Privacy Policy

1. Who we are

Social Kirin ("Social Kirin", "we", "us", "our") is an AI-powered comment and direct-message moderation service operated by D AGE Technology (SSM registration no. PC0005997-A), a sole proprietorship registered in Malaysia.

Address: Lintang Mayang Pasir 1, Bandar Bayan Baru, 11950 Bayan Lepas, Pulau Pinang, Malaysia
Email (privacy and data requests): hello@b2bautomator.com

This Privacy Policy explains what personal data we collect, why we collect it, how we use, share and protect it, and the choices you have. It applies to our website, our application and any related services (together, the "Service").

2. Our role: controller and processor

• For account, billing and website data about you, we are the data controller (in Malaysian PDPA terms, the data user).
• For content from the social media accounts you connect (comments, messages and related metadata, including content written by your followers and other third parties), we act as a processor / service provider on your behalf. We process that content only to provide the Service to you, under your instructions. You, as our customer, decide how moderation rules are configured and are responsible for having a lawful basis to moderate content on your accounts.

3. Information we collect

3.1 Information you give us

• Name, email address and business or company name
• Account credentials (passwords are stored only in hashed form)
• Your Service configuration: moderation rules, brand-voice settings, keywords, templates
• Messages you send to us for support

3.2 Billing information

Payments are processed by Stripe. Card and payment details are entered directly with Stripe. We do not receive or store full card numbers. We receive limited billing information from Stripe, such as subscription status, plan, billing country and the last four digits of the card.

3.3 Data from connected social media accounts

When you choose to connect an account, we access, through the platforms' official APIs and only with the permissions you approve:

• Instagram (Meta): comments on your posts and the accounts that wrote them (username and ID), message content and metadata where DM features are enabled, and basic information about your professional account.
• Facebook Pages (Meta): comments on your Page's posts, commenter name and ID as made available by Meta, Page messages where DM features are enabled, and basic Page information.
• YouTube (Google): comments on your channel's videos, commenter display name and channel ID, and basic channel and video identifiers, obtained through the YouTube Data API after you authorise access with your Google account.
• Access tokens issued by these platforms, which allow the Service to act on the connected account. Tokens are stored encrypted and are never displayed or shared.

We collect only what is needed for moderation, replies and the moderation history you see in your dashboard.

3.4 Information about people who comment on or message your accounts

Because the Service reads comments and messages sent to your accounts, we process the content and public identifiers (such as username or display name) of those people. We process this data on your behalf and only to perform moderation, replies and reporting for you.

3.5 Technical information

IP address, browser type, device and operating system, pages visited, and error and security logs, used to run, secure and troubleshoot the Service.

4. How we use information

We use personal data to:

1. Provide the Service: detect spam and abusive comments, hide or flag them, draft or send replies you have enabled, and show moderation history.
2. Operate your account, authenticate you, take payment and provide support.
3. Keep the Service secure, prevent fraud and abuse, and fix errors.
4. Send service and security messages (and marketing email only where you have opted in, which you can withdraw at any time).
5. Comply with legal obligations and enforce our Terms of Service.

Our legal bases (where such bases apply, for example in the EEA/UK) are: performance of our contract with you, our legitimate interests in running and securing the Service, compliance with law, and your consent where we ask for it.

5. Meta platform data (Instagram and Facebook)

We access Instagram and Facebook data only through Meta's official APIs, only with the permissions you grant, and only to provide the moderation, reply and messaging features you enable. We use Meta platform data in accordance with the Meta Platform Terms and Developer Policies. We do not sell Meta platform data, use it for advertising or profiling, or share it with data brokers. You can disconnect our access at any time in your Instagram or Facebook settings (see Section 11).

6. Google API Services disclosure (YouTube)

Social Kirin uses YouTube API Services to read and moderate comments on channels that you connect. By connecting a YouTube channel, you also agree to be bound by the YouTube Terms of Service, and Google's use of your data is governed by the Google Privacy Policy.

Social Kirin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means:

• We use data obtained from Google/YouTube APIs only to provide and improve the user-facing moderation features you request.
• We do not transfer that data to others except as needed to provide those features (for example to our infrastructure and AI processing providers listed in Section 8), to comply with law, or as part of a merger or acquisition with notice to you.
• We do not use it for advertising, including retargeting, personalised or interest-based advertising.
• We do not allow humans to read it, unless you give us explicit consent for specific content, it is necessary for security purposes (such as investigating abuse), or it is required by law.
• We do not use Google user data to develop, improve or train generalised AI or machine-learning models.

You can revoke Social Kirin's access to your Google account at any time at https://myaccount.google.com/permissions and by emailing us (Section 11). Upon revocation we stop accessing your channel and delete the stored YouTube data as described in Section 10.

7. Artificial intelligence, and what we do not do

The Service uses AI models to classify comments (for example spam, abuse, sentiment) and, where you enable it, to draft replies in your brand voice. To do this, the relevant comment or message text and the instructions you configured are sent to our AI routing provider (see Section 8).

We commit that:

• We do not train, fine-tune or improve any AI model using your content, your followers' content, or data obtained from Meta or Google APIs.
• We instruct our AI providers not to retain that content beyond what is needed to return a result, and not to use it for training.
• We do not sell personal data and do not share it for cross-context behavioural advertising.
• We do not use platform data for advertising, profiling, surveillance, or to build marketing or lookalike audiences.
• Our staff do not read your connected-account content, except to provide support you request, to investigate security or abuse, or where the law requires.
• AI output can be wrong. Social Kirin gives you controls over what is automated, and you remain responsible for your moderation settings (see Terms of Service).

8. Who we share data with (sub-processors)

We share personal data only with providers that help us run the Service, under contracts requiring them to protect it and use it only for our purposes:

We may also disclose information: (a) to the social platforms through their APIs as needed to perform the actions you request (such as hiding a comment); (b) where required by law, court order or a valid request from a public authority; (c) to protect our rights, users or the public from fraud, abuse or harm; and (d) in connection with a merger, acquisition or sale of the business, with notice to you. We will update this list when we add or change providers.

9. International transfers

We are based in Malaysia. Our providers may process data in other countries, including the United States and Singapore, depending on the provider and region. Where personal data is transferred outside your country, we rely on appropriate safeguards, such as contractual protections with our providers, in line with applicable law including Malaysia's Personal Data Protection Act 2010 ("PDPA"), the GDPR and UK GDPR where they apply.

10. Data retention

When you disconnect an account, revoke our access on Instagram, Facebook or Google, or ask us to delete your data, we stop collecting data from that account and delete the associated data within 7 days, except for records we must keep by law.

11. How to delete your data or revoke access

• Disconnect or revoke access yourself
  • Facebook / Instagram: remove Social Kirin from your connected apps in your Facebook settings (Settings → Apps and Websites) or Instagram settings (Settings → Website permissions / Apps and websites).
  • Google / YouTube: remove access at https://myaccount.google.com/permissions.
• Ask us to delete your data: email hello@b2bautomator.com with the subject "Data Deletion Request", from the email address registered to your account, and tell us which connected account(s) the request covers. We will confirm by reply and complete deletion within 7 days.
• If you are not our customer but your comment or message was processed through a customer's account, email us with the platform, your username or channel name, and the approximate date, and we will delete the data we hold or direct the request to the customer concerned.

Full instructions are on our Data Deletion page.

12. Your rights

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; withdraw consent; restrict or object to processing; receive a portable copy; and complain to your data protection authority.

• Malaysia (PDPA 2010, as amended): rights of access and correction, to withdraw consent, to limit processing, and (as amended) data portability. You may complain to the Personal Data Protection Commissioner.
• EEA/UK (GDPR): the rights above, plus the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): rights to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information as those terms are defined.

To exercise any right, email hello@b2bautomator.com. We may need to verify your identity, and we will respond within the period required by applicable law. We will not discriminate against you for exercising your rights.

13. Security

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, encryption of platform access tokens at rest, access controls limited to what is necessary, and separation of customer data. No online service can be perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

14. Cookies

We use only essential cookies and similar technologies needed to keep you signed in and to secure the Service. We do not use advertising cookies or third-party analytics trackers. If this changes, we will update this policy and request consent where required.

15. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, for material changes, notify you by email or in the Service before they take effect.

17. Contact

D AGE Technology (SSM no. PC0005997-A), trading as Social Kirin
Lintang Mayang Pasir 1, Bandar Bayan Baru, 11950 Bayan Lepas, Pulau Pinang, Malaysia
Email: hello@b2bautomator.com