Privacy Policy — RealConnect CRM

1. Introduction

RealConnect CRM ("we," "our," or "us") is developed and operated by Realtrack Technologies LLC ("RealTrack"), a company registered in Dubai, United Arab Emirates. RealConnect CRM is a customer messaging CRM platform that enables businesses ("Clients") to manage customer communications, campaigns, contacts, and leads through official Meta platforms: the WhatsApp Business Platform (Cloud API), the Messenger Platform and the Instagram API.

Our platform supports WhatsApp Coexistence (simultaneous use of the WhatsApp Business App and Cloud API on the same number), Embedded Signup (Meta's official onboarding flow), Facebook/Instagram Lead Ads integration, Meta Ads management, a shared inbox for Facebook Messenger and Instagram Direct messages, Instagram comment-to-DM replies, Messenger marketing messages to opted-in subscribers, and Facebook Page posts.

RealConnect CRM also integrates with TikTok through the official TikTok API for Business: syncing leads from TikTok Lead Ads (Instant Forms), creating and managing TikTok ad campaigns, reporting lead status back to TikTok, and — once approved by TikTok — a shared inbox for TikTok Direct Messages. Section 3.6 and Section 17 describe the TikTok data we process.

This Privacy Policy describes how we collect, use, process, store, share, and protect personal data of our Clients, their end-users (consumers communicating via WhatsApp, Messenger or Instagram), and website visitors.

2. Definitions

"Client" — A business or organization using RealConnect CRM.
"End-User" — A person who communicates with a Client through WhatsApp, Facebook Messenger or Instagram, or who comments on a Client's Instagram post.
"Messaging Window" — Meta's rule that a business may reply to a person on Messenger or Instagram within 24 hours of that person's last message (or within 7 days for a reply typed by a human agent, using the Human Agent feature).
"WABA" — WhatsApp Business Account, managed within Meta Business Manager.
"Coexistence" — Meta's feature enabling simultaneous use of the WhatsApp Business App and Cloud API on the same phone number.
"Embedded Signup" — Meta's official onboarding flow for connecting a WABA to RealConnect CRM.
"TikTok Data" — Data RealConnect CRM receives from the TikTok API for Business on a Client's behalf, as described in Section 3.6.
"Message Echoes" — Webhook-based mirroring of messages between the WhatsApp Business App and Cloud API under Coexistence.

3. Information We Collect

3.1 Client Account Information

During registration: name, email address, phone number, company/business name, business address, and billing/payment details.

3.2 Data Collected via Meta Permissions

RealConnect CRM requests specific Meta permissions to deliver its features. Below is a complete list of each permission, the data it accesses, how that data is used, and its current Meta App Review status:

Note: Permissions and features marked Pending Approval below are awaiting Meta App Review and are not yet active in production for Clients. Features that depend on them stay disabled until approval is granted. All permissions marked Approved are active.

Permission	Data Accessed & Purpose	Status
public_profile	Accesses the Client's basic Facebook profile (name, profile picture) to identify the user during Embedded Signup and display their identity within RealConnect CRM. No profile data is shared with third parties or used for advertising.	Approved
whatsapp_business_messaging	Enables RealConnect CRM to send and receive WhatsApp messages on behalf of Clients via the Cloud API. This includes text, media (images, videos, documents), location, and contact messages. Used for real-time inbox, broadcast campaigns, template messages, and automated replies.	Approved
whatsapp_business_management	Enables management of the Client's WhatsApp Business Account (WABA), including: managing phone numbers, creating/editing/deleting message templates, subscribing to webhooks, reading WABA quality rating and messaging limits, and managing business profile settings.	Approved
whatsapp_business_manage_events	Enables RealConnect CRM to log conversion events (for example a qualified lead, booking or purchase that the Client marks on a WhatsApp conversation) to Meta for the Client's own WhatsApp Business Account, so Meta can use them for the Client's ads optimization and reporting. Only the event type, its value and the Meta click identifier from a Click-to-WhatsApp ad conversation are sent — never message content.	Approved
business_management	Enables management of the Client's Meta Business Portfolio (Business Manager) assets. Used to: list and verify business assets (WABAs, ad accounts, Pages) during Embedded Signup, manage system user access tokens, and verify business ownership for WABA connections.	Approved
pages_show_list	Retrieves a list of Facebook Pages the Client manages. Used during setup to let Clients select which Page to connect for Messenger, Lead Ads, Page posts and Click-to-WhatsApp (CTWA) ad campaigns.	Approved
pages_read_engagement	Reads Page metadata (Page name, category, ID) required to associate a Facebook Page with Lead Ad forms and CTWA campaigns, and lists the Page's published and scheduled posts so the Client can manage them on the Facebook Posts page. No visitor data is accessed.	Approved
pages_manage_metadata	Subscribes a connected Page to Meta webhook fields: `leadgen` (new Lead Ad submissions), `messages` (Messenger inbox) and `messaging_optins` (marketing message opt-ins and opt-outs). Used only to manage these subscriptions — no Page content is changed.	Approved
pages_messaging	Enables RealConnect CRM to send and receive Messenger messages for the Client's connected Facebook Page. Messages End-Users send to the Page appear in the Client's inbox, and the Client's agents reply within the Messaging Window. For a new sender we read their first and last name (using their Page-scoped ID) to label the conversation.	Approved
pages_manage_posts	Lets the Client publish, schedule, edit and delete posts on its connected Page from RealConnect's Facebook Posts page, and uploads the cover image a Client chooses for a Lead Ads Instant Form as an unpublished Page photo. Nothing is posted automatically, and posts created by other people are never edited.	Approved
pages_user_locale	Reads the locale (language setting) of End-Users who message the Client's Page, so the Client's agents can see the person's preferred language and reply in it. Not used for advertising and never shared.	Approved
marketing_messages_messenger	Lets the Client send Meta's marketing messages opt-in request in a Messenger conversation, records whether the End-User subscribed or unsubscribed (with the opt-in token Meta provides), and send marketing messages only to End-Users who opted in to that Page, viewing their performance through the Client's authorized Ad Account.	Approved
paid_marketing_messages	Lets the Client create paid Messenger marketing message campaigns billed to the Client's own Ad Account and delivered only to opted-in subscribers, and read their delivery, engagement and spend results.	Approved
instagram_business_basic	Reads the connected Instagram professional account's ID, username, name, profile picture and account type to show which account is connected and to route its messages and comments to the right Client.	Approved
instagram_business_manage_messages	Enables RealConnect CRM to receive and reply to Instagram Direct messages in the Client's inbox. For a new sender we read their name and username (using their Instagram-scoped ID) to label the conversation. Replies follow the Messaging Window.	Approved
instagram_business_manage_comments	Receives comments on the Client's own Instagram posts. When a comment contains a keyword the Client configured, RealConnect sends one private reply (and an optional public reply) and adds the commenter to the Client's inbox. Comments without a matching keyword are not stored.	Approved
Human Agent (feature)	Allows a person on the Client's team to personally reply on Messenger or Instagram up to 7 days after the End-User's last message, using Meta's `HUMAN_AGENT` message tag. Never used for automated, scheduled, bulk or promotional messages.	Pending Approval
pages_manage_ads	Enables management of ads linked to Facebook Pages. Used to: create and manage Click-to-WhatsApp (CTWA) ad campaigns that direct users to start a WhatsApp conversation, and connect Lead Ad forms to Pages for lead capture.	Approved
leads_retrieval	Enables real-time retrieval of leads submitted through Facebook/Instagram Lead Ad forms via webhooks. Lead data (name, email, phone number, and custom form fields) is captured and stored in RealConnect CRM for the Client to follow up via WhatsApp. Lead data is only used for the Client's own CRM operations and is never sold or shared.	Approved
ads_read	Reads ad campaign data (campaign name, status, performance metrics, ad set configuration) from the Client's connected Ad Account. Intended to display ad performance analytics in the CRM dashboard alongside WhatsApp engagement data. Pending approval — ad performance analytics are currently unavailable; campaign creation/management via `ads_management` is unaffected.	Pending Approval
ads_management	Enables creating, editing, and managing ad campaigns in the Client's Ad Account. Used specifically for: creating Click-to-WhatsApp (CTWA) campaigns, managing Lead Ad campaigns, and pausing/resuming campaigns from within the CRM. RealConnect CRM only manages campaigns the Client explicitly creates through our platform.	Approved
Marketing API Access (Standard Tier)	Provides elevated access to Meta's Marketing API for advanced, higher-volume ad campaign operations. Requested in conjunction with `ads_management` and `pages_manage_ads`. Pending approval — RealConnect CRM currently operates on Meta's Basic Marketing API access tier.	Pending Approval

3.3 Coexistence-Specific Data

When a Client enables WhatsApp Coexistence through RealConnect CRM, the following additional data is processed to maintain synchronization between the WhatsApp Business App and the Cloud API.

Message Echo Data (smb_message_echoes): Messages sent via the WhatsApp Business App are echoed to RealConnect CRM via Meta webhooks. This includes message content, sender/recipient phone numbers, timestamps, and media attachments.
Contact Sync Data (smb_app_state_sync): Contact information from the WhatsApp Business App (phone numbers, contact names) is synced to the CRM.
Coexistence Status: Connection state, onboarding status, and phone number registration mode.

We do not access or import historical chat data from the WhatsApp Business App. Synchronization begins only from the moment Coexistence is enabled.

3.4 Embedded Signup Data

When Clients onboard via Meta's Embedded Signup flow, we receive:

An authorization code (exchanged for a system user access token).
The Client's Meta Business Portfolio ID and WABA ID.
Phone number details selected during signup.
Business verification status.

The Client explicitly grants these permissions during the Embedded Signup flow. No data is accessed without the Client's authorization.

3.5 Messenger & Instagram Data

When a Client connects a Facebook Page or an Instagram professional account, RealConnect CRM processes the following on the Client's behalf:

Messages: Text of Messenger and Instagram Direct messages exchanged between End-Users and the Client, with timestamps and delivery/read status.
Sender identifiers: The Page-scoped or Instagram-scoped ID Meta assigns to the End-User, and their name or username (and, where granted, their locale) to label the conversation.
Comments: Comments on the Client's own Instagram posts that match a keyword rule the Client set up, and the replies sent to them.
Marketing opt-in status: Whether an End-User subscribed to or unsubscribed from the Client's Messenger marketing messages, and the opt-in token Meta provides.
Connected account details: The Instagram account's ID, username, name, profile picture and account type, and an access token stored encrypted and refreshed automatically.
Page posts: Posts the Client publishes, schedules, edits or deletes through RealConnect, and the Page's post list shown for management.

3.6 TikTok Data

When a Client connects its TikTok for Business account, RealConnect CRM processes the following on the Client's behalf, only for the TikTok ad accounts and TikTok accounts the Client authorizes through TikTok's official OAuth flow:

Ad account details: The connected ad account's ID, name, status, currency, time zone, country and available balance, shown so the Client knows whether its ads can run.
Ad campaign data: Campaigns, ad groups and ads the Client creates or manages in RealConnect CRM — budgets, schedules, targeting choices, ad text, and the images, videos or music the Client selects — plus performance metrics (spend, impressions, clicks, results) and ad review status.
Lead data: Answers submitted by End-Users to the Client's own TikTok Instant Forms (for example name, phone number, email and custom questions), and the form's questions.
Lead status events: When the Client updates a TikTok lead's status (contacted, qualified, converted), RealConnect CRM sends TikTok only the TikTok lead ID and that status, so TikTok can optimize the Client's own campaigns.
Connected TikTok account (Direct Messages inbox, once approved by TikTok): The Client's TikTok Business Account ID, display name, username and avatar, and the Direct Messages exchanged between End-Users and the Client — text, images, timestamps, the sender's TikTok username and ID, and which ad or link started the conversation.
Access tokens: TikTok access and refresh tokens, encrypted with AES-256-GCM before they are stored and never exposed in client-side code or logs.

RealConnect CRM does not use TikTok Data to build advertising or marketing profiles, does not sell or share it with third parties or data brokers, does not download or repost End-Users' TikTok content, and does not access End-Users' followers, following lists or other TikTok accounts.

3.7 Usage & Technical Data

IP addresses, browser type, device information, pages visited, features used, session duration, error logs, and performance metrics.

4. How We Use Information

Service Delivery: Send/receive WhatsApp messages, manage templates, run campaigns, capture leads, enable Coexistence sync, and display ad analytics — all on behalf of the Client.
Contact & Lead Management: Manage Client contact databases, conversation inboxes, tags, lead tracking, and role-based team access.
Analytics: Provide delivery reports, conversation metrics, campaign performance, and ad ROI dashboards.
TikTok: Deliver TikTok leads to the Client's CRM, create and manage the Client's TikTok ad campaigns, show their performance, report lead status back to TikTok, and (once approved) let the Client's team read and reply to TikTok Direct Messages.
Platform Operations: Monitor performance, security, and reliability.
Support: Respond to Client inquiries and troubleshoot issues.
Compliance: Comply with applicable laws, regulations, and Meta policies.

5. Lawful Basis for Processing

Contractual Necessity: Processing required to deliver our services.
Legitimate Interest: Platform security, fraud prevention, analytics.
Consent: Where explicitly provided during Embedded Signup and Coexistence activation.
Legal Obligation: Where required by law.

6. Consent & Opt-In for Messaging

Meta Policy Requirement: All business-initiated WhatsApp messages sent through RealConnect CRM require prior, explicit opt-in consent from end-users.

Clients are solely responsible for obtaining, recording, and managing opt-in consent from end-users before sending any business-initiated WhatsApp messages.
Pre-checked boxes, purchased contact lists, or implied consent from other channels (SMS, email) are not valid WhatsApp opt-in.
End-users must be informed about the type and frequency of messages they will receive.
End-users must have a clear mechanism to opt out at any time. RealConnect CRM supports opt-out keyword handling (e.g., "STOP").
Clients must maintain auditable records of all opt-in consents.

Messenger & Instagram:

Replies are sent only within Meta's Messaging Window — 24 hours after the End-User's last message, or up to 7 days for a reply personally typed by a human agent (Human Agent feature).
Messenger marketing messages are sent only to End-Users who tapped Meta's opt-in button for that Page. End-Users can stop marketing messages at any time from within Messenger, and RealConnect CRM records the opt-out automatically.
Instagram comment-to-DM sends at most one private reply per comment, within 7 days of the comment, as Meta allows.
RealConnect CRM does not send unsolicited or bulk messages on Messenger or Instagram.

7. Data Sharing & Third Parties

We do not sell, rent, or trade personal data. We share data only as follows:

Meta Platforms, Inc. / WhatsApp: As required to operate via the WhatsApp Cloud API, Messenger Platform, Instagram API and Meta Marketing API. Subject to: WhatsApp Business Policy, Meta Terms for WhatsApp Business, WhatsApp Commerce Policy, Meta Platform Terms.
TikTok: As required to operate via the TikTok API for Business — for example creating the Client's ads, sending lead status events, or sending the replies the Client's team writes. Subject to the TikTok Business Products Terms and TikTok for Business developer terms.
Cloud Infrastructure: Industry-standard hosting (e.g., AWS, DigitalOcean) under data processing agreements.
Payment Processors: PCI-DSS compliant processors for billing.
Legal Authorities: When required by law, court order, or to protect rights and safety.

8. Data We Do NOT Collect or Use

To be explicitly clear for Meta's review — RealConnect CRM does NOT:

Sell, license, or monetize user data, message content, or Meta platform data to any third party.
Use Meta data for purposes unrelated to providing the CRM service to the Client.
Access historical WhatsApp Business App chats (pre-Coexistence activation).
Store or access Facebook user passwords or authentication credentials (Embedded Signup uses OAuth 2.0 tokens).
Use leads_retrieval data for any purpose other than delivering leads to the Client who owns the Lead Ad form.
Publish to, post on, or modify any content on the Client's Facebook Pages, except posts the Client itself publishes, schedules, edits or deletes through RealConnect CRM.
Access or store End-Users' Facebook or Instagram profiles, friend or follower lists, or social graph data — only the name or username (and, where granted, locale) of people who message the Client.
Use the Human Agent message tag for automated, scheduled, bulk or promotional messages.
Send Messenger marketing messages to anyone who has not opted in, or keep sending after they opt out.
Use data to build user profiles for advertising, profiling, or selling to data brokers.

9. Data Storage, Security & Encryption

All data in transit encrypted via TLS 1.2+ (HTTPS).
Data at rest encrypted using AES-256.
Access restricted via role-based access controls (RBAC) and multi-factor authentication (MFA).
Webhook endpoints receiving Meta data are secured and validated.
Meta access tokens are stored encrypted and never exposed in client-side code or logs.
TikTok access and refresh tokens are encrypted with AES-256-GCM at the application level before being stored.
Regular security assessments and vulnerability scanning.
Database backups encrypted and stored in geographically separate locations.

10. Data Retention & Deletion

Account Data: Retained while active, plus 90 days post-termination.
Messages & Conversations: Retained while account is active; Clients can delete at any time.
Coexistence Echo Data: Same retention as standard messages.
Messenger & Instagram Messages and Comments: Same retention as WhatsApp messages; deleted on account termination.
Marketing Opt-in Status: Kept with the contact while the Page is connected, so opt-outs are always honored; deleted on account termination.
Instagram Access Tokens: Stored encrypted while the account is connected; deleted on account termination.
Lead Data: Retained as part of Client's CRM data; deleted on account termination.
Ad Campaign Data: Cached for dashboard display; source of truth remains in Meta's systems.
TikTok Lead & Campaign Data: Retained as part of the Client's CRM data while TikTok is connected; deleted on account termination or on request. The source of truth for campaigns remains in TikTok's systems.
TikTok Direct Messages (once available): Same retention as other inbox messages; deleted on account termination or on request.
TikTok Access Tokens: Stored encrypted while TikTok is connected. When the Client disconnects TikTok, RealConnect CRM stops all further access to its TikTok Data; tokens and data are deleted on account termination or on request.
Technical Logs: Retained up to 12 months, then purged.
Post-Termination: All data permanently deleted within 30 days from primary systems, 90 days from backups.

Clients or end-users may also request data deletion by contacting info@realtrack.ae.

11. Data Subject Rights

Under applicable laws (GDPR, CCPA, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data), individuals may:

Access — Request a copy of personal data we hold.
Rectification — Correct inaccurate data.
Erasure — Request deletion ("right to be forgotten").
Restrict Processing — Limit processing of data.
Data Portability — Receive data in a structured, machine-readable format.
Object — Object to processing based on legitimate interest.
Withdraw Consent — Withdraw consent at any time.

Contact: info@realtrack.ae (response within 30 days).

TikTok users: If you submitted a TikTok Instant Form or messaged a business on TikTok that uses RealConnect CRM, you can ask that business — or us at the address above — to access, correct or delete your data, and we will help the business fulfil the request.

End-Users: If you communicated with a Client via WhatsApp, Messenger or Instagram, please contact that Client directly. RealConnect CRM processes end-user data as a Data Processor on behalf of the Client (Data Controller).

12. Data Processor Role

For end-user data processed via the WhatsApp Business Platform, the Messenger Platform, the Instagram API and Meta Lead Ads, RealConnect CRM acts as a Data Processor. We process data only as instructed by Clients and per our service agreement. Clients are responsible for their own lawful basis for collecting and processing end-user data.

The same applies to TikTok Data: for leads, campaigns and Direct Messages processed through the TikTok API for Business, RealConnect CRM acts as a Data Processor on behalf of the Client.

13. International Data Transfers

Data may be transferred to and processed in countries outside your residence. We ensure appropriate safeguards including standard contractual clauses and data processing agreements.

14. Cookies & Tracking

Essential Cookies: Session management and authentication.
Analytics Cookies: Usage patterns and platform improvement.

Manage via browser settings. Disabling essential cookies may impair functionality.

15. Children's Privacy

RealConnect CRM is a B2B platform not intended for use by individuals under 18. We do not knowingly collect data from minors.

16. Meta Platform Compliance

RealConnect CRM operates in full compliance with:

17. TikTok Platform Compliance

RealConnect CRM uses the TikTok API for Business only for the purposes described in Section 3.6, and complies with:

TikTok Direct Messages are processed only after TikTok has approved RealConnect CRM through its Data Security & Privacy Review, and only for TikTok accounts registered in regions where TikTok makes the Business Messaging API available. A Client can revoke RealConnect CRM's access at any time by disconnecting TikTok in RealConnect CRM or in its TikTok settings.

18. Data Deletion Callback URL

In compliance with Meta's platform requirements, RealConnect CRM provides a data deletion callback endpoint. When a user removes RealConnect CRM from their Facebook account, Meta sends a deletion request to our callback URL. Upon receiving this request, we initiate deletion of all data associated with that user within 30 days and provide a confirmation URL and tracking code to the user.

19. Changes to This Policy

We may update this policy to reflect changes in practices, technology, legal requirements, or Meta policies. Material changes will be notified via email or in-platform notice at least 15 days before taking effect.

20. Contact Us

Realtrack Technologies LLC — RealConnect CRM
Address: 1606, Binary Tower, Business Bay, Marassi Drive, Dubai, United Arab Emirates
Phone: +971 4 330 2205
Email: info@realtrack.ae
Website: https://realconnect-web.realtrack.ae