Privacy Policy

Last updated

On this page

1. Who we are

AFP.MONSTER is run by FJORN LLC, a limited liability company organised under the laws of the State of Wyoming, USA (filing ID 2026-002021904), with its address at 75 E 3rd St, Sheridan, WY 82801, USA (“we”, “us”). We are the controller of the personal data described here, unless this policy says otherwise. Privacy contact: [email protected].

We serve customers worldwide, including in the United Kingdom and the European Economic Area (“EEA”). For people in the UK, we follow the UK GDPR and the Data Protection Act 2018. For people in the EEA, we follow the EU GDPR. For California residents, see section 12.

2. Data we collect

  • Account data: name, email, password hash, Facebook user ID, and the Pages and Instagram accounts you connect.
  • Connected account content: comments and posts on your connected Pages and accounts, the names or IDs of the people who wrote them, and, if you turn it on, private messages sent to your connected accounts.
  • Rules, templates and settings you create in the Service.
  • Text you type into the AI assistant and the automation settings it needs to answer.
  • Billing data: plan, dates, amounts, country, tax details and payment status. We do not receive or store your full card number.
  • Technical and usage data: IP address, device and browser data, logs, and pages used.
  • Support messages you send us.
  • Cookie and analytics data, as described in section 8.
  • To provide the Service and your account (contract).
  • To process payments, invoices, taxes and refunds (contract and legal obligation).
  • To keep the Service secure and prevent abuse and fraud (legitimate interest).
  • To give support and answer you (contract and legitimate interest).
  • To improve the Service using usage data (legitimate interest; consent where the law requires it).
  • To measure our own advertising with Google and Meta (legitimate interest; consent for cookies, see section 8).
  • To send service emails such as receipts and changes to your plan (contract). We send marketing emails only with your consent, and you can unsubscribe at any time.
  • To follow the law and answer legal claims (legal obligation and legitimate interest).

For the comments and messages of people who write to your accounts, you decide why and how the Service processes them, and we process them for you. In this case, you are the controller and we are your processor. Email us if you need a data processing agreement.

4. Facebook and Instagram permissions

When you connect an account, Meta asks you to grant the permissions the Service needs. We use them only for the features you turn on and in line with the Meta Platform Terms and Developer Policies. For example: pages_show_list to list your Pages; pages_read_user_content and pages_manage_engagement to read, hide or remove comments; pages_messaging to send private replies; pages_manage_metadata to receive new comments in real time; and the matching Instagram permissions for Instagram accounts.

5. We do not sell your data

We do not sell personal data. We share data with Google and Meta only to measure our own advertising, as described in section 8.

6. Who receives data

We share data only with providers that help us run the Service, under contracts that protect it:

  • Meta Platforms - the Graph API, which is the source of the content the Service acts on, and the Meta Pixel and Conversions API, which measure our own advertising.
  • Google - Google Analytics 4 for website and product analytics, and measurement of our own Google Ads.
  • PostHog - product analytics and session recordings (how you move through the site; typed text is masked), hosted in the EU, only with your analytics consent.
  • Paddle - our Merchant of Record for card payments. Paddle acts as the seller and as an independent controller of your payment data. We receive limited data from it, such as your email, country, plan, tax details and payment status.
  • Cryptomus - processes cryptocurrency payments. It receives the payment amount and the order details.
  • Cloudflare - network security, content delivery and file storage.
  • Infrastructure providers: server and database hosting in the EU, delivery of service emails, AI model providers that answer the AI assistant (they receive only what you type into it and the automation settings needed to answer, and do not use it to train their models), and a messaging service for notifications, only if you connect it.
  • Professional advisers, regulators or courts, where the law requires it.

If we sell or reorganise the business, data can move to the new owner under the same protections.

7. International transfers

We are based in the USA, our servers are in the EU, and some providers are in other countries. When we transfer personal data out of the UK or the EEA, we use a legal safeguard, such as an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. You can ask us for a copy of the safeguard.

8. Cookies and similar technologies

Strictly necessary cookies keep you signed in and keep the Service secure. They do not need consent.

Analytics cookies (Google Analytics, PostHog) and marketing cookies (Meta Pixel) are off until you accept them in our cookie banner. You can change your choice at any time with the “Cookie settings” link at the bottom of every page.

Separately from cookies, our servers send Google and Meta a small set of conversion events, such as an account registration or a purchase. These events identify you by a hashed (irreversible) email address, not by a cookie, and nothing is stored on your device. We send them on the basis of our legitimate interest in measuring our own advertising. You can object at any time by email, and we stop sending events about you.

9. How long we keep data

  • Account data: while your account is open.
  • Content from connected accounts: while your plan is active. After your plan ends, we delete this data after 60 days, unless you ask us to delete it sooner.
  • After you delete your account, we keep it for 30 days so that you can restore it, then we delete it.
  • Billing records: for the period that tax and accounting law requires (usually 6 to 7 years).
  • Logs: for a short period, only as long as needed for security and debugging.

10. Deleting your data

You can delete your account in your account settings or by email to [email protected]. We act on deletion requests within 30 days, except for data that we must keep by law.

If you remove our app from your Facebook or Instagram account, you can also ask us to delete the data we got through it. Send an email to [email protected] with the subject “Data deletion” and the email or Facebook name of your account. This page is our Meta data deletion instructions URL: https://afp.monster/privacy-policy#data-deletion.

11. Your rights

You can ask us to: give you a copy of your data; correct it; delete it; limit or object to its use; move it to another service; and withdraw consent at any time. We answer within one month. Email [email protected]. We may need to confirm your identity.

If you wrote a comment or message to one of our customers, you can also contact that customer, or us at the email above.

12. California residents

We do not sell personal information as defined by the CCPA and CPRA. California residents can ask to know, delete or correct personal information, and to opt out of sharing for cross-context behavioural advertising, by emailing [email protected]. We do not treat you differently for using these rights.

13. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children. If you think a child gave us data, email us and we delete it.

14. Security

We use technical and organisational measures such as encryption in transit, access controls and logging. No system is fully secure. If a data breach affects you, we follow the law on notice.

15. Complaints

Email us first at [email protected]. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or to the data protection authority in your country in the EEA.

16. Changes

We can update this policy. We post the new version here with a new date. For material changes, we tell you by email or in the Service.