Privacy policy

1. Information the Brain may receive

When an authorized Messenger connection is enabled, the Brain can receive new events sent by Meta for the 10xCleaner Facebook Page. These can contain:

• Message text; Page and message identifiers; a Page-scoped sender identifier; and message, delivery, read or other event timestamps.
• Attachment descriptions, types and links included in an event. The current Brain does not download attachment files.
• Other event details supplied by Meta, such as delivery/read notifications, postbacks, reactions or message echoes. These may remain in the original event record even when they are not turned into a conversation message.
• Information you choose to include in a business message, such as your name, contact details, property address, cleaning needs, availability or quote request. A sender identifier is not necessarily your name, email address or verified identity.

The Brain preserves the original event and its receipt time, a verification result and integrity hash. It also creates linked conversation records, provisional contact records, source references, processing records and access/audit records. It does not automatically merge uncertain identities across accounts or services.

Future sources. If separately authorized and connected, business email, WhatsApp and selected business records could supply message headers, sender/recipient details, subject lines, message content, attachments, documents, customer/lead details, quotes, pricing, properties, jobs, policies and business decisions. Those connections and historical imports are not active now. Their scope and any material changes in use will be described before they are enabled.

Please avoid sending passwords, payment-card details or sensitive information that is unnecessary for a cleaning-service enquiry.

2. Why the information is processed

The intended purposes are to keep track of business enquiries and conversations, organize service requirements and quote requests, help authorized people retrieve relevant business information, preserve the source of a statement, and protect the reliability and security of the system.

The current software uses database search and rules to organize information and produce evidence-linked observations or suggestions. A customer's statement is not automatically treated as verified company policy. The current Brain does not send conversation content to an external AI model, train a general-purpose AI model, make consequential decisions about people, or operate autonomous agents. Future AI uses would require a separate review and an updated explanation where appropriate.

3. Access, sharing and Meta Platform data

Access to Brain records is restricted by company, source and assigned permissions. Authorized administrators operate the system. Hosting infrastructure necessarily supports storage and processing, and a connected communication provider processes communications under its own terms and privacy policy.

The Brain has no data-sale, advertising-audience export or data-broker feature. Meta Platform data is used for the business-communication purposes described here, not sold, published as customer profiles or used for unrelated advertising. The current Brain does not reply through Meta, alter Facebook content or retrieve historical conversations.

Information may need to be disclosed where required by applicable law or to address a valid security or legal obligation. Any such request requires human review. Requests from Meta to remove Platform data also require manual review and appropriate action under applicable Platform requirements. Deleting information from the Brain does not itself delete the original conversation held by Meta or another provider. See Meta's Privacy Policy for Meta's own processing.

4. Storage and security

Brain records are stored in a separate database on a server administered for 10xCleaner. Current safeguards include HTTPS for the public endpoint, verification of Messenger webhook signatures before acceptance, restricted internal interfaces, separate service and database permissions, protected credentials, and audit records. Operational backups are encrypted. This is not a claim that every database file is encrypted or that the system is end-to-end encrypted.

Backups currently remain on the same server; an independent off-site recovery arrangement is not yet in place. No system can guarantee complete security or availability. We do not make a Canada-only storage guarantee. Meta and any future connected provider may process information in other jurisdictions under their own policies.

5. Retention and deletion

The prepared live-source configuration has a 90-day retention setting, but deletion is currently paused by an administrative hold. This is not an automatic 90-day deletion promise. Automatic deletion of live conversations and a self-service deletion tool have not been implemented. The administrative hold does not mean that the law requires all records to be retained.

Privacy and deletion requests therefore require human review and manual technical action. You may request deletion or restriction even while a hold is in place. In considering a request, 10xCleaner must assess the business purpose, applicable legal obligations, Meta requirements and whether information is still needed. Any applicable reason for retaining information should be explained to you.

Original events, conversation records and derived knowledge may contain related copies, so a deletion review must account for those records together. Current backup rotation retains seven full backups and associated recovery records; copies may remain in protected backups until those backups are retired. Removing an active record does not instantly erase every backup. We do not promise immediate removal from all backups or from the source communication service.

6. Your choices and privacy requests

You can ask what information about you is held in the Brain, request access or correction, request deletion or restricted use, withdraw consent where processing relies on consent, or raise a privacy concern. Applicable rights and exceptions depend on the law and the circumstances. Withdrawing consent may limit the service that can be provided; it does not automatically remove information that must lawfully be retained.

Requests are handled by a person, not an automated Brain agent. Reasonable verification may be needed to avoid disclosing or changing someone else's information. Provide only enough detail to locate the relevant conversation. Do not send passwords, access tokens or identity documents unless an appropriate verification method has been agreed.

You may also contact the Office of the Privacy Commissioner of Canada or another applicable privacy authority about a concern.

7. Contact 10xCleaner

For access, correction, deletion or another privacy request, contact the 10xCleaner Facebook Page by message and begin with “Privacy request — Business Brain.” Include the account or contact details used in your conversation, an approximate date and the action you are requesting. This contact goes to the business through Facebook; it does not depend on the Brain's automated ingestion being enabled. Facebook may require you to sign in to send a message.

This privacy page itself is public and requires no login. It adds no analytics, advertising scripts, tracking cookies or contact form. The hosting service receives ordinary connection information when serving the page; following an external link takes you to that provider's service.

8. Changes to this policy

Updates will be published at this permanent URL with a revised date. New communication sources, broader AI use or other material changes should be explained before those uses begin, with additional notice or consent where required. This policy does not by itself enable a new integration or grant permission to access an account.