Privacy Policy — Bumblio (formerly Sandy DM Setter Test)
Updated: October 24, 2026
Operated by SB MEDIA / Sanda Cristiana Brown
Contact: admin@bumblio.io

Purpose and information processed
This prototype tests automated Instagram messaging on an authorized account.
Meta supplies account and sender identifiers, message content, timestamps,
and messaging events. The original test credentials are kept in Render environment settings.
Instagram login credentials authorized through the private connection test or
the separate reviewer workspace are
stored encrypted in the database, along with the account ID, username, and
authorization expiry. Temporary login verification records expire in 10 minutes.
Contact admin@bumblio.io to request deletion or revoke access in Instagram.
Additional authorized accounts are not enabled for automated messaging.
The prototype is restricted to one configured Instagram account and test sender.

AI test operation
Only eligible messages from the designated test sender beginning with "ai "
are stored and processed for a reply. The text after the prefix, assistant
instructions, and up to six recent exchanges from that same account and sender
are sent to xAI. The application does not add Instagram identifiers or access
tokens to the AI request. Information included in message text itself may be
transmitted. Generated replies are sent through Meta.

Storage and retention
Render PostgreSQL stores up to six recent exchanges per conversation, plus
temporary message-processing records that can contain incoming text, generated
replies, identifiers, timestamps, and delivery status. Conversation history
expires after seven days of inactivity; processing records expire seven days
after creation once they are no longer pending. Daily request and token totals
are retained for approximately 31 days. Cleanup runs at startup and hourly
while the service is running; if stopped, cleanup resumes when it starts.
Account configuration remains until removed by the operator.
Conversation pause settings remain until changed, even if their text expires.
The private admin dashboard stores assistant instructions and pause settings.
It also stores coach profile names, business names, voice preferences, approved
offers, qualification rules, resources, booking links, and other instructions.
Profiles are configuration drafts, not automatically authorized client accounts.
Selecting one for the existing test account sends its compiled instructions to
xAI and clears that test account's saved conversation context. Editing a profile
used in the test account also clears its context and cancels pending replies.
Older processing records remain subject to the seven-day retention above.
Administrator sessions use an HttpOnly, Secure, SameSite cookie and a hashed
session identifier stored in the database, expiring after eight hours. Aggregate
sign-in attempt counts are stored to limit password guessing. Passwords are not
stored in the application database. Dashboard access is limited to the operator;
this prototype does not provide customer signup or customer logins.
Restarts and redeploys do not clear the database.
Provider backups may retain copies according to their own retention schedules.
Logs record technical outcomes, internal job IDs, and token counts, not message text.

Controls and requests
Send "ai reset" from the designated test sender to clear that conversation's
history and older processing-record message text from the active database.
This does not erase provider logs/backups or daily usage totals. Other senders'
and accounts' histories are not affected. Revoke access through Instagram's
Apps and Websites settings to disconnect. For privacy, access, export, or
deletion requests, email admin@bumblio.io with your Instagram username.
Never send passwords or access tokens. Reasonable ownership verification
may be required.

Providers
Meta connects Instagram, Render hosts the application and database, and xAI
generates replies. They may retain data under their own policies. This policy
will change as the prototype's data handling changes.