Privacy policy

Last updated: 13 November 2026

Who we are

Tattvam Enterprises provides Reel Factory, software that helps businesses (our clients) publish short videos on their own Instagram and Facebook accounts and answer people who comment on them, and Reel Factory Connect (connect.ugcapp.site), where a business connects its accounts. Both use Meta's official APIs through our Meta app "AI Avatar Factory Publisher", and, when a business connects its Google account, Google's APIs (Gmail and YouTube API Services). Contact: contact@tattvamenterprises.com.

Businesses that use Reel Factory Connect

When a business logs in with Facebook Login for Business, we receive its Facebook user ID and name, the Facebook Pages and Instagram professional accounts it chooses to share, and access tokens for them. We use these only to show its posts, run the automations it sets up and show its leads. The tokens are stored encrypted and are never shown in a browser. We set one cookie, to keep the business logged in for up to 7 days; we use no advertising or tracking cookies. A business can disconnect at any time (in Reel Factory Connect, or in Facebook → Settings → Business integrations). When it does, we delete its connection, automations and leads at once and remove our app's access to its Facebook account; anything left in backups or logs is gone within 30 days.

Google accounts a business connects (Gmail and YouTube)

A business may connect its Google account in Reel Factory Connect, on Google's own screen, for two things only:

• Connect your Gmail (permission to send email on its behalf, gmail.send): we send, from the business's own Gmail address, the email a person asked for in the business's Instagram or Facebook DMs (for example the guide its post offered), and the notices the business set up for itself. We cannot read, search or change its mailbox: this permission only sends.
• Connect YouTube (permission to upload videos, youtube.upload, and to see the YouTube account, youtube.readonly): we upload to the business's own channel the videos it schedules in Reel Factory, with the title, description and privacy it chose, and we read the channel's name and ID (to show which channel is connected) and each uploaded video's processing state and view count (to show the business its posts).

What we receive and keep from Google: the Google account's email address and Google's ID for it; the permissions the business allowed; an access token and a refresh token, stored encrypted and never shown in a browser; for YouTube, the channel's name and ID, and the ID and state of each video we uploaded. We refresh the channel's name at least every 30 days and read views when they are shown, without keeping them.

What we use it for: only the two features above, which the business turns on itself. We do not use Google user data for advertising, do not sell it, do not let people read it (except with the business's permission, for security, or as the law requires), and do not transfer it to anyone except as needed to provide these features.

Reel Factory Connect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube. Reel Factory Connect uses YouTube API Services. By connecting YouTube, the business agrees to be bound by the YouTube Terms of Service; Google's handling of data is described in the Google Privacy Policy.

Removing access: press Disconnect Google in Reel Factory Connect (we remove our access at Google and delete the tokens, the channel's name and the posts we keep at once), or remove "Reel Factory Connect" in your Google account's security settings (third-party access); we then stop at once and delete what we keep within 30 days.

People who comment on a business's post

If you comment on an Instagram or Facebook post of a business that uses Reel Factory, and your comment asks for something the post offers (for example by writing a keyword the post names), the business's automation may:

• reply to your comment publicly, and
• send you one private message about your comment. Further messages are sent only if you reply or tap a button in that message, and only within the time Meta allows.

What we receive from Meta and keep:

• your comment: its text, its ID, the post it was left on, and when;
• your Instagram or Facebook user ID for that business (a number Meta gives each business), your username and, when Meta provides it, your name;
• the messages in that conversation with the business: what you type, the buttons you tap, and whether you removed (unsent) a message;
• your email address, only if you type it in that conversation to receive what the post offered.

What we use it for: only to run that business's automation for you: to reply, to send you what you asked for (a link, a file or an email), to avoid sending you the same thing twice, and to give the business its list of the people who asked (including the email addresses typed in the conversation) and simple counts (comments, replies, taps).

We do not sell this data, use it for advertising, or share it with anyone other than:

• the business whose post you commented on, which can see your username, the conversation's progress and, if you gave it, your email address;
• the services that run the automation for us: Cloudflare (where Reel Factory Connect and its data are hosted, and files a business offers), Google Cloud (where the automation runs), and, when the business sends what you asked for by email, the sending service it chose: Brevo, or the business's own Gmail.

Unsent messages. If you unsend a message, we delete our copy of it.

Files a business uploads to publish

Files a business uploads to publish a post through Reel Factory Connect are stored on Cloudflare R2 so Meta can fetch them, and are deleted 30 days after the post is published (7 days if publishing failed), or at once when the business disconnects.

Emails sent for a business

When you type your email in a business's conversation to receive what its post offered, we send that email for the business (from its own address, or ours with the business's name). We keep the address, the email's subject and whether it was sent for 90 days (then only a count remains), and your consent: the words shown under the question and when you answered. Every email has a one-click unsubscribe link; after it, that business sends you no more emails.

How long we keep it

The conversation and comment data: 90 days after the last message, then it is deleted. An email address you gave stays in the business's list until the business deletes it, you ask us to delete it, or you unsubscribe from the business's emails, and at most 24 months.

Your choices and rights

Reply "STOP" in the conversation and no more automated messages are sent to you. Every email has an unsubscribe link. To see, correct or delete your data, follow our data deletion instructions or write to contact@tattvamenterprises.com. We answer within 30 days. Depending on where you live (for example under GDPR or India's Digital Personal Data Protection Act), you may also have the right to object to or restrict how your data is used, and to complain to your data protection authority.

Requests from public authorities

If a public authority asks us for personal data we hold, we: check that the request is lawful and properly made; challenge it if we believe it is unlawful, overbroad or not properly made; disclose only the minimum data the request legally requires; and keep a record of each request, our response, the legal reasoning and who was involved. Where the law allows, we tell the business concerned.

Security

Access tokens are encrypted at rest; data travels only over HTTPS; each business can see only its own data.

Changes

We will update this page when what we do changes, and change the date at the top.