Privacy Policy

This Privacy Policy describes how staffd ("staffd," "we," "us," or "our") collects, uses, and shares information when our customers ("Clients") use our AI marketing automation services and when those services interact with third-party platforms such as Facebook (Meta), Instagram, and others on the Client's behalf.

1. Information We Collect

1.1 Information from our Clients

• Business name, contact name, email, phone number, and address
• Account credentials and access tokens for connected platforms (Facebook, Instagram, Google, Mailchimp, etc.) — stored encrypted at rest
• Billing information (processed by our payment processor; we do not store card numbers)
• Communications between the Client and staffd (email, text, support tickets)

1.2 Information collected from connected platforms on the Client's behalf

• Facebook / Meta data: Page posts, post metrics, page insights, ad account spend and performance, ad creative content, audience size, leads submitted through Facebook Lead Generation forms (name, email, phone, custom field answers), Instagram content and analytics for accounts the Client has granted permission for
• Other connected platforms: data the Client authorizes us to access (e.g., email marketing platforms, CRMs, scheduling tools, payment processors)

1.3 Information from end users who interact with the Client's marketing

If you submitted a Facebook Lead Form, replied to one of our Client's Facebook posts, or sent a message to one of our Client's Facebook pages, your information (name, email, phone, message content, and the answers you provided to the form) was passed to staffd by Meta on our Client's behalf. We use this information only to deliver your inquiry to our Client.

2. How We Use Information

• To provide and operate the staffd marketing automation service
• To generate marketing content (ad copy, graphics, emails, social posts) using AI models from third-party providers (e.g., Anthropic, OpenAI) on the Client's behalf — we do not use Client data to train these models
• To publish content, run ads, and send messages to platforms (Facebook, Instagram, etc.) on the Client's behalf, only within the permissions the Client has granted
• To deliver leads, inquiries, and notifications to the Client (typically via email or Telegram)
• To analyze marketing performance and provide reporting back to the Client
• To comply with legal obligations and protect against misuse

3. How We Share Information

We share information only with the following categories of recipients:

• Our Clients: All leads, inquiries, and marketing data we collect on behalf of a Client are delivered to that Client. We do not share one Client's data with another Client.
• Service providers: We use third-party services to operate, including but not limited to:
  • Anthropic (AI text generation)
  • OpenAI (AI image and text generation, when used)
  • Pexels (stock photography under their license)
  • AgentMail / Amazon SES (email delivery)
  • Telegram (messaging interface)
  • Meta (Facebook, Instagram, Messenger APIs)
  • Mailchimp (email marketing on behalf of Clients)
  • Cloud hosting and infrastructure providers (e.g., Netlify, Railway)
  These providers are contractually limited in what they can do with the data we share.
• Legal compliance: If required by law, court order, or to protect the rights, property, or safety of staffd, our Clients, or others.

We do not sell personal information to third parties for advertising or any other purpose.

4. Data Retention

We retain Client data for as long as the Client maintains an active service agreement with staffd, plus a reasonable period after termination (typically 30–90 days) to allow for export and transition. After this period, we delete or anonymize the data, except where retention is required by law or for legitimate business records (e.g., billing).

Lead data collected through Facebook Lead Forms on the Client's behalf is retained until the Client requests deletion or until the Client's service agreement ends.

5. Your Rights and Choices

If you are an end user whose data was collected via one of our Clients' Facebook campaigns, you have the right to:

• Request access to the data we hold about you
• Request deletion of that data — see our Data Deletion page for instructions
• Opt out of communications from the Client (typically by replying STOP, unsubscribing from emails, or contacting the Client directly)
• Withdraw consent that you previously granted to Facebook to share data with the Client's connected app

Since staffd acts on behalf of our Clients, in many cases the Client is the data controller and we are the data processor. Requests directed to staffd may be forwarded to the relevant Client.

6. Security

We use commercially reasonable measures to protect data, including encryption in transit and at rest, access controls, and regular security review. No system is 100% secure; we do not guarantee that data will never be accessed by an unauthorized party.

7. Facebook / Meta Platform Compliance

Our use of information received from Meta APIs adheres to Meta's Platform Terms and Developer Policies, including the Limited Use requirements. We do not transfer Meta data to data brokers, use it for ad networks not owned by Meta, or use it for any purpose inconsistent with the user's expectations or our Client's authorized use.

8. Children's Privacy

Our services are not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children.

9. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to active Clients and reflected by an updated "Last updated" date at the top of this page.

10. Contact

Questions about this Privacy Policy, or to exercise your rights, contact us at:

staffd, operated by Eric Loiacano
130 Sylvan St, Unit 4, Danvers, MA 01923