Privacy Policy

1. Who is responsible for your information

Bifro Connect is operated by Bifro Tech Inc., an active Ontario business corporation. Bifro Tech Inc. is responsible for personal information under its control and has designated a Privacy Officer who can be reached at info@bifro.ca.

This policy applies to Bifro Connect websites, accounts, approval links, support communications, and related services. When an agency uses Bifro Connect for a client, the agency is also responsible for having authority to provide client information and request access to client assets.

2. Information we collect

Account and business details

Meta app-scoped user ID, name, email, phone number, agency or business name, address, business portfolio identifiers, tax identifier if supplied, plan, and account status.

Connection and asset details

Approval-link tokens, client labels, requested access bundles, Meta business, Page, ad account, Pixel, and Instagram professional account identifiers and names, connection status, selected assets, errors, and timestamps.

Authorization credentials

Meta access tokens needed to complete and manage approved connections. These tokens are encrypted before database storage. We do not collect Facebook passwords or two-factor authentication codes.

Billing information

Stripe customer and subscription identifiers, plan, billing cycle, subscription status, payment event status, and limited transaction records. Stripe handles complete card details.

Technical and security information

Session records, request identifiers, timestamps, IP and browser information available in normal server requests, operational logs, audit events, rate-limit events, and error details.

Support communications

Name, email address, subject, message, and related correspondence when you contact us or make a privacy request.

3. Why we use information

We use personal information only for identified and reasonable purposes, including to:

• authenticate users through Meta and maintain secure sessions;
• create, display, complete, verify, and revoke approval links;
• request and manage only the Meta asset access selected by the agency and approved by the client;
• provide subscriptions, calculate plan limits, process payments, and meet tax obligations;
• send service, billing, security, and support messages;
• detect abuse, investigate errors, protect accounts, and maintain audit records;
• respond to access, correction, withdrawal, and deletion requests; and
• comply with law and enforce our terms.

We do not sell personal information. We do not use Meta platform data for unrelated advertising or to build advertising profiles. Bifro Connect does not request access to Instagram inboxes or direct messages for its current connection flow.

4. Consent and authority

We generally rely on consent, contractual necessity, and legal obligations to handle information. You may withdraw consent where permitted, but doing so may prevent us from providing features that require the information.

Agencies must explain the access request to their clients and obtain appropriate authority before sending a link. Clients choose whether to continue through Meta and can review the requested access before approval.

5. Service providers and disclosures

We disclose information only as needed to operate the service, follow your instructions, protect rights and systems, or comply with law. Our principal service providers include:

Meta Platforms

Authentication, business asset discovery, permission approval, connection management, and revocation through Meta APIs and Meta interfaces.

Supabase

Managed PostgreSQL database infrastructure used to store account, connection, audit, and operational records.

Stripe

Checkout, payment processing, subscriptions, tax calculation, billing portal access, and payment event delivery.

Render

Application hosting, network delivery, deployment, and operational infrastructure.

Email provider

Delivery of support, billing, account, security, and operational messages using the email service configured by Bifro Tech Inc.

We may also disclose limited information to professional advisers, regulators, law enforcement, or a purchaser of the business where legally permitted and subject to appropriate safeguards.

6. Processing outside Canada

Bifro Tech Inc. is based in Canada, but its providers may process and store information in the United States and other jurisdictions. In particular, Bifro's current managed database region is in the United States, and Meta, Stripe, Render, and email infrastructure may process information there.

Information processed outside Canada is subject to the laws of that jurisdiction and may be accessible to courts, law enforcement, or national-security authorities. Bifro remains accountable for personal information transferred to service providers and uses contractual, technical, and organizational safeguards appropriate to the service.

7. Retention

We keep personal information only as long as reasonably needed for the identified purpose, legal requirements, security, and dispute handling. Our current target periods are:

Billing and tax evidence

Six years after the end of the relevant tax year, or longer if law requires.

Breach and deletion records

Two years after the record is created or the matter is closed.

Support and security records

Up to two years, unless a longer period is reasonably required for an active investigation or legal claim.

Raw Stripe webhook payloads

No more than 30 days. Minimized transaction evidence may be retained separately for tax and accounting obligations.

Tokens, sessions, and connection data

For the life of the account or connection, then deleted or anonymized when no longer needed, subject to the account-deletion process and limited legal retention.

When information is retained after deletion for a legal or security purpose, we restrict its use to that purpose and minimize or anonymize it where practical.

8. Safeguards

We use administrative, technical, and contractual safeguards appropriate to the sensitivity of the information. These include HTTPS, secure session cookies, encryption of stored Meta access tokens, access controls, input validation, rate limiting, audit records, security headers, and monitoring. More detail is available on our Security and Data Handling page.

No internet service can guarantee absolute security. Please contact us promptly if you suspect unauthorized use of a Bifro account or approval link.

9. Access, correction, withdrawal, and deletion

You may ask to access or correct personal information under Bifro's control, withdraw consent where applicable, or request deletion. We may need to verify your identity and authority before responding. Certain records may be withheld or retained where permitted or required by law.

For account and Meta-originated deletion options, see Data & Account Deletion. You may also disconnect Bifro or remove business access in Meta settings.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the privacy regulator applicable to you.

10. Updates to this policy

We may update this policy when our service, providers, or legal obligations change. We will update the effective date and provide reasonable notice of material changes.