Legal
Privacy policy
Last updated 30 July 2026
What this policy covers
Bulk Interact is a Chrome extension and a website that let a Facebook Page admin scan their own Page inbox for leads and send a personalised message to those leads in bulk. This policy explains what we collect when you use either part, why we collect it, who else sees it, and what you can do about it.
It applies to everything we operate under the Bulk Interact name. It does not apply to Facebook or Messenger themselves, which are run by Meta Platforms, Inc. under their own terms and their own privacy policy.
Account and session information
When you sign up or log in we collect your email address and a password. Your name is optional. Your password is stored only as a hash, never as plain text, which means we cannot read it and cannot recover it for you.
When you sign up, log in, or refresh a session we also record your IP address and your browser user-agent. We issue authentication tokens that are stored in your browser and in the Chrome extension so that you stay signed in between visits.
What we receive from Facebook
When you connect Facebook we receive and store your Facebook user ID, your name, your email address if Facebook provides one, your profile image URL, and access tokens. For each Page you administer we store the Page ID, name, category, image URL and Page access token, along with which Page you have selected as active.
We ask Facebook for only the permissions the product needs to function:
pages_show_list — to list the Pages you manage so you can choose one
pages_messaging — to send messages from a Page you administer
business_management — to resolve Pages that are held inside a Business account
Inbox leads
When you run a scan we store one row for each one-to-one conversation in your Page inbox: the contact’s Facebook messaging ID, their display name where Facebook provides one, the conversation ID, and the status fields the product needs — when they were last scanned, the outcome of the last send, any error Facebook returned, and when a message was last sent to them.
We do not store your conversation history, and we do not store the content of the individual messages those people have exchanged with your Page.
Campaigns, message content, and files
When you create a campaign we store the message template you wrote, any image you attached, the content type, the send counts, and the campaign status. The message is personalised and delivered inside your own browser, so what we keep is the template you wrote and the outcome for each recipient — not a copy of every individual message that went out.
Campaign images and any payment-proof images you upload are stored with our file-storage provider, Cloudflare R2.
Payments, trial, and subscription records
If you pay for access we collect the blockchain transaction ID you submit, the invoice behind it — invoice number, amount, currency, network and status — any payment-proof screenshot you upload, and our review notes, including the reason if a payment is rejected.
We never see or store card or bank details. Payment is made manually in USDT on the TRON network to a wallet address we publish, and nothing is charged automatically.
We also store when your trial started and ended, your trial message limit and how much of it you have used, whether trial access is blocked because the same Facebook account has already had a trial, and the date your paid access runs until.
What stays in your browser
While the extension is running on Facebook it reads parts of your live Facebook session — the c_user cookie and the fb_dtsg token — so that a scan or a send is made as you, from your own signed-in session. That data is used locally in your browser for those actions alone. It is never transmitted to us and never stored on our servers.
This is also why sending runs in your browser rather than on our servers. Your Facebook session never leaves your machine, and your Page’s message traffic is never pooled with anyone else’s.
What we never collect
To be explicit, none of the following is ever collected or stored by us:
Card, bank, or crypto wallet credentials
Your Facebook password
The contents of the conversations in your Page inbox
Data from Facebook accounts or Pages you have not connected
Your Facebook session cookies, which stay in your browser
How we use what we collect
We use it to run the product, and for nothing else: to create and secure your account, to show you your Pages and your leads, to send the campaigns you build, to count messages against your trial or your paid access, to review a payment you have submitted, to reply when you email support, and to detect abuse — including the check that stops one Facebook account being used for repeated free trials.
We do not sell your data. We do not share it with advertisers or data brokers. We do not use your leads or your campaign content to market anything to anyone.
Who we share it with
Your data reaches these parties only, and only for the reason listed:
Meta Platforms, Inc. — a scan or send is a request made to Facebook using your own session, so the request necessarily reaches Facebook
Cloudflare — stores the campaign images and payment-proof images you upload
Our hosting and database provider — runs the application and holds the records described above
A public authority, if we ever receive a legally valid demand we are obliged to answer
Beyond that, no one.
How long we keep it
Account, Page, lead, campaign, and invoice records are kept for as long as your account exists, because they are what the product shows you. Session records and tokens expire on their own — a signed-in session lasts up to fifteen days, and the token the extension carries lasts twelve hours.
Where the law requires us to retain a record of a payment for accounting purposes, we keep the minimum needed to satisfy that obligation and nothing more.
Deleting your data
You can have your data deleted at any time. Email support@bulkinteract.com from the address on your account and ask for deletion. We will remove your account, your connected Facebook account and Pages, your stored leads, your campaigns and their images, and your payment proofs, and we will confirm when it is done. We aim to complete this within 30 days.
You can also disconnect Bulk Interact from Facebook yourself at any time, in Facebook under Settings and then Business Integrations. That immediately revokes our access to your Pages. It does not on its own delete the lead and campaign data already stored with us, so email us as well if you want that removed too.
Security
Your password is stored only as a hash. Refresh tokens are stored as a hash rather than in usable form, and the tokens the website and the extension carry are short-lived and signed. Traffic between your browser, the extension, and our servers is encrypted in transit, and access to the production database is limited to the people who need it to operate the service.
No system is perfectly secure and we will not pretend otherwise. If we ever discover a breach that affects your data, we will tell you.
Your rights
Bulk Interact is governed by German law, so you have the rights the GDPR gives you. You can ask what we hold about you, get a copy of it, have it corrected, have it deleted, have our use of it restricted, object to that use, and receive your data in a portable form.
Email support@bulkinteract.com and we will action it. We do not charge for this. You also have the right to complain to a data protection supervisory authority if you think we have got something wrong.
Children
Bulk Interact is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we change this policy we will update this page and change the date at the top of it. Where a change materially affects what we collect or how we use it, we will describe that change here rather than make it silently.
Contact
Email support@bulkinteract.com. That is the only support channel we run — there is no portal, live chat, or phone line — and it reaches the people who actually build and operate Bulk Interact.