1. Who operates this service
Sound Thought LLC operates SelectBNBs Media, the business-facing service for property owners and partners. The traveler-facing SelectBNBs catalog at www.selectbnbs.com is a separate consumer surface with its own browsing and marketing disclosures.
2. Information you provide
We receive information you choose to send in an inquiry, owner application, or support email, such as your name, business email, property details, links, and selected account settings. Passwordless sign-in uses your email address and a short-lived authentication session.
3. Connected Meta accounts and approved actions
When an owner connects an Instagram professional account, we use Meta's Instagram Login API. The initial comment-to-private-reply feature requests only instagram_business_basic and instagram_business_manage_comments. When the feature is configured and enabled for an approved campaign, we use them to identify the connected account and its selected media, receive or read comments on that account, match an owner-approved keyword rule, and send one approved initial private reply to an eligible comment.
When an owner connects Facebook Pages, we request pages_show_list, pages_read_engagement, and pages_manage_posts. These permissions let the owner select Pages they manage, let us read the selected Page and its published content for service delivery and reporting, and permit publishing only content the owner has separately approved. When an owner connects Threads, we request threads_basic and threads_content_publish to identify the connected profile and publish separately approved content. Connecting an account does not itself publish a post or send a message.
For connected-account features we may process:
- the connected Instagram account, Facebook Page, or Threads profile ID, display name, permission grant, and token expiry;
- selected media IDs, permalinks, captions, and owner-approved campaign settings;
- comment and commenter IDs, username, provider timestamp, and comment text long enough to evaluate the rule;
- event and content hashes, match result, reply version, attempt status, and Meta response reference; and
- account-disconnect, authorization, and duplicate-suppression evidence needed to prevent an unintended repeat.
The webhook receiver verifies Meta's signature before processing. It does not retain the raw webhook envelope or raw comment text after matching. IDs, hashes, usernames, and timestamps can still identify or relate to a person, so we treat them as personal data. This permission bundle does not provide a general inbox, read unrelated private-message history, or authorize an automated follow-up after the recipient has not replied.
4. Website and operational data
Our hosting provider may process standard request logs such as IP address, requested path, browser information, and request time for delivery, security, and troubleshooting. The public consultation form submits the details you enter to our customer relationship system and notifies the SelectBNBs hi and Alo inboxes so we can respond. Authenticated owner tools may store the account and draft information needed to provide the service.
5. How we use and disclose information
We use information to provide the requested service, secure accounts, prevent duplicate replies, troubleshoot delivery, respond to deletion requests, and comply with law. We do not sell personal information. Data is transmitted to Meta to authorize and perform the requested operation on Instagram, Facebook, or Threads. Hosting, database, and transactional-email vendors may process the limited data needed to run those parts of the service. We may also disclose information when law requires it.
6. Storage, security, and current retention boundary
Social access tokens are encrypted at rest and access is limited to the service processes and authorized operators that need them. Disconnecting stops new use of the grant and cancels queued work that has not been attempted. A verified Meta deletion callback removes the matching live social connection, token, OAuth state, campaign, routed comment observation, and pending-work records. Minimum one-way reply-suppression hashes remain only until their existing expiry so reconnecting cannot cause a duplicate reply. Unrouted content-free webhook hashes cannot safely be attributed to one provider subject and expire under their configured erase-after value. We do not use suppression or audit records for marketing.
Selective erasure from existing encrypted database backups is not implemented; prior copies age out through the existing backup lifecycle. Meta controls information retained in Meta systems. The product does not publish a numeric operational retention period that Cameron has not approved, and general client automation remains disabled pending that decision and the remaining Meta eligibility gates.
7. Your choices and rights
You can disconnect a connected Meta account from the owner connection screen, remove the app in the applicable Meta account settings, or ask us to pause future processing. You may request access, correction, or deletion by emailing hi@selectbnbs.com. We will verify the account safely, explain the records in scope and any lawful or security-related limits, and provide the expected processing time. See our data-deletion instructions.
8. International processing and changes
Sound Thought LLC operates from the United States. Providers may process data in other countries. We will update this page before materially expanding the data or permissions used by this service and will change the date shown above.
9. WhatsApp guest-enquiry assistant (in development)
Sound Thought LLC is developing SelectBNBs Guest Messaging, an AI-assisted service that answers guest questions about a stay on a hospitality business's WhatsApp number. The current prototype uses only Meta's test WhatsApp Business Account and replies only to our own approved testers. No client business accounts are connected, and we do not yet answer real guests.
When a tester messages the prototype, we receive their message and WhatsApp number from Meta. To write a reply, our server sends the message and up to the last eight turns of that conversation to OpenRouter, which passes them to Fireworks AI's US service to run the AI model. Both process this data under their own terms and policies; we have not yet verified their retention settings for this integration. The running service keeps those recent turns in memory only and does not write message text to its logs or storage. Separately, our App Review screen recordings contain test messages and replies, and our development assistant has processed test messages. We keep message and template IDs and delivery records from our tests.
We also store the integration's access credentials, WhatsApp Business Account and phone-number identifiers, message-template details and status, and our tester's phone number on our server, which is hosted by Hostinger. The server's configuration file, including these credentials and identifiers, is copied every night into a server backup on a private Google Drive (Google), which keeps the last seven nights. Test records containing message and template IDs are kept in a private GitHub repository. We use Codex (OpenAI) and Claude (Anthropic) to develop and operate the prototype. Codex has processed app and template metadata and test identifiers; Claude has also processed our tester's phone number and test message content.
We have not yet set a retention period for these test records. We will set one, and update this section, before we connect any client business or answer real guests. The access-token encryption, account disconnection and automatic deletion controls described in section 6 for Instagram, Facebook and Threads are not implemented for WhatsApp.
To ask about our WhatsApp test information, or to have it deleted, email hi@selectbnbs.com with the subject WhatsApp test data request. Deleting our records does not retract a message already delivered through WhatsApp.