Privacy Policy
Effective date: April 20, 2026
Entity: Bscale Laboratories, Incorporated (Philippines)
Contact: privacy@bscalelabs.com
1. Who we are
Bscale Laboratories, Incorporated ("Bscale," "we," "us") is a Philippine-incorporated company that operates Strata Connect, an AI business concierge platform. Strata Connect helps businesses handle inbound customer interactions — messages from Facebook Messenger and Instagram Direct, comments on Facebook Page posts and Instagram posts, and other connected channels — by routing them to AI agents trained on the business's own knowledge.
This policy explains what data we collect, why we collect it, how long we keep it, and the rights you have over it. It applies to everyone who interacts with Strata Connect: the businesses using the platform (we call them operators), the people messaging those businesses through connected channels (end-customers), and anyone visiting our websites.
2. Two audiences, two data flows
Strata Connect sits between two kinds of users, and the data relationship is different for each.
Operators create a Strata Connect workspace, connect their own messaging channels, upload their own knowledge base, and use Strata Connect to respond to their customers. Operators are our direct customers. We are the data controller for operator account data and a data processor for the customer conversation data that flows through their workspace.
End-customers are the people who interact with an operator's business on a connected channel — whether by sending a direct message or commenting on one of the operator's posts. When you message or comment on a business that uses Strata Connect, your content, sender or commenter metadata, and any attachments pass through Strata Connect so the operator's AI agent or human team can respond. We process this data on behalf of the operator — their own privacy policy governs how they use it. This policy covers what we do with it.
3. What we collect
From operators
- Account identity: name, email address, authentication credentials
- Workspace configuration: business name, branch setup, agent configurations, knowledge base content you upload
- Billing and payment information (when paid plans are live)
- Product usage telemetry: feature usage, session metadata, error traces
- Support correspondence
From connected Meta assets (Messenger, Instagram, Facebook Pages)
When an operator connects a Facebook Page or Instagram account to Strata Connect, we receive:
- Inbound and outbound message content from Messenger and Instagram Direct, including text, images, and other attachments
- Comments on the operator's Facebook Page posts and Instagram posts, and our replies to those comments
- Public profile information of people who message or comment (display name, platform user ID, profile picture URL)
- Page and Instagram account metadata (Page ID, IG business account ID, Page name)
- Post metadata for commented-on posts (post ID, post content summary)
- Message timestamps, read receipts, and reactions
- Webhook events such as postbacks, referrals, and comment notifications
From end-customers on any channel
- Message content you send to a business using Strata Connect
- Comments you post on a business's Facebook or Instagram posts, if that business uses Strata Connect
- Sender or commenter metadata provided by the channel (platform user ID, display name, profile picture URL)
- Attachments shared in messages or comments
- Your interactions with AI-generated replies
Derived data
- Conversation summaries generated by AI
- Embeddings of knowledge base content for retrieval
- Contact profiles built from repeated interactions across channels
- Aggregate analytics (volumes, response times, resolution rates)
4. Why we collect it
We collect this data to operate the service, and only for that purpose. Specifically:
- Deliver messages between end-customers and operators, and display and respond to comments on operators' Facebook and Instagram posts
- Generate AI responses grounded in the operator's knowledge base
- Give operators a unified inbox, comment feed, and contact history
- Enable booking, scheduling, and other agent actions the operator configures
- Improve system reliability (error monitoring, usage analytics)
- Bill operators for paid usage
- Meet legal and tax obligations
We do not sell personal data. We do not share personal data with advertisers. We do not use end-customer messages to train general-purpose AI models.
5. Who we share it with (sub-processors)
We rely on a small set of third parties to run Strata Connect. Each one processes data only as needed to provide their service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic | AI inference for agent responses | United States |
| Meta Platforms | Messenger and Instagram channel APIs | United States / EU |
| Twilio | Legacy messaging bridge (being phased out) | United States |
| Resend | Transactional email (confirmations, notifications) | United States |
| Amazon Web Services | File and attachment storage (S3) | Region-scoped |
| Hosting provider | Application and database infrastructure (Postgres, Redis) | Region-scoped |
| Sentry | Error monitoring (if enabled on your workspace) | United States |
| Axiom | Log aggregation (if enabled on your workspace) | United States |
We review this list as our stack changes. When we add a sub-processor that materially affects personal data, we update this page and notify operators at least 30 days before the change takes effect where practical.
6. How long we keep data
| Data type | Retention |
|---|---|
| Active workspace data (conversations, contacts, knowledge base, bookings) | Kept while the workspace is active |
| Deleted workspace data | Soft-deleted for 30 days (recoverable), then hard-purged within 90 days |
| Data covered by a Meta Data Deletion Callback | Purged within 30 days |
| Individual end-customer deletion request | Purged within 30 days of verification |
| Backups containing deleted data | Rotated out within 90 days |
| Billing records | 5 years (Philippine Bureau of Internal Revenue requirement) |
| Security and audit logs | 2 years |
| Records of data subject requests | 2 years (to prove compliance) |
7. Your rights
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and equivalent laws in other jurisdictions, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data (subject to the retention exceptions above)
- Port your data in a portable format
- Object to specific processing activities
- Withdraw consent where processing is based on consent
To exercise any of these rights, email privacy@bscalelabs.com with enough detail for us to identify your records. We will confirm receipt within 7 days and respond within 30 days. If we need to refuse a request (for example, because retention is required by law), we will explain why.
If you are an end-customer and your data reached us through an operator's workspace, we may ask you to work with that operator directly — they control the conversation and retention settings on their side. We will still act on valid deletion requests regardless.
If you are unsatisfied with our response, you can file a complaint with the National Privacy Commission of the Philippines at privacy.gov.ph.
8. Deletion pathways
End-customers who messaged a business using Strata Connect have two ways to remove their data:
- Remove Strata Connect from your Facebook settings.Facebook will send us a Data Deletion Callback, and we will purge your data within 30 days. This is the simplest path for Messenger and Instagram Direct users. Note: this callback may not cover data from public comments on a business's posts — use Option 2 if you only interacted via comments.
- Email privacy@bscalelabs.com. Tell us which channel you used (Messenger, Instagram Direct, Facebook comments, or Instagram comments) and which business you contacted. We verify the request and purge your data within 30 days.
9. Security
We take reasonable measures to protect personal data:
- Channel access tokens are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256)
- All data in transit is protected by TLS
- Access to production systems is restricted, logged, and reviewed
- We use multi-tenant isolation so one workspace cannot read another's data
No system is perfectly secure. If we ever experience a breach that affects your personal data, we will notify affected users and the National Privacy Commission within the timeframes required by Philippine law.
10. International data transfers
Because some of our sub-processors are based outside the Philippines, your personal data may be transferred to and processed in the United States, the European Union, and other jurisdictions. We rely on the contractual safeguards those sub-processors maintain (for example, data processing agreements and, where applicable, Standard Contractual Clauses) to protect your data during transfer.
11. Children
Strata Connect is not directed to children under 18. We do not knowingly collect personal data from children. If we become aware that we have, we will delete it. If you believe a child's data has been submitted to Strata Connect, email privacy@bscalelabs.com.
12. Changes to this policy
We may update this policy as Strata Connect evolves. Material changes — anything that expands what we collect, who we share it with, or how long we keep it — will be announced at least 30 days before they take effect, by email to operators and on this page. The effective date at the top tells you when the current version went live.
13. Contact
Bscale Laboratories, Incorporated
Philippines
Email: privacy@bscalelabs.com
For data protection concerns specifically, mark the subject line "Privacy Request."