ChatAd (“we”, “us”) is operated by CPS Technology Services Ltd. It is a B2B advertising-creative tool delivered over WhatsApp for small and medium-sized businesses in Hong Kong (“merchants”). This Privacy Policy explains, in plain language, what data we collect, why we collect it, how we use it, which third parties process it for us, and how you can have it deleted.
If you have any questions about this policy, email us at tomslchui@cpstech-hk.com or message us on WhatsApp at any time.
1. What data we collect
- WhatsApp conversation content: the text, images, voice notes and other messages you send to ChatAd through WhatsApp (Meta Cloud API), used to understand what advertising you need.
- Facebook / Instagram access tokens: only after you actively connect your own Facebook Page or Instagram professional account do we obtain and store this authorisation token, which we use to read data or publish content on your behalf.
- Content from your own Page / account: once connected, we read the public posts on your own Page / Instagram account (photos, text, colour palette and so on) to analyse and learn your brand style. We do not read any account you do not manage or any third-party account.
- Generated advertising material: the ad images, copy and related intermediate files the system produces for you.
- Basic merchant information: for example your business name, contact number (your WhatsApp number) and the business details you give us in conversation, used to identify your account and provide the service.
We do not collect Facebook or Instagram data by any form of web scraping.
2. Why we collect this data and how we use it
We collect the data above solely to serve your own business:
- to generate ad images and copy that match your brand style;
- to publish an ad to the Facebook / Instagram account you connected, on your behalf, only after you explicitly confirm each time (by replying “1”);
- to keep the service stable and improve its quality.
Your data is only used to provide the service to your own account. We never use any of your data (including access tokens, style data, conversations or generated material) for any other merchant, and we never sell or share it with any third party for marketing.
3. Data processors
To provide the service, some data is processed for us by the following trusted providers. They process data only on our instructions and do not use it for their own purposes:
- Supabase — our database and file-storage provider, storing merchant data, generated material and conversation records.
- Google Gemini API — our content-analysis engine, used to analyse your past posts to learn your brand style and to understand your advertising requests.
- Meta (Facebook / Instagram / WhatsApp) — we receive your WhatsApp messages, and publish ads after you confirm, through Meta’s official APIs (WhatsApp Business Platform, Facebook Graph API, Instagram Graph API).
- fal.ai — the AI image engine used to generate ad images. Every finished asset is downloaded and stored in our own Supabase storage and is not kept long-term on third-party servers.
4. Data retention and deletion
When you remove the ChatAd app’s authorisation in your Facebook / Instagram account settings (deauthorize), or trigger a data deletion request through Meta, we follow Meta’s official process: we automatically receive the notification, delete the Facebook / Instagram access token associated with you, and delete the related data as requested. This is handled automatically by the following technical endpoints:
- Deauthorize callback:
https://bot.chatad.app/oauth/facebook/deauthorize - Data deletion callback:
https://bot.chatad.app/oauth/facebook/data-deletion
In short: disconnecting us in Facebook / Instagram at any time triggers deletion of the related data. If you also want your conversation records and generated material deleted, or want to check on a deletion, email us or tell us on WhatsApp.
5. Data security
Each merchant’s data is isolated by design, so merchants cannot read or mix with each other’s data. Access tokens and other sensitive data are used only on our servers and never appear on public pages or in logs.
6. Your rights
You may at any time:
- ask to see the data we hold about you;
- ask us to correct inaccurate data;
- ask us to delete your data (see section 4 above);
- remove the connection authorisation in your Facebook / Instagram account settings.
7. Data controller and contact
The data controller for this service is CPS Technology Services Ltd. For any privacy question or request, email tomslchui@cpstech-hk.com or contact us on WhatsApp at +852 5927 8033.
8. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to the service or to legal requirements. For any material change we will update the “Last updated” date on this page and, where reasonable, notify existing merchants on WhatsApp.