Privacy Policy

1. Information We Collect

Account Information

Name, business name, email address, phone number, login credentials, role, team members, and account settings.

Accounts are created and authenticated through Firebase Authentication using an email address and password, or Google Sign-In. When you sign in with Google, we receive your name, email address, and profile picture from Google. We never receive or store your Google password.

Business and Merchant Information

Store name, company information, product catalogs, product descriptions, prices, inventory data, orders and order status, sales activity, customer inquiries, and business performance data.

Social Media and Platform Integration Data

When you connect third-party platforms to TobSar, we process authorized data from services such as Meta platforms including Facebook and Instagram, Telegram, TikTok, and other connected business tools.

Depending on the permissions you grant, this may include page or profile information, message data, comments, lead data, catalog data, campaign and reporting data, audience data, and access tokens issued by the platform so that TobSar can send and receive messages on your behalf.

Customer Conversation Data

TobSar processes messages, comments, customer questions, lead details, attachments, and conversation history from your connected channels so that you can respond to customers, manage sales, and automate support workflows. This content belongs to your business; TobSar processes it on your behalf.

Content You Create in the Mobile App

• Photos and images you take with the camera or select from your photo library, to add to a product or to send in a customer conversation.
• Voice recordings you record in the app to send as a voice message to a customer.
• Text you write — replies, product details, notes, and settings.

Usage and Technical Data

Technical information such as IP address, device type, operating system, browser type, log data, feature usage, error logs, and security-related events, collected by our backend when the app or dashboard communicates with it.

The TobSar mobile app contains no analytics SDK, no crash-reporting SDK, and no advertising SDK. It does not read your device's advertising identifier and does not track you across other companies' apps or websites.

Data Stored on Your Device

The app stores your session token and a small amount of app state and cached content locally on your device so you stay signed in. This data is removed when you sign out or uninstall the app.

Payment and Billing Data

Where TobSar offers paid plans, we may collect billing details, subscription information, invoices, and payment status. The mobile app is free and sells nothing in-app. Payment card details are processed by third-party payment providers and are not stored by TobSar.

2. What the Mobile App Collects

This summary matches the declarations TobSar files in the Apple App Store and Google Play. Every item is collected for app functionality and account management only. None of it is used for advertising, marketing, or tracking, and none of it is sold.

The app does not collect location, contacts, calendar, SMS, call logs, browsing history, search history, health or fitness data, device or advertising identifiers, or financial account details.

3. Device Permissions

Permissions are requested only when you first use the related feature, and can be changed or withdrawn at any time in your device settings. The rest of the app continues to work without them.

4. How We Use Information

We use information to:

• Provide, operate, and improve the Services
• Connect and maintain the social media, commerce, and messaging accounts you authorize
• Deliver customer conversations to your inbox and send your replies
• Support AI-assisted replies, recommendations, and automation
• Manage product catalogs, orders, and social commerce operations
• Generate analytics, reports, dashboards, and business insights for your own account
• Provide customer support and technical assistance
• Detect abuse, fraud, security risks, and unauthorized activity
• Comply with legal obligations and platform requirements
• Communicate service messages, product updates, and important notices

We do not use your data, your customers' messages, or your business content for advertising or cross-app tracking.

5. Use of AI

TobSar uses artificial intelligence to assist with customer replies, product recommendations, sales workflows, summaries, analytics, and automation. To generate a reply, relevant conversation content and information from your product catalog and knowledge base are sent to our AI provider, which processes them on our behalf as a service provider and does not use them to train its own models.

You control the assistant. It drafts replies using the tone and settings you configure, and every draft is held in a review queue where you approve, edit, or reject it before it is sent to a customer. If TobSar later offers automatic sending, it will be an option you enable for your own account, and you will remain responsible for what is sent. TobSar does not guarantee that AI-generated content will always be accurate, complete, or appropriate.

6. Third-Party Platform Data

TobSar accesses third-party platform data only when authorized by you or your business account owner, and uses it only to provide the features you requested — account connection, messaging, reporting, catalog management, lead management, and workflow automation.

We do not sell third-party platform data. You may disconnect an integration at any time in the TobSar app, in the dashboard, or directly on the third-party platform.

Facebook Platform Data

TobSar integrates with the Facebook Platform so that sellers can manage customer conversations on their Facebook Pages. When you connect a Facebook Page, we request these permissions and use them solely as described:

• pages_show_list — to display the Facebook Pages you manage, so you can choose which one to connect.
• pages_messaging — to receive customer messages sent to your Page and to send your replies. AI-drafted replies are placed in a review queue where you approve, edit, or reject each message before it is sent. If TobSar later offers automatic sending, it will be an option you enable for your own account.
• pages_manage_metadata — to subscribe your Page to webhook events so TobSar receives new messages in real time.
• pages_read_engagement — to read Page engagement data used for the analytics shown in your TobSar dashboard.

We do not use Facebook Platform data to send unsolicited messages, run advertisements, or share data with third parties beyond what is necessary to operate TobSar. You may disconnect your Page at any time from TobSar settings or from your Facebook account; on disconnection we delete the Page access token and stop processing new messages.

Our use of data received from Facebook APIs complies with the Meta Platform Terms and Meta Platform Policies.

Telegram Data

When you connect a Telegram bot, you provide the bot token issued to you by Telegram. TobSar uses it to receive messages sent to your bot and to send replies, images, and voice messages on your behalf. We process the message content, the sender's Telegram display name and identifier, and any media exchanged. You may disconnect the bot in TobSar or revoke its token in Telegram at any time.

7. Data Sharing

We may share information with:

• Service providers that help us host, operate, secure, analyze, and support TobSar
• Third-party platforms when you connect or authorize an integration
• Team members or business accounts authorized by the account owner
• Legal, regulatory, or security authorities when required by law or necessary to protect rights and safety
• Business partners, only when necessary to provide services you requested

We do not sell personal information, and we do not share it with data brokers or advertising networks.

8. Data Retention

We keep information only as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, and support legitimate business purposes.

When an account is deleted or an integration is disconnected, we delete or de-identify the associated personal data unless retention is required by law, security, fraud prevention, accounting, or legitimate business obligations.

9. Account and Data Deletion

You can request deletion of your account and its data at any time, and you can start the request from inside the app.

From the app: open Settings → Data deletion. This opens our deletion instructions, which tell you what to include and where to send your request.

From anywhere else: follow the instructions at https://tobsar.com/data-deletion, or email us at info@tobsar.com.

Deletion covers your TobSar account information, connected platform identifiers, stored access tokens, customer conversation data, lead data, product catalog data, order records, uploaded images and voice messages, and analytics linked to your account.

We may need to verify that you are the account owner before acting on a request. After verification we close your account and delete or de-identify eligible data within a reasonable period, usually within 30 days, unless a longer period is required for technical, legal, security, or compliance reasons. We will confirm by email once it is done.

Some information may be retained where required by law or for security, fraud prevention, accounting, or dispute resolution.

Uninstalling the app does not delete your account.

10. Security

We use reasonable technical and organizational measures to protect information from unauthorized access, loss, misuse, disclosure, alteration, or destruction. All data sent between the TobSar app and our servers is encrypted in transit using HTTPS. Access tokens for your connected channels are stored in encrypted form.

No online service, system, or transmission method is completely secure. You are responsible for protecting your account credentials and managing access permissions for your team.

11. International Data Processing

TobSar may process and store information in countries where we or our service providers operate, which may have data protection laws different from those in your own country.

By using TobSar, you understand that your information may be processed internationally as necessary to provide the Services.

12. Your Rights

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data.

To make a request, contact:

info@tobsar.com

13. Children's Privacy

TobSar is intended for business users aged 18 and over. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it.

14. Third-Party Links and Services

TobSar may contain links to or integrations with third-party services. Their privacy practices are governed by their own privacy policies and terms, and we are not responsible for them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the effective date above and, where the change is significant, notify you by email or in the app or dashboard. Continued use of TobSar after changes means you accept the updated policy.

16. Contact Us

For privacy questions or requests, contact:

TobSar
Email: info@tobsar.com
Website: https://tobsar.com