1. Who operates this service
Sound Thought LLC operates SelectBNBs Media, the business-facing service for property owners and partners. The traveler-facing SelectBNBs catalog at www.selectbnbs.com is a separate consumer surface with its own browsing and marketing disclosures.
2. Information you provide
We receive information you choose to send in an inquiry, owner application, or support email, such as your name, business email, property details, links, and selected account settings. Passwordless sign-in uses your email address and a short-lived authentication session.
3. Instagram account connection and comment replies
When an owner connects an Instagram professional account, we use Meta's Instagram Login API. The initial comment-to-private-reply feature requests only instagram_business_basic and instagram_business_manage_comments. When the feature is configured and enabled for an approved campaign, we use them to identify the connected account and its selected media, receive or read comments on that account, match an owner-approved keyword rule, and send one approved initial private reply to an eligible comment.
For this feature we may process:
- the connected Instagram account ID, username, permission grant, and token expiry;
- selected media IDs, permalinks, captions, and owner-approved campaign settings;
- comment and commenter IDs, username, provider timestamp, and comment text long enough to evaluate the rule;
- event and content hashes, match result, reply version, attempt status, and Meta response reference; and
- account-disconnect, authorization, and duplicate-suppression evidence needed to prevent an unintended repeat.
The webhook receiver verifies Meta's signature before processing. It does not retain the raw webhook envelope or raw comment text after matching. IDs, hashes, usernames, and timestamps can still identify or relate to a person, so we treat them as personal data. This permission bundle does not provide a general inbox, read unrelated private-message history, or authorize an automated follow-up after the recipient has not replied.
4. Website and operational data
Our hosting provider may process standard request logs such as IP address, requested path, browser information, and request time for delivery, security, and troubleshooting. The public consultation form prepares an email in your own mail application; it does not submit that form to our server by itself. Authenticated owner tools may store the account and draft information needed to provide the service.
5. How we use and disclose information
We use information to provide the requested service, secure accounts, prevent duplicate replies, troubleshoot delivery, respond to deletion requests, and comply with law. We do not sell personal information. Data is transmitted to Meta to authorize and perform the requested Instagram operation. Hosting, database, and transactional-email vendors may process the limited data needed to run those parts of the service. We may also disclose information when law requires it.
6. Storage, security, and current retention boundary
Social access tokens are encrypted at rest and access is limited to the service processes and authorized operators that need them. Disconnecting stops new use of the grant and cancels queued work that has not been attempted. A verified Meta deletion callback removes the matching live social connection, token, OAuth state, campaign, routed comment observation, and pending-work records. Minimum one-way reply-suppression hashes remain only until their existing expiry so reconnecting cannot cause a duplicate reply. Unrouted content-free webhook hashes cannot safely be attributed to one provider subject and expire under their configured erase-after value. We do not use suppression or audit records for marketing.
Selective erasure from existing encrypted database backups is not implemented; prior copies age out through the existing backup lifecycle. Meta controls information retained in Meta systems. The product does not publish a numeric operational retention period that Cameron has not approved, and general client automation remains disabled pending that decision and the remaining Meta eligibility gates.
7. Your choices and rights
You can disconnect Instagram from the owner connection screen, remove the app in Instagram's Apps and Websites settings, or ask us to pause future processing. You may request access, correction, or deletion by emailing hi@selectbnbs.com. We will verify the account safely, explain the records in scope and any lawful or security-related limits, and provide the expected processing time. See our data-deletion instructions.
8. International processing and changes
Sound Thought LLC operates from the United States. Providers may process data in other countries. We will update this page before materially expanding the data or permissions used by this service and will change the date shown above.