026
Commerce OS helps businesses that sell on Facebook answer customers and take orders. It is a pilot run by Shafayetul Huda Sadi, and this policy explains what data it handles. Questions or requests: shafayet.sadi@gmail.com.
Who this is about
Merchants: the businesses that sign up and connect their Facebook Page.
Customers: the people who message a merchant's Page. We handle their data on the merchant's behalf, to run the merchant's shop. Each merchant's data is kept separate and is never shown to another merchant.
What we collect
- Merchant accounts: name, email, password (stored only as a hash), the people they invite, and the connection to their Facebook Page.
- Messenger conversations with a connected Page: messages, photos, files and voice notes, with the customer's name and Facebook profile picture as Meta provides them.
- Text transcripts of customer voice notes.
- Orders: items, prices, phone number, delivery address and payment notes.
- Reply drafts written by the AI assistant, and what the merchant sent instead.
- Technical logs needed to run and secure the service. We keep message content out of them.
Earlier Messenger chats
When a customer who has messaged a Page before writes to it for the first time after the Page is connected, we import their earlier Messenger conversation with that Page: up to the last 90 days, at most 50 messages. This gives the merchant and the assistant context, such as a previous order or address. It happens once per customer and only for that Page.
How we use it
- To show conversations to the merchant and help them reply and take orders.
- To let the AI assistant suggest replies. In the pilot a person approves every message before it is sent.
- To transcribe voice notes so the merchant and the assistant can read them.
- To keep the service working and secure.
- We do not sell data and we do not use it for advertising.
Who processes it for us
- Meta (Facebook and Messenger), which carries the messages.
- AI model providers (currently OpenAI and Google, directly or through OpenRouter), which read conversation text to suggest replies.
- ElevenLabs, which turns customer voice notes into text.
- Cloudflare R2, which stores photos, files and voice notes.
- Amazon Web Services, which hosts the service and its database.
- Resend, which sends account emails.
- Couriers the merchant chooses (for example Pathao), which receive the delivery details of an order when the merchant books it.
How long we keep it
- Conversations, attachments and transcripts: 12 months after the last message.
- AI drafts: 90 days.
- Raw messages as Meta delivered them: 30 days.
- Orders: while the merchant's account exists. Personal details on them are removed when the customer's data is deleted.
- Backups: deleted data can remain in backups for about 30 more days before they expire.
Deleting your data
Customers can ask the merchant, or write to us at shafayet.sadi@gmail.com, to have their data deleted. We then delete their messages, attachments, transcripts and addresses, and remove their name and phone number from any orders the merchant needs to keep.
Merchants can disconnect their Page in Settings, or remove the app in their Facebook settings; we then stop receiving that Page's messages. To close an account and delete its data, write to shafayet.sadi@gmail.com. We agree a date so you can keep a copy of your orders, and delete the account's data within 30 days of it.
Changes
If this policy changes, we will update the date at the top and tell merchants in the pilot.