Privacy policy
KiteLead is a connector that delivers leads from Facebook and Instagram Lead Ads to the Odoo database of the business that connected it. This policy explains what the connector processes and why.
What we process
- Facebook Page access tokens for the Pages a business chooses to connect, so we can receive and read that Page's leads. Tokens are encrypted at rest.
- The Facebook user ID of the person who connected the Pages, so we can honour deauthorization and deletion requests.
- Lead answers submitted on the business's lead forms. We fetch them from Meta and forward them to that business's Odoo database. We do not store lead answers; we keep only the lead ID, Page ID, form ID and delivery status, for up to 30 days, to avoid duplicates and to retry failed deliveries.
- The address of the Odoo database the leads are delivered to.
How we use it
Only to deliver each lead to the Odoo database its Page is connected to. We do not sell, rent or share this data, use it for advertising, or combine it with other data.
Who controls the lead data
The business that owns the Page and the Odoo database is the controller of its leads. Once a lead is in that business's Odoo database it is governed by that business's own privacy policy.
Retention
- Delivery records: 30 days.
- Page access tokens: until the connection is removed in Odoo, the app is removed on Facebook, or deletion is requested, after which they are deleted immediately.
- Records of removed connections (without tokens): 90 days.
Security
All traffic uses HTTPS. Tokens and connection secrets are encrypted with AES-256-GCM. Every delivery to Odoo is signed, and every notification from Meta is signature-checked.
Your choices
You can remove KiteLead at any time from Odoo (Disconnect), or on Facebook under Settings → Business integrations. See data deletion for how to have your data deleted.
Contact
Questions about this policy: kitelead@erpplus.net.