Privacy Policy

This Privacy Policy explains how Crazy Horse Media, a Florida Corporation, ("Company," "we," "us," or "our"), collects, uses, and shares information in connection with the website at mentionxyz.com and the related comment-to-DM automation service (collectively, the "Service").

This Policy is incorporated into and subject to our Terms of Use. By using the Service, you agree to this Policy.

1. Two Roles: Member Data vs. Recipient Data

Because of how the Service works, we handle personal information in two distinct roles. This distinction matters and is referenced throughout this Policy.

A. As a controller — Member data. When you sign up for and use the Service as a customer (a "Member"), we act as the controller (or "business" under U.S. state laws) of the personal information about you — your account details, billing, and usage of the Service. This Policy governs how we handle that information.

B. As a processor — Recipient data. When you use the Service to run automations on your Facebook Pages, the Service processes personal information about the people who comment on or message your Pages ("Recipients") — such as their names, Facebook/Messenger user identifiers, and the content of their comments and messages. With respect to that Recipient data, you (the Member) are the controller and we act as a processor/service provider on your behalf, handling that data only to provide the Service to you and on your instructions.

As a Member, you are responsible for having your own privacy policy, for providing any notices, and for obtaining any consents or lawful basis required to collect and message your Recipients under applicable law and under Meta's policies. See Section 12.

2. Information We Collect

2.1 Information you provide (Members)

• Account information: name, email address, login credentials, and business details you enter.
• Business configuration: the facts about your business, services, trigger phrases, replies, follow-up sequences, prompts, logos, and brand assets you provide to configure the Service.
• Billing information: processed by our third-party payment processor. We do not store full payment card numbers; we receive limited information such as billing status and the last four digits of your card.
• Communications: information you provide when you contact support.

2.2 Information processed on your behalf (Recipient data)

When you connect a Facebook Page through your own Facebook App, the Service accesses and processes, via the Meta Graph API and on your instructions:

• Recipient names and Facebook/Messenger user identifiers;
• the content of Recipient comments and messages;
• interaction and event data (for example, which trigger fired, what reply or DM was sent, and follow-up status); and
• other data made available through the permissions you grant to your Facebook App.

We process this data to operate the automations you configure and to populate your dashboard, leads, and conversation history.

2.3 Information collected automatically

• Usage and log data: IP address, browser and device type, pages viewed, actions taken, and timestamps.
• Cookies and similar technologies: used to keep you logged in, remember preferences, and understand usage. See Section 8.

2.4 Information from third parties

• Meta: data made available through the Meta Graph API and the permissions granted to your Facebook App.
• Payment processor: billing and transaction status.
• AI providers: results returned from processing your content (see Section 4).

3. How We Use Information

We use Member information to:

• provide, operate, maintain, and secure the Service;
• create and manage your account and process membership payments and Tokens;
• generate AI Output you request, such as replies, scheduled posts, and images;
• respond to support requests and communicate with you about the Service;
• monitor, analyze, and improve the Service, and develop new features;
• detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms; and
• comply with legal obligations and enforce our agreements.

We process Recipient data only to provide the Service to the relevant Member, consistent with the Member's instructions, this Policy, our Terms, and Meta's policies. We do not use Recipient data for our own independent purposes, and we do not sell it.

4. AI Processing

Some features of the Service use artificial-intelligence providers to generate content. When you use these features, the relevant inputs — such as your business information, prompts, and, where applicable, message content — may be transmitted to and processed by our AI providers to produce AI Output. We contract with providers on terms intended to restrict their use of that data to providing services to us. You are responsible for reviewing AI Output before it is published or sent, as described in our Terms.

5. How We Share Information

We do not sell your personal information or your Recipients' personal information. We share information only as follows:

• Service providers (sub-processors): we share information with vendors that help us operate the Service, including cloud hosting and content-delivery providers, AI providers, payment processors, email/communication providers, and analytics providers. These parties are permitted to use the information only to perform services for us.
• Meta: to operate the automations you configure, the Service interacts with Meta's platform through your Facebook App. Data obtained from Meta is used only as permitted by Meta's Platform Terms and Developer Policies.
• Legal and safety: we may disclose information if required by law, subpoena, or legal process, or to protect the rights, property, or safety of us, our users, or others.
• Business transfers: if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.
• With your direction or consent: where you ask us to share information or otherwise consent.

6. Meta Platform Data

The Service accesses Meta data through the permissions you grant to your own Facebook App. We use, store, and transmit Meta data only as necessary to provide the Service and only as permitted by Meta's Platform Terms, Developer Policies, and applicable data-use requirements. We do not use Meta data to build or augment user profiles for advertising, and we do not sell or license Meta data. If your membership ends or you disconnect a Page, we handle the associated Meta data as described in Section 9. mentionxyz.com is not affiliated with or endorsed by Meta.

7. Legal Bases for Processing (EEA/UK)

Where the EU or UK GDPR applies to our processing of Member data, we rely on the following legal bases: performance of a contract (to provide the Service you request); legitimate interests (to secure, analyze, and improve the Service, where not overridden by your rights); consent (where required, such as for certain cookies or communications); and legal obligation (to comply with applicable law). For Recipient data, the Member is responsible for establishing the appropriate legal basis.

8. Cookies and Tracking

We use cookies and similar technologies to operate the Service, keep you signed in, remember preferences, and analyze usage. You can control cookies through your browser settings, though disabling some cookies may affect functionality.

9. Data Retention

We retain Member information for as long as your account is active and as needed to provide the Service, and thereafter as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. We retain and delete Recipient data in accordance with the Member's instructions and our Terms; when your membership ends or you disconnect a Page, associated Recipient and Meta data is deleted or de-identified within a commercially reasonable period, except where retention is required by law. You may request deletion as described in Section 11.

10. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, or misuse. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials.

11. Your Privacy Rights

Depending on where you live, you may have rights over your personal information. For Recipient data, direct your request to the Member who controls it; we will assist that Member as their processor. For Member data that we control, you may have the rights described below.

11.1 U.S. state privacy rights (including California)

Subject to applicable law, you may have the right to: know/access the personal information we hold about you; correct inaccurate information; delete your information; and opt out of the "sale" or "sharing" of personal information or of targeted advertising. We do not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising these rights. You may also designate an authorized agent to make a request on your behalf.

11.2 EEA/UK rights (GDPR)

Subject to applicable law, you may have the right to access, rectify, erase, restrict, or object to processing of your personal information, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

11.3 How to exercise your rights

To make a request, contact us at care@mentionxyz.com. We will verify your request as required by law and respond within the timeframe applicable to your jurisdiction.

12. Member Responsibilities

If you are a Member, you act as the controller of your Recipients' personal information. You are responsible for: maintaining your own privacy policy; providing all required notices to Recipients; obtaining any consent or establishing any lawful basis required to collect, message, and follow up with Recipients; honoring Recipient opt-outs and privacy-rights requests; and complying with Meta's policies and all applicable privacy, anti-spam, and electronic-messaging laws. You agree that your use of the Service will comply with these obligations.

13. Children's Privacy

The Service is intended for businesses and users aged 18 and older. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

14. International Data Transfers

We are based in the United States, and we and our service providers may process information in the United States and other countries. Where required, we implement appropriate safeguards for cross-border transfers of personal information. By using the Service, you understand that your information may be transferred to and processed in countries whose data-protection laws may differ from those of your jurisdiction.

15. Third-Party Links and Services

The Service may link to or integrate with third-party sites and services (including Meta). We are not responsible for the privacy practices of those third parties, and this Policy does not apply to them. Review their privacy policies before providing information.

16. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the "Last updated" date and provide notice as required by law. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

17. Contact Us

If you have questions about this Policy or wish to exercise your rights, contact:
Mention XYZ, Email: care@mentionxyz.com

mentionxyz.com is not affiliated with or endorsed by Meta Platforms, Inc. Facebook and Messenger are trademarks of Meta.