Sakrabot is a web platform for advertising agencies and media buyers: it links money spent on Meta ads to sales in the client's CRM and shows leads, active, qualified, sales and losses for every creative. This policy explains what data Sakrabot receives, why it uses it, where it stores it and who it shares it with.
Sakrabot works with two kinds of data. The first is account data of its users (agency staff, media buyers, clients). The second is data from sources the user connects themselves: ad account, lead forms, Instagram Direct, CRM, website form. This data belongs to the user (the advertiser) — Sakrabot processes it only on their instruction and only to provide the service.
What data we receive
We receive only the data the service needs to work. The user connects every source themselves — nothing is taken from a source that is not connected.
- Account: your name and the identifier of your sign-in method (Facebook, Google or Telegram). From Google — your verified email, from Telegram — your name and username. Email, phone and job title you add to your profile yourself are optional.
- Sessions: sign-in time, last activity, sign-in method, a short device name (for example, «Chrome · Windows») and an IP address with its last part hidden — so you can recognise your sessions and close the ones you don't need.
- Meta ad account — when you connect it through Facebook and within the permissions you grant: ad accounts; names, statuses and objectives of campaigns, ad sets and ads; spend and statistics (impressions, reach, clicks, video views); the list of your Facebook Pages. Permissions: ads_read, business_management, pages_show_list; ads_management — to pause, enable and delete ads and to send sales back to Meta.
- Lead forms: name, phone and email of people who filled in a Meta lead form, their answers to the form questions and the ad they came from. Permissions: leads_retrieval, pages_read_engagement; so that a new lead arrives within a minute, the Page is subscribed to lead notifications — pages_manage_metadata.
- Instagram Direct: the username of people who wrote to the Instagram account you connected, message text and time, a phone number left in the conversation. Permissions: instagram_basic, instagram_manage_messages, pages_messaging.
- CRM (AmoCRM or Bitrix24) — when you connect it: pipelines and stages, deals (stage, amount, creation and closing time, responsible employee's name, loss reason), the deal contact's phone, history of notes and calls (time, duration, employee, note text, call recording link).
- Telegram: the identifier and name of a group the Sakrabot bot was added to, and the group connection command. The bot does not store other messages in the group.
- Website leads: the fields your website form sends to Sakrabot — name, phone, email, comment and additional fields. The sender's IP address is kept briefly in server memory only for spam protection (rate limiting) and is not written to the database.
- Payments: plan, period, amount, payment status and Payme / Click transaction identifiers. Card numbers and card details never reach Sakrabot — they are entered on the Payme or Click page.
- Activity log: who changed what and when — for example, pausing a campaign, a setting, a role or a manual correction.
Why the data is used
- To count leads, active, qualified, sales, losses and their cost for every creative: a lead is matched to a CRM deal by phone number.
- To send the messages you turned on to your Telegram group: new leads, daily, weekly and monthly reports, alerts.
- If you turned it on, to send qualified-lead and purchase events back to Meta (Conversions API) — so ads find more paying customers.
- To prepare an AI summary when you ask for it — a short recommendation based on aggregated numbers.
- Sign-in, role-based access, session management and the activity log — to see who did what.
- To account for your plan, limits and payments.
Data is not sold, not used for advertising and not processed for any purpose other than those above. Data received through Meta APIs is used within the Meta Platform Terms.
Where and how data is stored
- Data is stored in a database on the Sakrabot server; the database is not reachable from the outside network.
- Meta and CRM access tokens (including a Conversions API token you enter) are stored encrypted in the database (AES-256-GCM); the encryption key is kept separately from the database — even if a copy of the database fell into the wrong hands, the tokens could not be read.
- Website form keys and team invite links are stored in the database only as a SHA-256 hash.
- Everyone sees only the projects they are a member of; the «client» role can only view and cannot change anything. The session cookie is signed and sent only over HTTPS.
Who data is shared with
Data is shared only in the following cases and only for that purpose:
- Meta Platforms — if you turned on Conversions API, to the pixel you selected or whose key you entered: for a lead-form lead, only Meta's own lead ID; for a sale from Instagram Direct, the SHA-256 hash of the phone number (not the number itself); for a sale, the amount and currency; names are not sent. Ad actions you click in Sakrabot (pause, enable, delete) are also sent to Meta.
- Anthropic (Claude AI) — when you ask for an AI summary: only aggregated numbers (spend, leads, sales, conversion, etc.) and campaign names. Names, phone numbers, message text and deal names are not sent; salespeople are replaced with «Salesperson 1», «Salesperson 2».
- Telegram — only to the groups you connected: new leads (name, phone, email, which ad they came from), reports and alerts.
- Payme and Click — the order number and amount for payment.
- Facebook, Google and Telegram — only when you sign in with the method you chose, to confirm who you are.
- Your client — through the secret report link you sent them, they can see only this project's report without signing in. If you reset the link, all old links stop working.
- Government authorities — only in cases and in the manner established by law.
Data is not sold or given to anyone else.
How long data is kept
- Data is kept while the account and project are active.
- A deleted project stays in the archive for 30 days (it can be restored during this time), then all project data — leads, deals, conversations, statistics and connections — is permanently deleted. Activity log entries (who did what and when) are kept for security.
- When Meta or a CRM is disconnected, the access token is deleted immediately; statistics and history received earlier stay until the project is deleted.
- A session lasts 30 days; it ends earlier if you click «Sign out» or close the session.
- A Telegram group connection code is valid for 24 hours, a team invite link for 72 hours.
- Payment records are kept for accounting.
Your rights
- View your data in the app and correct your profile (Settings → My profile).
- View and close active sessions, connect or disconnect sign-in methods.
- Disconnect Meta, CRM, Telegram and website at any time (Connections section).
- Request deletion of your data — see «Data deletion» below.
If you are a customer of a Sakrabot user (for example, you filled in a lead form or wrote in Direct), your data comes from a source connected by that advertiser. Send your request to the advertiser or to the address in the «Contact» section — we will pass it on to the relevant user and carry it out on their instruction.
Data deletion
How to delete data connected through Facebook and your account:
- Disconnect Meta: Sakrabot → Connections → Meta → «Disconnect Facebook» (separately in each project). The access token is deleted immediately and Sakrabot no longer receives data from Meta.
- From Facebook: Facebook → Settings & privacy → Settings → «Business integrations» (or «Apps and websites») → Sakrabot → «Remove». After that, Sakrabot can no longer access Meta on your behalf.
- Delete project data: Settings → Delete project (project owner). The project stays in the archive for 30 days, then all its data is permanently deleted.
- Delete your account and all related data: write «Data deletion» to the address in the «Contact» section — include your name and how you sign in (Facebook, Google or Telegram).
Once we confirm the request comes from the account owner, it is completed within 30 days and we tell you the result. Payment records that must be kept by law are an exception.
Who the service is for
Sakrabot is a business service; it is not intended for people under 18, and we do not knowingly collect their data.
Changes to this policy
When Sakrabot changes, this policy is updated too: the new text appears on this page with the update date at the top. Continuing to use the service after an update means you accept the new text.
Contact
For questions, data deletion requests or complaints, write to:
- Telegram: @abchingiz