Privacy Policy

Last updated 9 October 2026

Social2Revenue is a business platform operated by Treatz Corp. It connects to social media accounts that a customer owns, reads the public comments and direct messages those accounts receive, and replies on the customer's behalf according to rules the customer configures.

This policy describes what the platform stores, why, and who can reach it.

Who the customer is, and who you are

Our customer is the business that connects its own accounts. If you commented on, or sent a message to, a business using this platform, that business is the party that decides how your message is handled; we process it on their instructions. Contact that business first — they can delete what relates to you, and they can answer why they replied the way they did.

What is stored

• Account identifiers issued by the provider — Facebook Page ids, Instagram account ids, and the account-scoped user id a provider assigns to a person interacting with that account. These are the provider's identifiers, not ours, and they are stored as a mapping to our own records.
• The content of comments and messages exchanged through the connected accounts, which is what a reply has to be written against and what a customer's own record of a conversation contains.
• Contact details a person chooses to give in a conversation, or on a form the customer's rule sends — a name, an email address, a phone number — when the rule asks for them, one question at a time or on one hosted page. Where the rule or the form asks whether the person agrees to be emailed or texted, their answer is stored together with the wording they were shown.
• Whether a person follows the customer's account, where the customer turned that check on. It is read from the provider only after the person has opened a conversation, and stored as the provider answered it: following, not following, or unavailable when the provider gave no answer. An unavailable answer is never recorded as "not following".
• Activity on the customer's own website, where the customer installed the platform's tracking script: the pages visited, with identifying parameters removed from the address before it is stored; the referring page; campaign and advertising click parameters; and the events the customer defined, such as a form submission or a purchase. A form reports the names of its fields, and values only for name, email and phone — never a password, a card number or free text. A visitor is recognised by random identifiers held in first-party cookies, not by fingerprinting.
• Email sent on the customer's behalf, one message per recipient, and whether it was delivered, opened or clicked. Where a customer connects its own mailbox, only messages exchanged with that customer's existing contacts are copied, starting from the moment of connection.
• Access tokens the customer authorized, encrypted, so the platform can act on the accounts the customer connected.
• Customer account details — the email address, name and password of the people who sign in, and the names of their organizations and brands. Passwords are stored only as a hash.

What is not stored

The platform does not store payment card details, and it holds no capability that returns the plaintext of a stored provider credential — that capability does not exist, so no account and no future role can be granted it.

Session records keep only a truncated network address. Operational request logs may contain a full network address for service diagnostics. Network addresses are not used to match one visitor to another.

Where data goes outside the platform

Each of these is a real transfer, and a description of this platform that omitted any of them would be inaccurate.

• A third-party large language model provider. To decide whether a comment expresses buying intent, the text of that comment — and, where a conversation has begun, the messages in it — may be sent to a model provider for classification. The provider returns a classification and does not receive the customer's stored credentials.
• An email delivery provider, which carries the email a customer's sequences send. It receives the recipient's address and the message, and reports delivery, opens and clicks back.
• A text-message delivery provider, which carries the text a customer's rule or form sends where the person agreed to be texted. It receives the phone number and the message, and reports delivery and replies, including a request to stop, back.
• The customer's own CRM, when the customer connects one. A lead's name, email, phone and the source of the conversation are sent to that CRM once, and updated there afterwards.
• Advertising platforms the customer chooses, in two cases only. Where the customer adds one as a destination for its website, website events are forwarded to it when the visitor's consent permits. Where the customer connects its own advertising account, a conversion the customer defined — a purchase, a booking — is reported back to it. In both cases an email address or phone number is hashed before it leaves the platform. The text of comments and messages is never sent to an advertising platform.
• Infrastructure providers that host the platform's servers and database, under their own security obligations.

Data obtained from a connected provider is not sold.

Social2Revenue's own SMS program

Social2Revenue, operated by Treatz Corp, offers optional launch updates, product news, and offers by SMS to its own leads, subscribers, and customers. SMS consent is a separate, voluntary choice at our communication preferences page. Providing a phone number, creating an account, or making a purchase does not grant SMS consent.

We keep the mobile number and the consent decision with the wording shown, the form version, the source page, and the time of submission, to operate the program and honour preferences. Mobile information and SMS opt-in information are not sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes. Messaging providers process the number and message solely to deliver texts on our behalf.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

Reply STOP to unsubscribe from SMS, or HELP for assistance. You may also contact Contact@TreatzCorp.com. Message frequency varies. Message and data rates may apply. See the Terms of Service for program details.

Separation between customers

Every table holding customer data is governed by database-level row security enforced under a restricted role, so one customer cannot read another's tokens, accounts, conversations or events. This is a property of the database rather than a rule in application code, and it is tested against a real database with the real policies.

Who at Treatz Corp can see customer data

Platform staff use a separate control plane that holds read-only access to customer tables and cannot write to them. Viewing an individual customer's data requires a named, time-limited, recorded support session. There is no mechanism for staff to read a stored access token.

Disconnecting

A customer may disconnect a connected provider at any time from their own settings. Doing so destroys the stored credential, stops all outbound activity on those accounts, and stops inbound events being processed. Business records the customer created — conversations, contacts, revenue history — are retained under that customer's own retention settings, because disconnecting a provider is not a request to delete a business's records.

Deleting data

A customer can delete their own records from within the product. A person who interacted with a customer's account should contact that business, which can remove records relating to them.

Where a provider supports it, deletion requests forwarded by that provider are honoured automatically at https://hook.social2revenue.com/webhooks/meta/data-deletion.

Requests may also be sent to Treatz Corp directly using the contact details listed with the application in the provider's platform, and we will act on them.

Changes

If this policy changes materially, the updated date above changes with it.