SpotlightPrivacy Policy
Spotlight helps businesses run advertising on Facebook and Instagram and answer customer messages from Messenger, Instagram and WhatsApp in one place. This policy explains what personal data we handle, why, and how you can have it deleted. To request deletion, go to Data Deletion.
1. Who this policy covers
Spotlight is a business service. This policy applies to:
- Clients and their team members: businesses that use Spotlight and the people they invite.
- End customers: people who message or comment on a Client’s Facebook Page, Instagram account or WhatsApp number, or who respond to a Client’s ads.
For Client and team-member data, we decide how the data is used. For End customer data, the Client decides why it is collected and we process it on the Client’s behalf. The Client’s own privacy notice also applies to End customers.
2. Information we collect
| Information | Examples | Source |
|---|---|---|
| Account and team | Name, work email, role, password (stored hashed), two-factor settings, sign-in history; and, when you connect Meta accounts, your Facebook name and user ID | You, your administrator, or Meta |
| Connected Meta assets | Names and IDs of Facebook Pages, Instagram professional accounts, ad accounts and WhatsApp Business accounts; permissions granted; access tokens (stored encrypted) | Meta, when a Client connects an account |
| Advertising | Campaigns, ad sets, ads, creative, budgets, performance and spend figures | The Client; Meta |
| Conversations | Message text and attachments, sender name and platform ID, phone number (WhatsApp), timestamps, delivery status, and the ad or post that started the conversation | End customers, through Meta; the Client |
| Leads | Contact details, notes and lead stage, entered by the Client or taken from lead forms | The Client; End customers |
| Content you provide | Campaign briefs, brand assets (logos, fonts, images), reply templates and answer text | The Client |
| Technical | IP address, browser and device type, request and error logs | Collected automatically |
We do not collect payment card details. Advertising costs are billed to the Client directly by Meta. We do not ask End customers for sensitive information; if a customer includes it in a message, we handle it only to deliver the service.
3. Information we receive from Meta
When a Client connects their Meta accounts, they grant Spotlight specific permissions. We use them only for these purposes:
| Access granted | What we use it for |
|---|---|
| Ads and business assets | Create and edit campaigns, ad sets and ads; read performance and spend; list the Client’s business assets |
| Facebook Pages | List and read the Client’s Pages; receive and send Messenger messages; read and reply to comments |
| Instagram professional accounts | Link the account; receive and send direct messages and, where granted, read and reply to comments |
| WhatsApp Business | Receive and send messages on the Client’s WhatsApp number; manage message templates and phone number settings |
| Lead forms | Retrieve lead form submissions where the Client uses them |
| Conversion events | Send lead and outcome events (for example lead received, appointment booked, purchase), with hashed identifiers such as a phone number, to Meta’s Conversions API so the Client’s ads can be measured and optimised. Only where the Client has enabled it. |
We request only the access these features need. A Client can disconnect Spotlight at any time from Spotlight or from their Meta business settings. When a connection is removed, we delete its stored access token.
4. How we use information
- To provide and operate Spotlight: publish campaigns, apply the budget limits and adjustments the Client has configured, and collect conversations in one inbox.
- To report on performance and cost.
- To draft campaign content and suggested replies with AI (see below).
- To secure the service, prevent abuse and fix errors.
- To support Clients and send service notices.
- To meet legal obligations.
We use information from Meta only to provide the features the Client has asked for.
AI features. Spotlight uses AI models to turn campaign briefs into drafts, write ad copy, analyse performance and suggest replies. AI output is only a suggestion: a person approves campaigns before they are published, and a person sends every reply to a customer. Automatic acknowledgements use fixed text written by the Client. We do not use Meta data or customer messages to train AI models.
5. How we share information
We do not sell personal data, and we do not share data received from Meta with data brokers or other advertising networks. We share information only:
- With the Client: End customer messages and lead details are visible to the Client’s authorised team members.
- With Meta: data is sent to and received from Meta through its APIs to deliver messages, to publish and measure ads, and, where the Client has enabled it, to report leads and other outcomes (conversion events) so ads can be optimised. Meta’s own privacy policy governs data Meta holds.
- With service providers that help us run Spotlight, such as hosting and infrastructure, AI model providers, email delivery and error monitoring. They process data only on our instructions and under confidentiality and security obligations. A current list is available on request from privacy@omukk.dev.
- When required by law, or to protect rights, safety or security.
- In a merger or sale of our business, with the same protections.
6. Where data is processed
Spotlight is hosted in Bangladesh. Some providers, including AI model providers, and Meta process data in other countries. We use contractual and technical safeguards where the law requires them.
7. How long we keep information
- Account and team data: while the account is active, and deleted within 30 days after it is closed.
- Advertising, conversation and lead data: while the Client’s account is active, unless the Client or an End customer asks for earlier deletion. Deleted within 30 days after the account is closed.
- Access tokens: deleted when a connection is removed.
- Backups: encrypted backups are overwritten on a rolling cycle of up to 35 days.
- Required records: records we must keep for security, accounting or legal reasons are kept only as long as required.
8. Data Deletion
Anyone can ask us to delete their personal data. You can:
- Email us. Write to privacy@omukk.dev with the subject “Data deletion request” and tell us the platform (Messenger, Instagram, WhatsApp, or Facebook sign-in to Spotlight), your name, handle or phone number, and the business you contacted, if any. We may ask you to confirm your identity.
- Ask the business you contacted. It can pass your request to us, and we will carry out the deletion.
We complete requests within 30 days and confirm by email. We may keep limited records where the law requires it. This does not delete data that Meta holds; contact Meta for that. Full instructions are on our Data Deletion page.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or restrict the use of your personal data, to object to its use, and to receive a copy. Email privacy@omukk.dev to exercise these rights. We respond within 30 days. If we hold your data for a Client, we may refer your request to that Client, except deletion requests, which we carry out ourselves as described in Data Deletion. You may also complain to your local data protection authority.
10. Security
We protect data with encryption in transit (HTTPS), encryption of stored access tokens, separation between Clients’ data, role-based access, and audit logs of sensitive actions. Our staff access Client data only to provide support, and that access is logged. No system is completely secure. If a breach affects your data, we will notify you as the law requires.
11. Children
Spotlight is a business service and is not directed to children. We do not knowingly collect personal data from children under 13. If you believe we have, contact us and we will delete it.
12. Cookies
We use only essential cookies that keep you signed in and secure. We do not use advertising or cross-site tracking cookies.
13. Changes to this policy
We may update this policy. We will post the new version here with a new effective date, and we will tell Clients about material changes by email or in the dashboard.
14. Contact
Omukk Limited
Ellal Chamber, House No. 11, Matijhil B/A, Dhaka-1000
Email: privacy@omukk.dev