Security

How the connection works#

When you press Connect Facebook, Facebook opens its own dialog. You choose the Pages, the businesses and the Instagram accounts, review the list of permissions, and press Save. Meta then gives CommentWatchDog a token for each Page. Your password never passes through us.

Tokens are stored on our servers, used only for the features you set up, never shown in your browser or to anyone else, and deleted when you disconnect a page or your Facebook account.

What the app can and cannot do#

The permissions below are the ones Facebook shows you in the connect dialog, in Facebook's own words. Each one maps to something you can see in the app.

What we store#

• Your account: name and email. There is no password to store: you sign in with a one-time code or link we email you, or with Google.
• Your workspace: rules, agents and the knowledge you give them, automations and flows, saved replies, roles and page access.
• Your pages' comments and messages: the text, the author's name, the page, the labels and the actions taken, so the inbox, the Bin and Insights work. Photos, voice notes and files people send you in a message are copied to our storage, because Meta's links to them expire within days.
• Your contacts: the people your automations reached or heard from. The next section lists what is kept for each.
• Billing: your plan, its status and invoice references. Card details stay with Stripe; we never see the full number.

Contacts and DM automation#

DM automation answers people in Messenger and Instagram DMs, so it keeps a record of each person it reached. This is what that record holds, and what you control.

• Each contact: their name and username, the page they wrote to, which automations reached them, and when they last wrote. On Instagram also whether they follow you, their follower count and their verified badge, as last read.
• What they gave you: an email or a phone number a person typed in answer to your question, kept with the question they answered and the time, and the answers saved to the custom fields you made.
• What you added: tags, custom field values and notes for your team.
• Automation history: each run and what it did. Runs that acted are kept for 90 days and runs that skipped for 30; the daily totals stay.

Forget on a contact deletes their name, username, email, phone number, saved answers and the conversation kept here; their runs stay without a name, Meta keeps its own copy of the messages, and if they write again they are a new person. From the Growth plan, the contact list can be exported to CSV.

An HTTP request step sends what you put in it, for example a contact's email or an answer, to the address you chose, each time a flow reaches that step. It sends nothing anywhere else. An API key or token you save in the step is encrypted with AES-256-GCM, tied to your account, never shown again and kept out of the run history. Addresses inside private networks are refused.

Where it lives and how it is protected#

Everything runs on servers operated by Hetzner Online GmbH in Germany, in the European Union. Traffic is encrypted in transit with TLS, and browsers are told to use HTTPS only. Access to production systems is limited to the people who operate the service.

Backups are taken daily and copied to a second server; they roll off after 14 days on the first and after 30 days on the second. When you delete your account, your data is removed immediately and leaves the backups within 30 days.

AI checks, AI answers and translation#

Four rules read meaning: Profanity, Negativity, Custom topics and Impersonators. For those, the comment text, the author's display name (for Impersonators) and your rule notes are sent to an AI API, OpenAI or a compatible provider. Your account details and your page tokens never go with it. Translation works the same way: the text you ask to translate is sent, nothing else.

When an AI agent answers a comment or a DM, the same AI API is sent the person's comment or message, for a DM the last few messages of that chat with the sender's name and your page's name, and the knowledge you gave the agent. Before an automatic answer goes out, a second check reads it against that knowledge, and an answer it cannot support is not sent: the question waits for a person. When you set up an HTTP request with AI, the API key never reaches the model: you type it into a key box that fills the step.

When the AI is unavailable, the text rules keep running and the AI checks retry on their own. Nothing is skipped silently.

Payments#

Payments run on Stripe. You enter your card on Stripe's pages and manage it in Stripe's billing portal. We keep the plan, its status and invoice references, and nothing about the card.

Your team#

Four roles: owner, administrator, manager and moderator, plus page access that limits a manager or a moderator to the pages you tick. Removing someone ends their access on every device immediately.

Ending our access#

Three ways, and none of them needs our permission.

• Disconnect Facebook on the Pages tab. Every page stops receiving comments and messages, so automations stop too; your settings stay for when you reconnect.
• Remove CommentWatchDog in Facebook under Settings, then Business integrations. If you also choose Delete data there, Facebook sends us a deletion request and we erase everything that came from your connection.
• Delete account under Settings, then Account. Only the owner can do it. It removes the workspace, cancels the subscription, disconnects the pages and confirms by email. It cannot be undone.

Reviewed by Meta#

Meta reviews an app before it may use permissions that read or change Page content. The permissions above went through that review, and the list Facebook shows you in the connect dialog is the reviewed list. Facebook's Business integrations page is the authoritative record of what you granted, and you can check it at any time.

Report a security issue#

If you find something that looks wrong, write to support@commentwatchdog.com with what you saw and where. A person reads every report and answers. Please do not put a token or a password in the email.