Privacy Policy

About this app and who it belongs to. Messenger Hub is an internal operational tool built, owned, and operated by 21CT Research Co., Ltd.(“the Company”, “we”, “us”). It is used only by authorized employees of 21CT Research Co., Ltd. and its parent and affiliated companiesto read and respond to messages that customers send to the Company’s own Facebook Pages. It is not a public or third-party product, is not offered to outside organizations, and is not sold or licensed to anyone. The Meta application associated with this policy is owned by 21CT Research Co., Ltd.. The app is hosted at messenger-hub.vercel.app.

1. Scope

This policy explains what data Messenger Hubprocesses through Meta’s platform, the limited purpose for which we process it, how we secure it, how long we keep it, and how anyone can request its deletion. It applies to two groups: (a) the customerswho message the Company’s connected Facebook Pages, and (b) the Company’s authorized staff who use the app.

2. Information we process

From the Company’s connected Facebook Pages.When an authorized admin connects a Facebook Page that the Company manages, we receive and store: the Page’s ID and name, a Page Access Token (stored encrypted), and — via Facebook webhooks — the messages customers send to that Page, including message text, timestamps, and read receipts.

About customers messaging the Page.For each customer we store a Facebook Page-Scoped ID (PSID) and, where permitted for business-owned Pages, the customer’s display name and profile picture (retrieved from Meta’s Messenger User Profile API) so staff can recognize who they are assisting. We do notcollect a customer’s friends, contact list, or any activity outside their conversation with the Company’s Page.

About the Company’s staff. For each authorized user we store an email address, display name, role, and the business units they belong to, to provide login, permissions, and assignment features.

3. Purpose — and the limits on how we use the data

We process this data for one purpose only: to operate the Company’s own customer-service inbox — delivering incoming customer messages to authorized staff, sending the staff’s replies back through Meta’s Messenger Platform, displaying the customer’s name and picture to those staff, and routing and reporting on conversations internally.

We use Meta platform data onlyfor this disclosed purpose and the use case the customer engaged in (messaging the Company’s Page). We do not use it for advertising, profiling, or any unrelated purpose.

4. We do not sell or transfer data

We do not sell, transfer, sublicense, or rentany data obtained through Meta’s platform. We share data only with the limited service providers below, who process it solely on our behalf under contractual confidentiality and security obligations, or where required by law.

• Meta Platforms — message delivery and customer profile data for the Company’s connected Pages.
• Supabase — database, authentication, and encrypted token storage.
• Vercel — application hosting.

5. How we secure data

We maintain technical and organizational safeguards designed to meet or exceed industry standards and to prevent unauthorized access, loss, alteration, or disclosure. Page Access Tokens are held in an encrypted secrets vault; every database table enforces row-level security so each business unit sees only its own data; and customer names and pictures are visible only to authenticated staff of 21CT Research Co., Ltd. — never publicly. If we become aware of a data incident, we will act promptly and notify Meta and affected parties as required by applicable law.

6. Data retention

We keep conversation and customer data only as long as necessary for the Company’s customer-service purpose. We delete it as soon as reasonably practicable when: it is no longer necessary for that purpose; the relevant Page is disconnected or we stop operating Messenger Hub; a customer or user requests deletion; Meta requests deletion to protect users; or the law requires it.

7. Your right to deletion (and how to exercise it)

Anyone whose data is processed by Messenger Hubhas the right to request access, correction, or deletion, consistent with Meta’s Platform Terms and Thailand’s Personal Data Protection Act (PDPA). Full step-by-step instructions are on our dedicated Data Deletion page. In short:

• Customers: email design@21ctresearch.com with the Facebook Page you messaged and your profile name; we delete the associated records within 30 days and confirm.
• Staff / business: disconnect the Page in the app to stop collection, then email design@21ctresearch.com to request erasure of stored history for that Page.

8. Children

Messenger Hub is an internal business tool and is not directed at children under 13.

9. Changes to this policy

We may update this policy; the “Last updated” date above reflects the latest version.

10. Contact

21CT Research Co., Ltd. — design@21ctresearch.com. For any question about this policy or to exercise your data rights, contact us at this address.