1. Who we are
The Butterfly Social Suite is operated by Butterfly Foundation & Agency (BFA), a digital advertising and web-services agency, under the legal entity BUTAL, LLC (registered in Florida, United States), with an operating office in Sultan Muzaffar, Erbil, Kurdistan Region, Iraq. In this policy, “BFA,” “we,” “us,” and “our” refer to this organisation, and “you” refers to the person or business using our services.
We are the data controller for information processed through our own platforms. When you connect a Facebook Page, Instagram account, or WhatsApp Business asset that belongs to your own clients, you act as the controller for that data and we act as a processor on your behalf.
2. What this policy covers
This policy applies to the BFA products that let businesses connect and manage their social and messaging assets, including:
- Butterfly Social Suite — connecting Facebook Pages and Instagram Business accounts to schedule, publish, and manage content.
- BFA Notify — WhatsApp Business messaging, templates, and delivery reporting.
- Related BFA agency tools that use the Meta and WhatsApp platforms on your behalf.
It does not cover third-party websites or platforms we link to, including Meta’s own products, which are governed by their own privacy policies.
3. Information we collect
Information you provide
- Account details such as your name, email address, and business name when you register.
- Content you create or upload — posts, captions, images, videos, and message templates.
Information from Meta when you connect an account
When you authorise our app through Facebook Login for Business, we receive only the data covered by the permissions you approve:
- Your Facebook user ID and basic profile.
- The list of Facebook Pages you manage, and their IDs and access tokens.
- Your connected Instagram Business account ID and basic profile.
- Business Manager identifiers needed to link the correct assets.
- Engagement and publishing data for the Pages you connect.
WhatsApp Business information (BFA Notify)
- Business phone numbers, message templates, and delivery/read status of messages you send.
- Recipient phone numbers you provide for messaging campaigns you run.
Technical information
- Log data such as IP address, browser type, and timestamps, used for security and troubleshooting.
4. Meta permissions we use
We request only the permissions our features require. Each is used strictly for the purpose described below.
| Permission | Why we use it |
|---|---|
pages_show_list | To display the Facebook Pages you manage so you can choose which to connect. |
pages_read_engagement | To read post and Page engagement so you can review performance in one place. |
pages_manage_posts | To publish and schedule the content you create to your selected Pages. |
business_management | To identify and link the correct Business Manager assets to your account. |
instagram_basic | To read the basic profile of your connected Instagram Business account. |
instagram_content_publish | To publish the content you create to your connected Instagram Business account. |
We never use these permissions to collect data beyond what a feature needs, and we do not access private messages or friend data.
5. How we use information
- To provide the core service: connecting your accounts and publishing the content you schedule.
- To show you analytics and delivery status for your posts and messages.
- To secure the service, prevent abuse, and troubleshoot problems.
- To contact you about your account, security, or service changes.
We do not sell your personal information, and we do not use it for advertising unrelated to the campaigns you run.
7. Storage & security
Data is stored on servers we control, protected behind Cloudflare and secured with encrypted (HTTPS/TLS) connections. Access tokens are stored securely and used only to perform the actions you request. Access to systems is limited to authorised personnel. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.
8. Retention
We keep your information for as long as your account is active or as needed to provide the service. When you disconnect an account or delete your data, we remove the associated tokens and personal data as described in the Data Deletion section, except where we must retain limited records to meet legal obligations.
9. Your rights
Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to withdraw consent. You can disconnect any connected account at any time from your app settings or from your Facebook settings. To exercise any right, contact us using the details below.
10. Deleting your data
In short: remove the app from your Facebook settings to revoke access, then contact us to erase any stored data. We process deletion requests promptly, typically within 30 days.
12. Children
Our services are intended for businesses and adults. They are not directed to anyone under 18, and we do not knowingly collect personal information from children.
13. Changes to this policy
We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for significant changes, provide additional notice.
14. Contact us
For any privacy question or request:
- Email: privacy@bfa.zone
- Support: support@bfa.zone
- Butterfly Foundation & Agency (BUTAL, LLC), Sultan Muzaffar, Erbil, Kurdistan Region, Iraq