Your customers’ conversations
People who wrote to your business and never heard of us. This is the one that matters most, and every retention and erasure rule on this page exists because of it.
SECURITY AND PRIVACY
Checked against the code, not just published
Tend answers messages from people who never chose us, so the standard is not a page of assurances. Everything below is written down internally first, tested, and only then said out loud. Where something is not done yet, it is not on this page.
WHAT WE HOLD
Three things, in the order that a breach would hurt
Your Meta access tokens
The permission you grant when you connect Facebook, Instagram or WhatsApp. We never receive or store your Meta password, and a token is never shared between accounts.
The model key that writes the replies
Ours, not yours. It lives outside the configuration file, and it is the only one of the three whose loss costs money rather than trust.
WHAT IS ENFORCED
The protections a customer of yours is relying on
- One business cannot see anotherEvery query filters on the account it belongs to, and a normal session cannot ask for someone else’s data by changing a value in the address bar.
- Logins are hard to grindPasswords are compared in constant time, repeated failures lock the source out, and two factor authentication is available on the portal.
- Sessions expire and stay in the browserShort lived tokens, HttpOnly, SameSite and Secure, swept on a clock. Completing a password reset ends every live session on that account.
- Every platform callback is verified before it is readIncoming webhooks are checked against Meta’s signature over the raw body. A bad signature is dropped before anything is parsed.
- Every change is written downThread state, settings, memory edits, channel connections, account changes and every login, successful or not. Who, what, when and from where.
- Requests are capped and rate limitedBoth the portal and the public webhook. Size limits are measured on the wire rather than trusted from a header.
- The browser is told to allow nothing by defaultA strict content security policy, no framing, no referrer leakage, no content sniffing, HTTPS enforced. Pages are built without ever pasting untrusted text into markup.
- Backups are encrypted before they touch the diskWith no key configured the backup refuses to run rather than write a readable copy. The server can create archives it cannot itself open.
- A message is input, never an instructionText from a stranger cannot tell Tend what to do. An attempt to steer it escalates the conversation to you instead of complying.
Exact limits, internal names and the specific weaknesses that have been closed stay in the internal record. Publishing them would help the wrong reader more than the right one.
THE PROMISE WITH TEETH
It cannot quote a price you never gave it
Refusing to invent an answer is the product, so it is not left to the model’s good behaviour. Replies are checked after they are written and before they are sent, and a figure that does not appear in your own memory file is blocked, whether it arrives as a symbol, a unit, a magnitude word or a bare number. If someone talks Tend into offering a discount, the reply never leaves the building.
HOW LONG ANYTHING IS KEPT
Retention, and the part most policies leave out
Message content is deleted after 180 days
On a clock, by a job that runs, and it reaches every copy of the text rather than the obvious one.
Every backup is deleted 90 days after it is taken
A retention promise that ignores backups is not a promise. Content you asked us to erase can sit in an encrypted archive until that window closes, and then it is gone with the archive.
To have your data erased, emailsupport@doyourownads.comfrom the account you messaged with, use the deletion route Meta offers inside the app settings, or ask the business you were talking to. The full policy is in theprivacy policy.
WHO ELSE SEES IT
The full list, including the one that is easy to forget
- AnthropicWrites the reply text. The conversation is sent to the model to be answered.
- Meta PlatformsThe messages already live on Facebook, Instagram and WhatsApp. Replies go back through their own interfaces.
- CloudflareServes this site and sits in front of the service.
- GoogleEscalation alerts reach a business owner by email, and that email carries the customer’s quoted message.
Nobody else. Your conversations are not sold, not shared with other businesses, and not used to train a model for anyone but you.
LIMITS WE DO NOT MOVE
What Tend will never do, whoever asks
- It only replies. It never messages anyone first.
- No bulk blasts, no broadcast campaigns, no cold outreach.
- It works inside the 24 hour reply window the platforms allow.
- WhatsApp history starts at install. It cannot read chats from before.
- Abusive messages get silence, never a reply in your name.
Found something?
Write to support@doyourownads.comand it reaches a person. A report about someone else’s data gets answered the same day.