Privacy Policy

Naltbox is a SaaS platform that lets businesses manage customer communication from Facebook Messenger, Facebook comments, Instagram Direct and Instagram comments in a single shared inbox, together with commerce integrations such as WooCommerce.

For your platform account data (name, email, activity in the system) Naltbox acts as the data controller. For the conversations, comments and end-customer contacts that arrive in your workspace, the business that owns the workspace is the controller and Naltbox acts as a processor, handling that data only on the business's instructions.

We collect only what the service needs to work:

• Account data: first and last name, email address, password stored only as a hash, workspace role, email verification status.
• Workspace data: company name, team members, invitations, tags, settings.
• Data from Meta platforms: the ID and name of the connected Facebook Page or Instagram account, access tokens (stored encrypted), the messages and comments exchanged, and basic public contact profile data (display name, profile picture, app-scoped identifier - PSID / IGSID).
• End-customer contact data: display name, channel, conversation history, plus the internal notes and tags your team adds.
• Commerce data (if you connect WooCommerce): products, prices, orders created from conversations, and the billing and shipping details a customer provides in the chat.
• Technical data: IP address, browser type, request identifiers, system events and audit logs (who did what and when).

We do not collect special categories of data (health, biometric, political or religious beliefs) and we do not ask you to enter them into the platform.

• To provide the unified inbox: receiving, displaying and sending messages and comments through the official Meta APIs.
• For authentication, session management and role-based access control.
• For conversation assignment, statuses, tags and internal notes.
• For analytics inside your own workspace (response times, conversation volume, team performance).
• For AI features when you enable them: reply suggestions, automatic replies and order extraction from conversations.
• For security, abuse prevention, debugging and compliance with legal obligations.

We do not sell your data and we do not use your customers' conversations for advertising or resale to third parties.

• Performance of a contract - to deliver the service you signed up for.
• Legitimate interest - security, abuse prevention and service improvement.
• Consent - connecting Meta accounts, enabling AI features and optional communications.
• Legal obligation - retaining records where the law requires it.

Naltbox uses only official Meta APIs (Facebook Login, Graph API, Messenger Platform, Instagram Messaging and Webhooks). We do not use scraping, browser automation, unofficial APIs or credential sharing.

• Access tokens are stored encrypted and are never exposed in the user interface or in logs.
• Data received from Meta is used only inside the workspace that connected the accounts and is never mixed between businesses.
• Our use of this data complies with the Meta Platform Terms and Developer Policies.
• When you disconnect a Page or Instagram account, the related tokens are deleted immediately and all further syncing stops.

We share data only with service providers required to operate the platform:

• Meta Platforms - to send and receive messages and comments.
• Cloud infrastructure and database providers hosting the platform.
• An S3-compatible object storage provider for attachments and media.
• An AI model provider, only if you enable AI features and only for the text needed to generate a reply.
• Your WooCommerce store, if you connect it, for product lookup and order creation.
• A transactional email provider for verifications, invitations and password resets.
• Public authorities, only where the law requires it.

• Account and workspace data is kept while the account is active.
• Conversations, comments and contacts are kept until the business deletes them or the workspace is closed.
• Audit and technical logs are kept for a limited period for security and troubleshooting.
• After deletion, data is removed from live systems immediately and from backups within 35 days.

• Encrypted transport (HTTPS/TLS) between the browser, the API and external providers.
• Integration tokens and credentials are encrypted before storage.
• Passwords are stored only as hashes using a modern algorithm; never in plaintext.
• Strict workspace isolation: every request is checked against the user's workspace.
• Role-based access control (OWNER, ADMIN, AGENT) and audit logging of significant actions.
• Secrets and tokens are never written to logs.

Subject to applicable law (GDPR and Albanian data protection law) you have the right to:

• Request access to your data and a copy of it.
• Request correction of inaccurate data.
• Request deletion of your data.
• Request restriction of, or object to, processing.
• Request portability in a machine-readable format.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Lodge a complaint with the competent supervisory authority.

To exercise these rights write to info@naltik.com. We respond within 30 days. If you are an end customer who messaged a business through Naltbox, please address the request to that business first; we forward it to them and help them carry it out.

Full instructions for requesting deletion of your data from Naltbox, including data obtained from Facebook and Instagram, are on the dedicated page: https://connecta.naltik.com/data-deletion

We use cookies and local storage only for essential functionality: keeping your session, security and interface preferences. We do not use advertising cookies and we do not track users across other websites.

Some of our service providers may be located outside Albania or the European Economic Area. Where that is the case, we make sure the transfer is covered by an appropriate legal mechanism, such as Standard Contractual Clauses.

Naltbox is a business product and is not directed at people under 16. We do not knowingly collect data from children. If we learn that we have, we delete it immediately.

We may update this policy. The last update date is shown at the top of this page. For material changes we notify you by email or inside the platform before they take effect.

Privacy questions: info@naltik.com. Technical support: info@naltik.com.