Privacy Policy

About this app and who it belongs to. Messenger Hub is an internal operational tool owned by 21CT Research Co., Ltd. (“the Company”, “we”, “us”). It is developed, hosted and maintained by AGILE SOFT CORPORATION COMPANY LIMITED (“Agilesoft”), the software company of the same corporate group. It is used only by authorized employees of the Company and its parent and affiliated companies to read and respond to messages and comments that customers send to the Facebook Pages, Instagram accounts and TikTok accounts of the Company and its affiliated companies (each of which owns its own business portfolio and business accounts). It is not a public or third-party product, is not offered to outside organizations, and is not sold or licensed to anyone.

Who’s who. The Meta application associated with this policy is owned by 21CT Research Co., Ltd.; the TikTok developer application is registered to Agilesoft. Both companies follow this policy, and Agilesoft processes data only to run Messenger Hub for the group. The app is hosted at messenger-hub.21287724.xyz.

1. Scope

This policy explains what data Messenger Hub processes through the Meta, TikTok and YouTube platforms, the limited purpose for which we process it, how we secure it, how long we keep it, and how anyone can request its deletion. It applies to two groups: (a) the customers who message or comment on the connected accounts, and (b) the Company’s authorized staff who use the app.

2. Information we process

From connected Facebook Pages and Instagram accounts. When an authorized admin connects a Facebook Page or Instagram professional account that the Company or one of its affiliated companies manages, we receive and store: the account’s ID and name, an access token (stored encrypted), and — via webhooks and the Graph API — the messages and comments customers send to that account (including text, attachments, timestamps, and read receipts), posts that mention it, and the account’s own posts and performance statistics.

From connected TikTok business accounts. When an authorized admin connects a TikTok business account, we receive and store: the account’s ID, name and profile picture, access tokens (stored encrypted), direct messages customers send to the account, comments on the account’s own videos, and the account’s video and follower statistics. We also use this connection to publish the videos and photos that staff schedule for the account.

From connected YouTube channels. Read-only channel and video statistics, through Google’s YouTube Data and Analytics APIs. We do not read or store viewer identities.

About customers who message or comment. For each customer we store the platform’s ID for them (for example a Facebook Page-Scoped ID or a TikTok user ID), their conversation or comment with the account, and, where the platform provides it, their display name and profile picture, so staff can recognize who they are assisting. We do not collect a customer’s friends, contact list, or any activity outside their interaction with the relevant account.

About the Company’s staff. For each authorized user we store an email address, display name, role, and the business units they belong to, to provide login, permissions, and assignment features.

3. Purpose — and the limits on how we use the data

We process this data for one purpose only: to operate the customer-service inbox, comment moderation, post scheduling and performance reporting of the Company and its affiliated companies — delivering incoming customer messages and comments to authorized staff, sending the staff’s replies back through the relevant platform, displaying the customer’s name and picture to those staff, publishing the posts staff schedule, and routing and reporting on conversations and posts internally.

We use data from Meta, TikTok and YouTube only for this disclosed purpose and the use case the customer engaged in (messaging or commenting on the relevant account). We do not use it for advertising, profiling, or any unrelated purpose.

4. We do not sell or transfer data

We do not sell, transfer, sublicense, or rent any data obtained through these platforms. We share data only with the limited service providers below, who process it solely on our behalf under contractual confidentiality and security obligations, or where required by law.

• Meta Platforms — message, comment and statistics data for connected Facebook Pages and Instagram accounts.
• TikTok — message, comment, publishing and statistics data for connected TikTok business accounts.
• Google (YouTube) — read-only channel statistics.
• Supabase — database, authentication, and encrypted token storage.
• Cloudflare (R2) — storage for images, videos and files sent or received in conversations and scheduled posts.
• Vercel — application hosting.
• AI analysis provider (Vercel AI Gateway or Google Gemini) — the businesses’ own post content and performance figures, for on-demand content reports. Customer messages are never sent to it.
• GIPHY — GIF search; only the search words staff type are sent.

5. How we secure data

We maintain technical and organizational safeguards designed to meet or exceed industry standards and to prevent unauthorized access, loss, alteration, or disclosure. Access tokens for every connected platform are held in an encrypted secrets vault; every database table enforces row-level security so each business unit sees only its own data; and customer names and pictures are visible only to authenticated staff of the Company and its affiliated companies — never publicly. If we become aware of a data incident, we will act promptly and notify the affected platform (Meta or TikTok) and affected parties as required by applicable law.

6. Data retention

We keep conversation and customer data only as long as necessary for the Company’s customer-service purpose. We delete it as soon as reasonably practicable when: it is no longer necessary for that purpose; the relevant account is disconnected or we stop operating Messenger Hub; a customer or user requests deletion; the platform (Meta or TikTok) requests deletion to protect users; or the law requires it.

7. Your right to deletion (and how to exercise it)

Anyone whose data is processed by Messenger Hub has the right to request access, correction, or deletion, consistent with Meta’s Platform Terms, TikTok’s developer terms, and Thailand’s Personal Data Protection Act (PDPA). Full step-by-step instructions are on our dedicated Data Deletion page. In short:

• Customers: email design@21ctresearch.com with the platform, the Page or account you messaged or commented on, and your profile name; we delete the associated records within 30 days and confirm.
• Staff / business: disconnect the account in the app to stop collection, then email design@21ctresearch.com to request erasure of stored history for that account.

8. Children

Messenger Hub is an internal business tool and is not directed at children under 13.

9. Changes to this policy

We may update this policy; the “Last updated” date above reflects the latest version.

10. Contact

21CT Research Co., Ltd. (owner), developed and maintained by AGILE SOFT CORPORATION COMPANY LIMITED, 50/11 Moo 2 Sukhumvit Road, T. Tachang, A. Muang, Chanthaburi 22000, Thailand. For any question about this policy or to exercise your data rights, contact us at design@21ctresearch.com.