BuzzFar Privacy Policy
We are dedicated to safeguarding the privacy of creators and their audiences. This policy explains our data practices, API terms compliance, and your legal rights under GDPR, CCPA, and Meta platform policies.
Key Privacy Commitments at a Glance
We do not sell, rent, or trade your personal data, customer contacts, or social follower information to data brokers or advertisers.
All OAuth tokens and credentials are encrypted at rest with AES-256 and transmitted exclusively via TLS 1.3 encrypted tunnels.
We connect directly through verified Meta Graph and TikTok Webhook APIs, strictly honoring platform permissions and data scopes.
You can revoke tokens or permanently delete your account and all associated interaction logs anytime via our web request portal.
1. Overview & Scope
This Privacy Policy describes how BuzzFar("BuzzFar", "we", "us", or "our") collects, uses, protects, and discloses personal information when you access or use:
- Our marketing website located at
buzzfar.com. - Our web dashboard application for creators located at
app.buzzfar.com. - Our integrations with third-party social platforms (including Instagram Direct Graph API, TikTok Video Webhooks, and Facebook Messenger).
- Our Store OS checkout and automated direct message delivery systems.
This policy applies both to creators who register for an account with BuzzFar ("Creators") and to individuals who interact with a Creator's automated social flows, comment triggers, or store listings ("Followers" or "End Users").
2. Information We Collect
We collect personal information to provide our automation, messaging, and storefront services. The information falls into the following categories:
A. Information Provided Directly by Creators
When you create a BuzzFar account, subscribe to a plan, or set up your store, you provide us with:
- Account identifiers: Name, email address, password hash, profile avatar, and business/brand name.
- Billing & Payment Data: Credit card details, billing address, and tax IDs (collected and processed directly by our PCI-DSS compliant processor, Stripe; BuzzFar does not store raw credit card numbers).
- Product & Store Data: Digital files (PDFs, course assets, digital downloads), pricing, and fulfillment instructions.
B. Information From Social Platform Integrations (Meta & TikTok)
When you connect your Instagram Professional account, Facebook Page, or TikTok Creator profile to BuzzFar:
- OAuth 2.0 Access Tokens: Encrypted platform credentials granting authorized access to send DMs and listen to comment webhooks.
- Page & Profile Identifiers: Your Instagram user ID, Facebook Page ID, and TikTok creator handle.
- Webhook Payloads: Real-time event notifications when a user comments on your post, mentions you in an Instagram Story, or sends a DM with a configured trigger keyword (e.g. "GUIDE", "BRAND").
C. Information Collected From End Users & Followers
When followers interact with a creator using BuzzFar:
- Public comments containing triggered keywords, comment timestamp, and public Instagram/TikTok usernames.
- Direct message delivery status (whether the requested resource link or free PDF was delivered successfully).
- Checkout information (email address and delivery details if a follower purchases a product or registers for a strategy call).
D. Technical & Operational Telemetry
Standard internet logs collected automatically: IP addresses (truncated/anonymized where feasible), browser type, operating system, referrer URL, timestamps, and API response latency measurements.
3. Social Platform APIs (Meta & TikTok Compliance)
BuzzFar complies strictly with the Meta Platform Terms, Developer Data Policy, and TikTok Partner Guidelines:
Meta Data Handling Commitments
- Authorized Scopes Only: We request only the minimal permissions necessary to operate comment triggers and automated DM responses (e.g.,
instagram_manage_messages,pages_messaging,instagram_basic). - No AI Model Training on Private Messages: We do NOT use private direct messages or customer conversation transcripts to train machine learning models or generative AI.
- No Transfer or Sale:We never sell Meta platform data or transfer it to ad networks, data brokers, or any third party not necessary for providing BuzzFar's core service.
- Immediate Deauthorization: When you disconnect BuzzFar in your Facebook or Instagram App settings, our automated deauthorization webhook immediately invalidates all active access tokens and halts message queues.
4. How We Use Personal Information
We process personal data solely for legitimate business purposes:
- Automated DM Delivery: Delivering free guides, booking calendars, and resource links to users who comment trigger keywords in sub-0.4s.
- Store Fulfillment: Sending download links and invoices for courses, PDFs, and merchandise purchased through Creator Store OS.
- Account & Security Administration: Authenticating logins, preventing abuse, monitoring spam rates, and ensuring compliance with platform rate limits.
- Billing & Customer Support: Processing subscription renewals via Stripe and responding to support tickets.
- Legal & Regulatory Compliance: Complying with statutory accounting obligations, anti-fraud standards, and responding to lawful requests from authorities.
6. Security & Encryption Standards
We implement comprehensive organizational and technical measures designed to protect personal information from unauthorized access, destruction, loss, alteration, or disclosure:
- Encryption in Transit: All HTTP communications are forced over HTTPS using modern TLS 1.3 protocol.
- Encryption at Rest: All database volumes, backups, and user access tokens are encrypted using AES-256 encryption.
- Principle of Least Privilege: Access to production databases is strictly restricted to authorized engineering personnel using multi-factor authentication (MFA) and audited VPNs.
- Regular Vulnerability Audits: Continuous monitoring for software vulnerabilities and strict secret rotation practices.
7. Data Retention & Erasure
We retain personal information only for as long as necessary to fulfill the purposes outlined in this policy:
- Active Creator Accounts: Retained while your account remains active. Upon voluntary deletion, all live triggers and tokens are revoked immediately, and full database purge completes within 48 to 72 hours.
- Webhook Payloads & Temporary Triggers: Temporary message payloads and trigger events are flushed systematically within 30 to 90 days.
- Financial Invoices: Order transaction history through Stripe is retained for statutory periods required by tax and financial laws (typically 7 years).
To exercise your right to erasure, visit our dedicated Delete Account Request Portal.
8. Your Privacy Rights (GDPR, CCPA & Global Frameworks)
Depending on your jurisdiction (such as the European Economic Area, United Kingdom, or California), you may have the following legal rights:
Request a copy of the specific pieces of personal information we have collected about you.
Request permanent deletion of your personal data and social platform tokens.
Request correction of inaccurate or incomplete personal information.
We will never discriminate against you for exercising any of your legal privacy rights.
To submit an inquiry or exercise any of these rights, email us at privacy@buzzfar.com or use our Delete Account Request Page.
10. Children's Privacy
BuzzFar is intended exclusively for creators and business professionals aged 18 and older (or at least 13 with parental consent where allowed by platform rules). We do not knowingly collect personal information from children under the age of 13. If we discover that a child under 13 has provided us with personal information, we will delete it immediately.
11. Policy Changes & Contact Information
We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory updates. We will notify you of material changes by posting the revised policy on this page with an updated “Last Updated” date or by notifying active creators via email.
Contact Us
If you have questions, comments, or requests regarding this Privacy Policy: