Privacy Policy

What we process

Account data: your name, email address and the Facebook account identifier returned to us when you connect your Page.

Page data: the identifier, name and category of each Facebook Page you connect.

Post data: the identifier, message text, timestamp and comment count of the recent posts published by a Page you connect. We read these so you can choose which post to reply to. Only the post identifier is stored; the text is displayed to you and not kept. We never publish or modify posts.

Access tokens: encrypted with AES-256-GCM before storage. They are never written to logs.

Comment data: the text, timestamp, identifier and — where Facebook returns it — the author name and author identifier of comments on the posts you choose to reply to.

Reply records: which comment received a reply and when. These contain no comment text and no author information.

Why we process it

To provide the service you asked for: publishing your reply to comments on your own Facebook Page. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

To keep the service secure and diagnose faults. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

To meet statutory retention duties for invoices. Legal basis: legal obligation, Art. 6(1)(c) GDPR.

How long we keep it

Comment text and author information: 30 days, then permanently deleted.

Reply records (comment identifier and timestamp only): kept for as long as your account exists, so that we never reply to the same comment twice.

Invoices and accounting records: 10 years, as required by § 147 AO.

Logs: 30 days.

Access tokens: until you disconnect the Page or delete your account.

Who else processes it

Contabo GmbH, Munich, Germany — server hosting. Data stays in Germany.

Cloudflare, Inc. — content delivery and protection.

Meta Platforms Ireland Ltd. — we read and write data on Facebook on your instruction.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection under Articles 15 to 21 GDPR.

You can delete your account at any time from Settings, without contacting us. The link is in the footer of every page.

To receive a copy of your data, email [email protected] from the address on your account. We answer within 30 days.

You may lodge a complaint with a supervisory authority. For Saxony: Sächsischer Datenschutzbeauftragter.

Automated publishing

SamaReply publishes replies automatically on your instruction. You write the reply text yourself; the service does not generate it. This is indicated in the interface wherever publishing is automated, in line with Article 50 of the EU AI Act.