Gutenberg: paste the whole thing into an empty page (the ## become Heading blocks, - become lists). Then make the two link phrases at the bottom — Terms of Service and Data Deletion — actual hyperlinks (select text → link button) to the URLs shown.
Privacy Policy — Meta CRM Integration (CM Lead Connect)
Last updated: 27 June 2026
1. Who we are
Caisse Manager is a point‑of‑sale and business‑management software provider based in Rabat, Morocco. Within our CRM module we operate the CM Lead Connect integration, which lets our business customers (“Merchants”) connect their own Facebook Pages, Instagram professional accounts and Facebook Lead‑Ad forms to manage their customer conversations and leads inside our platform.
This policy explains how CM Lead Connect handles personal data obtained through the Meta Platforms (Facebook, Messenger, Instagram).
2. Our role
For the data of a Merchant’s own customers — people who message the Merchant’s Page or Instagram account, or who submit the Merchant’s Lead‑Ad forms — the Merchant is the data controller and Caisse Manager acts as a service provider (processor) on the Merchant’s behalf and instructions. Each Merchant connects only assets they own or are authorised to manage.
3. Information we access through Meta Platforms
Only after a Merchant explicitly connects their assets and grants permission, CM Lead Connect may access:
- Connection data: the Merchant’s authorised Pages, Instagram accounts, ad accounts and business assets, and the access tokens needed to operate the integration.
- Messaging data (Messenger & Instagram): the sender’s name and profile picture, platform identifiers (PSID, IGSID, id, ids_for_business), message content, attachments and timestamps for conversations sent to the Merchant’s connected assets.
- Lead‑Ad data: the fields a person submits in the Merchant’s Lead‑Ad forms (such as name, email, phone and any custom fields the Merchant configured).
- Page data: Page metadata and engagement information needed to operate the inbox and integration.
- Ads data (where the Merchant uses ad features): campaign and performance/insight data from the Merchant’s connected ad accounts.
We request only the minimum data needed for the features the Merchant uses.
4. How we use this data
- Display the sender’s name and profile picture and the conversation in the Merchant’s unified inbox and contact records, so the Merchant can recognise and reply to the person.
- Use platform identifiers (id, ids_for_business, PSID, IGSID) to match the same person across the Merchant’s connected assets into a single contact and avoid duplicates.
- Deliver Lead‑Ad submissions into the Merchant’s CRM as contacts and leads for follow‑up.
- Let the Merchant send replies and, where applicable, view ad performance.
- Maintain, secure and improve the service. Any analytics used for product improvement, marketing or advertising rely only on aggregated, de‑identified or anonymised information that cannot be re‑identified.
We do not sell personal data, and we do not use personal data obtained through the Meta Platforms for our own advertising.
5. Legal bases
We process this data based on the Merchant’s instructions and contract with us, the consent obtained at connection time, and our legitimate interest in operating the service — consistent with applicable law, including Morocco’s Law No. 09‑08 on the protection of personal data (CNDP) and, where relevant, the EU General Data Protection Regulation (GDPR).
6. Sharing
We disclose this data only to: the Merchant that owns the connected assets; service sub‑processors (such as hosting) bound by confidentiality obligations; and as required by law. We exchange data with Meta only as needed to operate the integration and in accordance with the Meta Platform Terms and Developer Policies.
7. Retention
We retain data obtained through the Meta Platforms only as long as needed to provide the service to the Merchant, or until the Merchant disconnects the asset or a deletion request is made, after which the data is deleted or anonymised within 30 days, except where longer retention is legally required.
8. Your rights and how to request deletion
Individuals may request access to, correction of, or deletion of their personal data. Because the Merchant is the controller, requests are honoured together with the Merchant.
- To request deletion, email privacy@caissemanager.com with the subject “Meta data deletion”, or follow the steps on our Data Deletion page.
- If you used Facebook or Instagram, you can also remove CM Lead Connect from your Meta settings, which signals us to delete the data associated with your profile.
9. Security
We protect this data with encryption in transit, access controls, tenant isolation (each Merchant’s data is scoped to its own workspace) and signed webhooks.
10. Compliance with Meta
Our use of information received from the Meta Platforms complies with the Meta Platform Terms and Developer Policies, including their limitations on the use, sharing and storage of data.
11. Children
The service is intended for businesses and is not directed to children under 16.
12. Changes
We may update this policy; the “Last updated” date will change and material changes will be communicated to Merchants.
13. Contact
Caisse Manager — Av Annakhil, Rabat, Morocco · privacy@caissemanager.com
See also our Terms of Service and our Data Deletion page.