This Privacy Policy explains how Osabox Limited (“Osabox Limited”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you visit our website or use SureWyse (the “Service”). Please read it together with our Terms of Use.
1. Who we are
SureWyse is a social media analytics and client-reporting service for agencies and businesses. It is owned and operated by Osabox Limited.
For personal information about you and your team that we collect to run your account, Osabox Limited is the data controller. For data about the Facebook Pages and clients you connect to the Service, you (our customer) decide what is connected and why, and we process that data on your behalf as a data processor, under your instructions and these terms.
2. Scope of this policy
This policy applies to our website, the Contact page, the SureWyse web application and related support. It does not apply to third-party websites or services, such as Facebook, that we link to or integrate with; their own privacy policies apply.
3. Information we collect
Information you give us
Account details: your full name, email address, agency or business name, chosen plan, and a password. Passwords are stored only as a one-way cryptographic hash; we cannot read them. Password reset links are single-use and expire.
Client and workspace details: client names and the assignment of Facebook Pages to clients that you set up in the Service.
Billing details: your plan, subscription dates, and records of payments (amount, currency, date, method such as bank transfer or mobile money, and a payment reference). We do not store full card numbers.
Enquiries: when you use our Contact page we collect your name, email address, optional company name, topic, subject and message, so that we can reply.
Support communications: the content of emails and other messages you send us.
Information collected automatically
Security and activity logs: sign-in times, actions taken in the account (for example connecting Facebook, generating a report or changing a plan), and the IP address associated with those actions.
Sign-in protection: failed sign-in attempts, recorded with a hashed form of the email address and the IP address, used to block password-guessing attacks.
Contact form protection: a keyed, one-way hash of your IP address and your browser’s user-agent string, used to stop spam and abuse of the Contact page.
Device and browser information: technical information your browser sends with each request, such as browser type, used to deliver and secure the Service.
Information from third parties
Facebook: when you connect Facebook, we receive data from Meta Platforms, Inc. (“Meta”) as described in the next section.
4. Facebook and Meta data
You can choose to connect a Facebook account using Facebook Login. We request only the permissions needed to read Page analytics, which currently are pages_show_list, pages_read_engagement and read_insights. With your authorisation we access:
the list of Facebook Pages you manage, with their names, IDs and categories;
posts published on the Pages you connect, including post text, links, publish times and engagement counts;
Page Insights metrics, such as follows, content views and post engagements;
your Facebook user ID, the permissions you granted, and access tokens issued by Meta.
We only read data. SureWyse does not post, comment, message, advertise or make any change on your Facebook account or Pages.
Access tokens are encrypted at rest using AES-256-GCM, are never displayed in your browser, and are used only to fetch the data above for the Service.
We use data received from Meta only to provide the analytics and reports you request. We do not sell it, use it for advertising, use it to build profiles of individuals, or transfer it to data brokers. Our use of this data complies with Meta’s Platform Terms and Developer Policies. You can remove SureWyse’s access at any time in your Facebook settings under Settings & privacy → Settings → Business integrations, or by contacting us (see Deleting your data).
SureWyse is not affiliated with, endorsed or sponsored by Meta Platforms, Inc.
5. How we use information
To provide the Service: creating and managing your account, connecting Pages, syncing data, displaying dashboards and generating PDF reports.
To manage billing: running free trials, recording payments and managing subscriptions.
To communicate with you: replying to enquiries and support requests, and sending service messages such as trial, billing, security or policy notices.
To keep the Service secure: preventing fraud, spam, abuse and unauthorised access, and investigating security incidents.
To improve the Service: understanding how features are used, fixing errors and planning improvements, using aggregated or de-identified information where possible.
To meet legal obligations: keeping financial records, responding to lawful requests and enforcing our Terms of Use.
We do not sell personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.
6. Legal bases for processing
Where data protection law requires a legal basis, we rely on:
Contract — to provide the Service you signed up for and manage your account and billing;
Consent — when you connect Facebook or send us an enquiry. You can withdraw consent at any time, without affecting processing that already took place;
Legitimate interests — to secure the Service, prevent spam and abuse, and improve our product, balanced against your rights;
Legal obligation — to keep records required by tax, accounting and other laws.
7. How we share information
We share personal information only as follows:
Within your workspace: members of your agency account can see the Pages, data and reports in that workspace.
Service providers: companies that host our servers and databases, send our service emails (such as password reset links), and deliver website assets such as fonts and stylesheets (for example Google Fonts and the jsDelivr content network, which receive your IP address when your browser loads those files). If enabled, Cloudflare Turnstile is used on the Contact page to tell people and bots apart. These providers may only use information to provide services to us.
Meta: when you use Facebook Login and when we request data from Meta’s APIs on your behalf.
Legal and safety: when required by law, court order or a lawful request from authorities, or to protect the rights, property or safety of Osabox Limited, our users or others.
Business transfers: as part of a merger, acquisition, financing or sale of assets, in which case this policy will continue to protect your information or you will be notified of any change.
8. International transfers
Our service providers and Meta may process information in countries other than the one you live in, which may have different data protection laws. Where required, we use appropriate safeguards, such as contractual protections, for these transfers.
9. How long we keep information
Account and workspace data — for as long as your account is open. After closure we delete or anonymise it within 90 days, except as described below.
Facebook data and tokens — until you disconnect a Page or Facebook account, remove our app in Facebook, or close your account; then deleted within 30 days.
Billing and payment records — for the period required by tax and accounting law (typically up to 7 years).
Security logs — up to 12 months; failed sign-in records are cleared after a successful sign-in.
Contact enquiries — up to 24 months after the enquiry is resolved, then deleted; messages identified as spam may be deleted sooner.
Backups are overwritten on a rolling schedule, so deleted data may persist in backups for a limited period before it is removed.
10. How we protect information
We use administrative, technical and organisational measures appropriate to the risk, including encrypted HTTPS connections, encryption of Facebook access tokens at rest, hashed passwords, protection against cross-site request forgery, rate limiting of sign-in and contact forms, role-based access within workspaces, and restricted administrative access with activity logging. No system is completely secure; if we become aware of a breach affecting your personal information we will notify you and the relevant authorities where the law requires.
You are responsible for keeping your password confidential and for the people you give access to your workspace.
11. Cookies and local storage
We use a small number of strictly necessary technologies and no advertising or third-party tracking cookies:
Session cookie (socialmetric_session) — keeps you signed in and protects forms against forgery. It expires when you close your browser or sign out.
Local storage — remembers display preferences such as light or dark theme and whether the sidebar is collapsed. This stays on your device.
Cloudflare Turnstile (if enabled on the Contact page) — may set technical data needed to tell people and bots apart.
Because these are necessary for the Service to work, they do not require consent in most jurisdictions. You can clear them in your browser settings, but parts of the Service may stop working.
12. Your rights and choices
Depending on where you live, you may have the right to:
access the personal information we hold about you and receive a copy;
correct inaccurate or incomplete information;
delete your information;
restrict or object to certain processing, including processing based on legitimate interests;
receive your information in a portable format;
withdraw consent, for example by disconnecting Facebook; and
lodge a complaint with your local data protection authority.
To exercise these rights, use our Contact page (choose “Privacy & data requests”) or email privacy@surewyse.com. We will respond within 30 days, and may need to verify your identity first. If your request concerns client data that an agency controls, we may refer you to that agency and assist them in responding.
13. Deleting your data
You can request deletion of your account and all associated data, including data received from Facebook, at any time:
Send a request through our Contact page with the topic “Privacy & data requests”, or email privacy@surewyse.com from the address on your account.
Tell us whether you want to delete your whole account or only specific Facebook Pages or data.
We will confirm your request, complete deletion within 30 days, and email you once it is done.
You can also remove SureWyse from your Facebook account settings at any time, which stops all further access to your Facebook data. Information we must keep by law, such as payment records, is retained only for the required period and then deleted.
14. Children
The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will delete it.
15. Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above and, for material changes, notify account holders by email or in the Service before the change takes effect.
16. Contact us
If you have questions about this policy or how we handle your information, contact Osabox Limited: