隱私權政策Privacy Policy

隱私權政策

最後更新：2026-10-28

tennnzo（tennnzo.com 及其子網域）是由不好意思股份有限公司（Excuse Me Lab，統一編號 62186614）經營的社群帳號營運平台。代理商與品牌用它管理旗下的社群帳號、在發文前審稿、查看成效。本政策說明我們處理哪些資料、為什麼處理、存放在哪裡、保留多久，以及你可以怎麼行使權利。

我們處理的資料

使用者帳號資料：登入名稱、顯示名稱、Email、所屬組織與角色、你自行上傳的頭像。密碼只以雜湊形式由登入服務保存，我們看不到明文。
通知管道：組織設定的通知管道（Email 地址、Telegram 或 LINE 的聊天編號、Webhook 網址，後者加密保存）；成員用 tennnzo 的官方 Telegram bot 接收通知時，我們保存該聊天的編號與 Telegram 顯示名稱，用來送出這位成員看得到的通知，不讀取聊天內容。連結時使用的一次性連結碼只保存雜湊值。
客戶管理的內容：人設設定、社群帳號的編號與帳號名稱、貼文草稿與已發布的貼文、圖片、審稿意見與決定。
客戶的自動化 Agent 回報的資料：排程、發布狀態、貼文連結，以及成效數字（瀏覽、互動、粉絲數）。
私域社群資料：客戶在自己的 WhatsApp 群組或 Discord 使用 AI 小幫手時，客戶的 Agent 交給我們的成員摘要（帳號 id 的雜湊值、顯示名稱、互動次數、興趣與意向標籤、一句話摘要）。我們不儲存訊息原文與電話號碼。詳見下方「私域社群資料」。
Threads 公開帳號資料：對於客戶在 tennnzo 登記、由客戶經營管理的 Threads 帳號，我們透過 Threads 官方 API（Meta 提供）依帳號名稱讀取該帳號的公開資料：帳號名稱（username）、顯示名稱、大頭貼。我們只保存大頭貼的圖檔，用來在後台顯示和平台上一致的頭像；查詢結果中的簡介與驗證標記不會保存。
連結帳號的資料：客戶把自己經營的 Threads 帳號、Facebook 粉專或 Instagram 專業帳號連結到 tennnzo 時，我們保存平台核發的存取權杖（加密後保存）、平台帳號編號與帳號名稱、粉專名稱、授權到期時間與授權範圍，以及該帳號貼文與帳號的成效數字。詳見下方「連結帳號（直接發布）」。
連結 TikTok 帳號的資料：客戶把自己經營的 TikTok 帳號連結到 tennnzo 時，我們保存 TikTok 核發的存取權杖與更新權杖（加密後保存）、TikTok 帳號編號（open_id）、帳號名稱、顯示名稱與大頭貼、授權到期時間與授權範圍，以及帳號粉絲數與公開影片的清單和成效數字。詳見下方「TikTok 連結帳號」。
連結 X 帳號的資料：客戶把自己經營的 X（前身為 Twitter）帳號連結到 tennnzo 時，我們保存 X 核發的存取權杖與更新權杖（加密後保存）、X 帳號編號、帳號名稱、顯示名稱與大頭貼、授權到期時間與授權範圍。詳見下方「X 連結帳號」。
技術資料：維持登入所需的 Cookie、記住介面偏好（例如語言、側欄開合、目前工作區）的 Cookie，以及伺服器紀錄（時間、路徑、狀態碼），用於安全與除錯。我們不使用廣告 Cookie 或第三方追蹤工具。

Threads 資料的範圍

只讀取公開資料，只讀取客戶管理的帳號。我們不讀取任何 Threads 帳號的私人資料、私訊、貼文內容或粉絲名單。
查詢使用 tennnzo 自己的官方 Threads 帳號授權進行，不需要也不保存客戶 Threads 帳號的密碼或授權。
每日更新一次，讓頭像跟著平台上的變更；客戶也可以在後台按「從 Threads 更新頭像」立即更新。
Threads 資料不出售、不出租、不用於廣告，也不提供給第三方，僅供該客戶的後台顯示。

連結帳號（直接發布）

客戶可以選擇把自己經營或有權管理的 Threads 帳號（透過 Threads 登入）、Facebook 粉專與其連結的 Instagram 專業帳號（透過 Facebook 登入），以及沒有連結粉專的 Instagram 專業帳號（透過 Instagram 登入）連結到 tennnzo。連結由帳號擁有者或管理者本人登入並同意授權，平台會清楚列出授權範圍。連結後：

我們寫入的內容：只發布客戶在 tennnzo 審稿通過、排定時間的貼文（文字、圖片、影片）與跟著貼文一起審稿通過的接續回覆（Threads 串在貼文下的回覆，Facebook、Instagram 貼文底下帳號自己的留言）、客戶的工作人員在 tennnzo 逐則核准的海巡回覆（用客戶的 Threads 帳號回覆其他人的公開貼文，文字與最多一張客戶素材庫的圖片），以及刪除客戶在 tennnzo 明確按下刪除的貼文。我們不會發布未經客戶審稿通過的內容。
我們讀取的內容：帳號編號、帳號名稱與名稱（用來確認連結的是正確的帳號）、客戶可管理的粉專清單與其連結的 Instagram 帳號（只在客戶選擇要連結哪一個的當下使用，未選的不保存）、已發布貼文的成效數字（瀏覽、讚、回覆或留言、轉發、引用、分享、收藏）與帳號粉絲數；連結後也會讀取該帳號自己過去發布的貼文清單（貼文編號、內文、連結、時間、是否有圖片或影片，不下載圖片或影片），記成客戶的已發布貼文，讓客戶看到連結以前的貼文與成效（Instagram 最多為最近 10,000 則，Facebook 粉專依平台提供的範圍）。
我們也取得讀取與管理帳號留言、回覆、提及與私訊的權限，用於內部成員的「收件匣」，詳見下方「收件匣（留言、提及與私訊）」。商品標籤、付費合作標示、合作廣告與其他廣告相關權限的用途，見下方「廣告」。
Threads 發文選項與平台通知：客戶的內部成員可以為 tennnzo 要發布的 Threads 貼文選一個地點（用該帳號向 Threads 搜尋地點，保存地點編號、名稱與地址），或選擇同時分享到該帳號連結的 Instagram 限時動態；兩者都只在發布那篇貼文時送出。平台通知該帳號在平台上直接發文或刪文時（Threads、Facebook 粉專），我們讀取那篇貼文的編號、內文、連結與時間，記成客戶的已發布貼文，或把對應的貼文標為已在平台上刪除。已發布貼文的內嵌預覽只在有人按下時，才在隔離框內載入平台提供的內嵌程式。
透過 Instagram 登入連結時：我們讀取該 Instagram 專業帳號的帳號編號、帳號名稱與帳號類型（確認是商業或創作者帳號、且是要連結的那個帳號）、已發布貼文的成效數字與粉絲數；寫入的只有發布審稿通過的貼文。我們同時取得留言管理與私訊權限，用於收件匣（見下方）。Instagram 登入的授權 60 天到期，我們會在到期前自動續期。這種連結無法由 tennnzo 刪除貼文。
從平台登入新增或連結帳號時，我們也保存該帳號在平台上的顯示名稱與大頭貼圖檔（粉專則為粉專名稱與圖片），用來在後台顯示和平台一致的帳號資訊；帳號名稱會成為該帳號在 tennnzo 的帳號名稱。大頭貼與其他平台頭像同樣保存、汰換與刪除。
連結邀請：客戶可以產生一個 24 小時內有效、只能用一次的邀請連結，交給帳號擁有者（例如合作的創作者），由對方在自己的瀏覽器登入並同意授權，客戶不會經手對方的密碼。邀請頁會顯示邀請的組織名稱與標誌、要連結的平台與授權範圍。透過邀請連結時，我們向帳號擁有者收集與上述相同的資料（帳號編號、帳號名稱、顯示名稱、大頭貼、加密後的存取權杖；用 Facebook 登入時另有其管理的粉專清單，只在對方勾選要連結哪些時使用，未勾選的不保存），並記錄邀請的使用情形：何時打開、何時開始登入、連結了哪個平台帳號（帳號名稱）、未成功時的原因與時間。我們不要求帳號擁有者註冊 tennnzo，也不保存其密碼。為了把登入結果顯示給同一個瀏覽器，我們會在對方瀏覽器設定一個 40 分鐘內有效的必要 Cookie（只存隨機值，伺服器只保存其雜湊）。邀請連結本身只以雜湊保存。
存取權杖以 AES-256-GCM 加密後保存在伺服器，解密金鑰只存在伺服器環境中；權杖不會傳到瀏覽器，也不會提供給客戶的 Agent 或其他使用者。
客戶在後台按「中斷連結」時，我們立即刪除保存的權杖並停止一切發布、刪除與讀取；帳號擁有者也可以隨時在 Threads、Facebook 或 Instagram 的設定中移除本應用程式。已讀取的成效數字屬於客戶的成效紀錄，依下方保留期間處理。
連結帳號的資料不出售、不出租、不用於廣告，也不提供給第三方。

TikTok 連結帳號

客戶可以選擇把自己經營或有權管理的 TikTok 帳號，透過 TikTok 登入（Login Kit）連結到 tennnzo。連結由帳號擁有者本人登入並同意授權，TikTok 的授權頁會列出授權範圍。連結後：

我們讀取的內容（user.info.basic、user.info.profile、user.info.stats）：TikTok 帳號編號（open_id）、帳號名稱（username）、顯示名稱與大頭貼，用來確認連結的是正確的帳號，並在後台與發布畫面顯示要發到哪個帳號；以及帳號的粉絲數，用於客戶的成效報告。我們不保存簡介與驗證標記。發布前我們也向 TikTok 查詢該帳號目前可用的隱私等級與功能限制（例如影片長度上限、是否可開放留言、合拍與拼接），只在發布畫面當下使用，不另外保存。
我們寫入的內容（video.publish）：只發布客戶在 tennnzo 審稿通過、並由客戶在發布畫面確認的影片與說明文字。隱私等級、是否允許留言／合拍／拼接，以及商業內容揭露，都由客戶在發布畫面自行選擇，我們不會預設，也不會在影片上加入浮水印或其他標記。
我們讀取的影片（video.list）：該帳號的公開影片清單（影片編號、說明文字、連結、發布時間）與這些影片的觀看、按讚、留言、分享數字，記成客戶的已發布貼文並用於成效報告。TikTok 只提供公開影片，私人影片不會讀到；我們不下載影片檔，也不讀取私訊或粉絲名單。
也可以用連結邀請：客戶把 24 小時內有效、只能用一次的連結交給帳號擁有者，由對方在自己的瀏覽器登入 TikTok 並同意授權，客戶不經手對方的密碼。收集的資料與上述相同，另記錄邀請的使用情形（見上方「連結邀請」）。
存取權杖與更新權杖以 AES-256-GCM 加密後保存在伺服器，權杖到期前由伺服器自動更新；權杖不會傳到瀏覽器，也不會提供給客戶的 Agent 或其他使用者。
客戶在後台按「中斷連結」時，我們立即刪除保存的權杖並停止一切發布與讀取；帳號擁有者也可以隨時在 TikTok App 的設定中移除本應用程式的權限。
TikTok 資料不出售、不出租、不用於廣告，也不提供給第三方，僅供該客戶的後台與報告使用。客戶使用 TikTok 相關功能時，同時適用 TikTok 的服務條款與隱私權政策。

X 連結帳號

客戶可以選擇把自己經營或有權管理的 X 帳號，透過 X 登入（OAuth 2.0）連結到 tennnzo。連結由帳號擁有者本人登入並同意授權，X 的授權頁會列出授權範圍。連結後：

我們讀取的內容（users.read、tweet.read）：X 帳號編號、帳號名稱、顯示名稱與大頭貼，只在連結當下讀取一次，用來確認連結的是正確的帳號，並在後台顯示。我們不讀取該帳號的貼文、時間軸、私訊、追蹤者名單或成效數字。
我們寫入的內容（tweet.write、media.write）：只發布客戶在 tennnzo 審稿通過、排定時間的貼文與其圖片或影片（上傳到 X 後再發文）。我們不會發布未經客戶審稿通過的內容，也不會代為按讚、轉貼、追蹤或傳送私訊。
存取權杖與更新權杖（offline.access）以 AES-256-GCM 加密後保存在伺服器，權杖到期前由伺服器自動更新；權杖不會傳到瀏覽器，也不會提供給客戶的 Agent 或其他使用者。
客戶在後台按「中斷連結」時，我們立即向 X 撤銷並刪除保存的權杖，停止一切發布；帳號擁有者也可以隨時在 X 的「設定和隱私 › 安全性和帳號存取權 › 應用程式和工作階段 › 已連結的應用程式」移除本應用程式。
X 資料不出售、不出租、不用於廣告，也不提供給第三方，僅供該客戶的後台使用。客戶使用 X 相關功能時，同時適用 X 的服務條款、開發者協議與隱私權政策。

廣告帳號：我們保存廣告帳號編號、名稱、幣別、時區、所屬企業管理平台編號、投放用的粉專（含粉專存取權杖，加密保存），以及登入者的 Facebook 帳號編號與名稱、登入的存取權杖（加密保存，約 60 天到期）。
廣告成效：每天讀取綁定的廣告帳號中各廣告活動與廣告的花費、曝光、觸及、點擊與成果，保存為每日數字，用於工作區的「廣告」頁與該專案的報告；報告發布給客戶時，客戶看得到該專案的廣告成效。我們不讀取廣告受眾中任何個人的資料。
建立與管理廣告：只依客戶成員在 tennnzo 的操作（或核准的 Agent 提案）建立加熱、合作廣告與目錄廣告；所有廣告都先以「暫停」建立，必須有人按下啟用才會開始花費，且工作區每月花費不超過組織管理者設定的上限（達到上限時自動暫停）。客戶的 Agent 只能提出調整建議，不能直接建立、啟用或改變廣告。
品牌合作：標記為業配的貼文由 tennnzo 發布到以 Facebook 登入連結的 Instagram 帳號時，會加上 Meta 的「付費合作」標示，並在專案設定了品牌時標註該品牌；品牌端的 Instagram 帳號可在 tennnzo 核准創作者、申請合作廣告授權。我們只保存品牌名稱、品牌的 Instagram 帳號編號與名稱、粉專編號，以及每篇貼文標註了哪個品牌。
潛在顧客（名單廣告）：客戶設定要轉送的名單表單收到新名單時，我們從 Meta 讀取該筆名單（表單上填寫的欄位，例如姓名、Email、電話與回答），立即轉送到客戶指定的目的地（客戶的 Webhook 網址，或 Email）。名單內容只為轉送而加密暫存：送達後立即刪除；一直無法送達的，最多保留 7 天後刪除。我們長期保留的只有每筆名單的 Meta 編號、表單、轉送目的地、轉送狀態與時間，以及筆數統計，不保留姓名、聯絡方式或回答。Webhook 以客戶的密鑰簽章；轉送後的名單由客戶依其自身的隱私權政策處理。
商品目錄：客戶在 tennnzo 建立的商品清單（商品編號、名稱、說明、價格、幣別、圖片與商品頁網址、庫存、品牌）會同步到客戶企業管理平台中的 Meta 商品目錄，用於 Instagram 商品標註與目錄廣告；我們只保存客戶輸入的商品資料、目錄編號與同步結果，以及每篇貼文標註的商品編號。
廣告相關資料不出售、不出租、不用於 tennnzo 自身的廣告，也不提供給客戶指定目的地以外的第三方。客戶可隨時解除綁定廣告帳號、停用名單轉送或刪除目的地；解除綁定時，我們刪除該廣告帳號在 tennnzo 的活動與成效數字（Meta 上的廣告不受影響）。

使用目的

提供服務：讓客戶管理帳號、審稿、排程與查看成效。
客戶選擇由 tennnzo 直接發布的帳號：在排定時間發布審稿通過的貼文、依客戶指示刪除貼文、讀取成效。
連結的 TikTok 帳號：發布客戶審稿通過並確認的影片、讀取帳號粉絲數與公開影片的成效。
連結的 X 帳號：發布客戶審稿通過的貼文、圖片與影片。
連結的帳號：在收件匣顯示該帳號收到的留言、提及與私訊，讓客戶的內部成員回覆、隱藏或刪除（每個動作都由人按下；唯一的例外是客戶設定的連結黑名單，見下方「收件匣」）。
廣告：依客戶的操作建立與管理廣告、在報告中呈現廣告成效、轉送名單、同步商品目錄。
讓後台與審稿畫面顯示各帳號在平台上目前的頭像，方便審稿人與客戶辨認帳號。
安全、防止濫用、除錯與客戶支援。
遵守法律義務。

我們不出售個人資料，也不將資料用於廣告投放或建立與服務無關的個人檔案。

資料存放與分享

資料存放於我們委託的雲端基礎設施供應商（主機、資料庫、檔案儲存），機房可能位於台灣以外的地區。這些供應商依合約只為提供服務而處理資料。除此之外，只有在法律要求或客戶指示時才會提供資料給他人。

客戶組織內的成員依角色看到不同範圍的資料；客戶端成員只看得到已整理、可對外的內容。

貼文評分：審稿中的貼文內文、該帳號的人設摘要，以及帳號所在的市場與平台名稱，會傳給我們委託的文字評分服務（TypeSafe），取回的只有介於 0 到 1 的分數，不取回任何生成的文字。分數只給客戶的內部成員參考，不會自動擋下或退回任何貼文；客戶端成員看不到分數。

表格同步：客戶選擇把審稿表格（飛書多維表格、Lark Base、Notion、Airtable、Google 試算表或釘釘 AI 表格）接上 tennnzo 時，我們依客戶的設定把貼文的帳號編號、預定日期、主題、內文、配圖、審稿狀態、審稿意見、貼文連結與發布時間寫入該表格，並讀回表格裡的審稿動作、內文與意見修改，記錄為表格最後修改人代為登記；不能上傳檔案的平台會寫入指向 tennnzo 的長效圖片連結（只有該圖片，不含其他資料）；兩邊同時修改時，表格未被採用的內容會寫入該表格的「同步衝突」欄。連線用的憑證（應用程式密鑰、integration token、personal access token、服務帳戶金鑰、AI 表格連線網址）由客戶自行輸入，以加密方式保存，不會再顯示，只在同步時解開使用。表格平台依其自身條款處理寫入的資料；客戶可隨時暫停或停用同步，停用後我們不再讀寫該表格。

收件匣（留言、提及與私訊）

客戶連結帳號後，tennnzo 會接收並保存該帳號收到的留言與回覆、提及該帳號的貼文與留言，以及該帳號的私訊（Instagram 私訊、粉專的 Messenger 私訊；客戶另外綁定 WhatsApp Business 電話號碼時，還有該號碼的 WhatsApp 對話），讓客戶的內部成員在同一個地方查看與回覆。

我們收到的內容：留言、回覆或訊息的文字、附件類型與連結、時間、所在的貼文，以及寫的人在平台上的編號、帳號名稱、名稱與大頭貼連結（平台允許提供時）。私訊只收到連結之後的新訊息。
為什麼：讓客戶回覆自己帳號收到的留言與私訊、隱藏或刪除留言。回覆一律由客戶的內部成員按下送出或核准；客戶的 Agent 只能草擬回覆，不能自己決定送出、按讚、隱藏或刪除任何內容。
連結黑名單（自動隱藏）：客戶可以設定一份網域清單（預設包含幾個購物網站的網域與短網址，客戶可增刪）。新收到的留言或提及（不含私訊與帳號自己的內容）帶有清單上網域的連結時，會自動隱藏；客戶把該網域設為刪除、且平台允許時改為刪除。我們只比對文字裡連結的網域，不分析內容的其他部分；每一次自動處理都記錄是哪一條規則、原因與結果，客戶的內部成員可以在收件匣看到，並可隨時關閉或移除規則。
客戶設成「Agent」收件的帳號：這些帳號沒有透過 tennnzo 連結平台，留言、回覆與提及由客戶自己的 Agent 讀取後交給 tennnzo 保存（收到的內容同上，不含私訊），連同留言所在貼文的連結與內文（讓客戶成員知道留言在哪篇貼文底下）；客戶內部成員核准的回覆，以及按下的按讚、收回讚、隱藏與刪除（和連結黑名單自動排定的隱藏或刪除），由客戶的 Agent 從該帳號照原樣執行。tennnzo 不會為這些帳號連到平台，只記錄誰核准或哪條規則觸發、由哪個 Agent 執行與結果。
誰看得到：只有客戶組織裡負責該工作區的內部成員；客戶端成員、其他組織都看不到。我們不會把這些內容用於廣告、不出售、不用來建立與服務無關的個人檔案。
我們寫入的內容：只有客戶內部成員在收件匣按下的回覆、私訊、隱藏、取消隱藏、刪除與按讚，以及客戶設定的連結黑名單自動執行的隱藏或刪除；每一個動作都記錄是誰（或哪條規則）、什麼時間做的。設成「Agent」收件的帳號，tennnzo 不寫入平台。
保留：收件匣的留言、提及與私訊（含草稿）保留 90 天，之後每日自動刪除。動作紀錄保留，但不含訊息內容。客戶解除綁定 WhatsApp 號碼時，該號碼的對話立即刪除。
帳號擁有者在平台上移除本應用程式時，我們會收到通知並停止使用該授權；帳號擁有者向 Meta 提出資料刪除請求時，我們立即刪除該登入的存取權杖，以及收件匣裡這些帳號的留言、提及與私訊，並提供確認碼與狀態頁。

私域社群資料

我們處理哪些資料：客戶把 AI 小幫手加進自己的 WhatsApp 群組或 Discord 後，客戶的 Agent 每天把前一天的發言整理成每位成員的摘要交給 tennnzo。我們儲存：成員在平台上的帳號 id 的雜湊值（原始 id 在我們的伺服器端轉成雜湊後才寫入資料庫，不儲存原始 id）、成員的顯示名稱、互動次數、興趣與意向標籤、一句話摘要，以及客戶內部成員標註的成員角色與工單內容。在 Discord 伺服器，客戶的 bot 另外回報成員何時加入、用的是伺服器的哪一條邀請連結（只有邀請碼，不含邀請人），讓客戶知道成員從哪個帳號或貼文過來；客戶在後台替邀請連結標上對應的帳號與貼文。
我們不儲存的：訊息原文，以及電話號碼。一句話摘要由客戶的 Agent 整理，不抄原文、不包含電話、地址或訂單號。訊息原文留在客戶 Agent 所在的主機，不在 tennnzo。我們的標準設定（以及由我們代管的 Agent）會在 30 天後刪除原文；客戶自己營運的 Agent，刪除原文是客戶依我們的 Agent 使用要求應負的責任。
群組清單：客戶的 Agent 所在的主機會回報 AI 小幫手所在的群組 id、群組名稱、最後收到訊息的時間，以及主機目前服務的群組清單，讓客戶的內部成員登記群組時用選的。這份回報不含任何訊息內容或發話人；Agent 被刪除時一併刪除。AI 小幫手擔任群管理員、替客戶刪除垃圾訊息時，主機另外回報每個群每天刪除、移除、加入與退出的次數、每次有人加入的時間（不含是誰）、群組目前的邀請碼與群組頭像，讓客戶看到群組管理成效與成員從哪條推廣連結進來（估計）。
為什麼：讓 AI 小幫手在群組裡回答成員的問題、推薦客戶上架的商品，在客訴、退款、訂單或刪除個資等情況轉給真人處理，並讓客戶了解群組成員關心什麼。
誰看得到：只有客戶組織裡負責該工作區的內部成員；客戶角色的成員與其他組織都看不到。我們不會把這些內容用於廣告、不出售、不用來建立與服務無關的個人檔案。
如何要求刪除：群組成員可以直接在群組裡請 AI 小幫手轉給真人（會開立「刪除個資」工單），或寄信到 privacy@tennnzo.com，說明你所在的群組與顯示名稱。收到刪除請求後（不論是透過客戶或「資料刪除」頁），我們會刪除與你有關的社群資料（帳號 id 雜湊、顯示名稱、互動次數、標籤、摘要、加入紀錄與相關工單），完成後通知你。也可以直接向經營該群組的客戶提出。

關鍵字監看與帳號查詢（公開內容）

客戶的內部成員可以設定關鍵字，由 tennnzo 定時透過客戶已連結的帳號搜尋平台上的公開內容：Threads 的關鍵字搜尋（公開貼文），以及 Instagram 的 hashtag 搜尋（最近 24 小時含該 hashtag 的公開貼文）；也可以用帳號名稱查詢其他 Instagram 商業或創作者帳號的公開資料（Instagram business discovery）。

我們保存的內容（只限搜尋找到的公開貼文）：平台上的貼文編號、作者的帳號名稱（Threads 才有；Instagram hashtag 搜尋不提供作者）、最多 500 字的內文摘要、貼文連結、發布時間、媒體類型、平台提供的按讚與留言數，以及對到的關鍵字。不下載圖片或影片，不保存作者的其他資料。
帳號查詢：查到的商業或創作者帳號資料（名稱、大頭貼、簡介、網站、粉絲數、貼文數與最近貼文的公開數字）只顯示給查詢的人，不保存；只有在內部成員選擇把查到的大頭貼設為客戶自己的 Instagram 帳號頭像時，才保存那一張圖。
為什麼：讓客戶的團隊掌握與自己品牌、產品、話題相關的公開討論，並以帳號名稱取得自己帳號的平台頭像。
誰看得到：只有客戶組織裡負責該工作區的內部成員；客戶端成員、其他組織都看不到。客戶的 Agent 只能讀取結果並提議監看清單，不能搜尋、留言、按讚或發文；搜尋清單須由人核准。
我們寫入的內容：沒有。關鍵字監看與帳號查詢只讀取公開內容，不在平台上發布、留言或互動。
搜尋次數：遵守平台的上限（Threads 每個帳號每 24 小時的搜尋次數、Instagram 每個帳號 7 天內的 hashtag 數），只保存每次搜尋的時間、關鍵字與結果筆數（不含內容）以計算配額，8 天後刪除。
保留：搜尋結果保留 30 天，之後自動刪除（含收藏的結果）；客戶刪除監看清單時，其結果立即刪除。這些內容不出售、不用於廣告，也不用來建立與服務無關的個人檔案。

廣告素材查詢（第三方公開資料）

客戶的內部成員（或成員明確同意後，由客戶的 Agent 代為登記）可以查詢寫廣告用的參考素材：淘寶／天貓商品的公開資料（標題、價格、規格與屬性、買家評價、買家問答），以及小紅書近期熱門筆記的標題與互動數。這些資料由第三方資料服務從公開頁面取得後提供給我們，每次查詢前都會先報價，經人同意才查詢並扣除客戶的 credit。

我們保存的內容：查到的商品標題、價格、規格、評價的文字、日期與購買規格、問答的文字、熱門筆記的標題與互動數，以及查詢的報價、同意者（姓名、在哪裡同意、時間）、扣點與結果。不保存買家或作者的暱稱、頭像、帳號編號或其他個人資料；評價只保留文字、日期與規格。
用途：只作為客戶撰寫廣告與業配內容的參考資料。內容是第三方的簡體原文，只供參考，不得照抄或轉載原文。
誰看得到：只有客戶組織裡負責該工作區的內部成員與該工作區的 Agent；客戶端成員、其他組織都看不到。查詢結果的快取只在同一個組織內共用，不跨組織。
我們提供給資料服務的內容：只有要查的商品編號或關鍵字，不提供客戶、帳號或任何個人資料。
保留：查詢紀錄與結果隨客戶的帳號資料保留，客戶的資料被刪除時一併刪除；快取的商品資料 31 天、關鍵字資料 2 天後刪除。

保留期間

客戶的帳號與內容：在客戶使用服務期間保留；客戶終止服務或要求刪除後，於 30 天內刪除。
平台大頭貼（Threads 查詢取得，或連結帳號時取得）：保留於對應帳號的資料中；平台上的頭像換新後，舊圖會標記為已汰換。帳號或人設被刪除、或收到刪除請求時一併刪除。
伺服器紀錄：只在安全與除錯需要的期間內保留。
Telegram 通知的聊天編號：保存到成員移除、在 Telegram 傳 /stop 或封鎖 bot、或離開組織為止（離開組織時自動刪除）；一次性連結碼的雜湊在過期一天後刪除。
連結帳號的存取權杖：保存到客戶中斷連結、授權失效後重新連結，或客戶終止服務為止；中斷連結時立即刪除。
TikTok 連結帳號的存取權杖與更新權杖：保存到客戶中斷連結、授權失效，或客戶終止服務為止；中斷連結時立即刪除。帳號編號、顯示名稱、大頭貼、粉絲數與公開影片的清單和成效隨客戶的帳號與內容保留。
X 連結帳號的存取權杖與更新權杖：保存到客戶中斷連結、授權失效，或客戶終止服務為止；中斷連結時立即撤銷並刪除。帳號編號、帳號名稱、顯示名稱與大頭貼隨客戶的帳號資料保留。
連結邀請的紀錄（邀請連結的雜湊、對象人設、平台、建立者、時間、使用結果與失敗原因）：作為操作紀錄隨客戶的帳號資料保留，人設或客戶的資料被刪除時一併刪除；登入過程中暫存的登入狀態在 24 小時內清除。
人設語感的整理紀錄（Looking Glass）：客戶的 Agent 依人設已發布的內容與客戶提供的材料整理出說話方式，寫回人設；我們保存每一輪的結果、上一版、使用的語料說明（種類、說明、連結、則數，不含語料原文）與時間，隨人設保留，人設或客戶的資料被刪除時一併刪除。
收件匣的留言、提及與私訊（含草稿，以及平台送來的原始通知）：保留 90 天，之後自動刪除；收到資料刪除請求時立即刪除。
私域社群資料（成員的帳號 id 雜湊、顯示名稱、互動次數、標籤、一句話摘要、工單）：在客戶使用服務期間保留；客戶終止服務後，或我們收到刪除請求後，我們會刪除並確認完成。我們不儲存訊息原文與電話號碼；原文留在客戶 Agent 所在的主機，標準設定下 30 天後刪除。
關鍵字監看找到的公開貼文：保留 30 天，之後自動刪除；搜尋次數紀錄（不含內容）保留 8 天。
海巡回覆：回覆內容與送出結果在客戶使用服務期間保留；附帶的對方貼文作者與內文摘要（給核准的人看）保留 30 天，之後自動刪除。海巡候選（客戶的 Agent 用關鍵字找到、存進來等候判斷的公開貼文：貼文 id、連結、作者、內文摘要、發文時間與 Agent 的分級）保留 30 天，之後連同內容自動刪除。
廣告帳號的存取權杖與廣告成效：保存到客戶解除綁定或終止服務為止；解除綁定時一併刪除該帳號在 tennnzo 的活動與成效數字。
名單廣告的名單內容：送達客戶指定的目的地後立即刪除；無法送達的最多保留 7 天。轉送紀錄（Meta 名單編號、狀態、時間）與筆數依客戶的帳號與內容保留。

安全

傳輸一律經 HTTPS 加密；資料依組織與角色控管存取；平台的 Threads 授權與客戶連結帳號的存取權杖只存在伺服器端（後者另以 AES-256-GCM 加密），不會傳到瀏覽器。沒有任何系統能保證百分之百安全，若發生影響你資料的事件，我們會依法通知。

你的權利

依中華民國個人資料保護法，你可以請求查詢、閱覽、複製、補充或更正、停止處理或利用，以及刪除你的個人資料。請寄信到 privacy@tennnzo.com。刪除的方式請見「資料刪除」頁。

兒童

本服務提供給企業與專業使用者，不以兒童為對象。

政策更新與聯絡我們

本政策若有重大變更，會更新本頁的日期並在服務內告知。

聯絡：不好意思股份有限公司（Excuse Me Lab，統一編號 62186614），Email：privacy@tennnzo.com。

Privacy Policy

Last updated: 2026-10-28

tennnzo (tennnzo.com and its subdomains) is a social account operations platform operated by 不好意思股份有限公司 (Excuse Me Lab Co., Ltd., Taiwan Unified Business No. 62186614). Agencies and brands use it to manage the social media accounts they run, review posts before they go out and see how they perform. This policy explains what data we process, why, where it is stored, how long we keep it and how you can exercise your rights.

Data we process

User account data: sign-in name, display name, email address, organisation and role, and a profile picture if you upload one. Passwords are kept only as hashes by the sign-in service; we never see them in plain text.
Notification channels: the notification channels an organisation sets up (email addresses, Telegram or LINE chat ids, webhook addresses, the latter stored encrypted). When a member receives notifications through tennnzo's own Telegram bot, we keep that chat's id and Telegram display name to send the notifications that member can see; we do not read the chat. The one-time link code used to connect is stored only as a hash.
Content our customers manage: persona settings, the codes and usernames of their social accounts, post drafts and published posts, images, review comments and decisions.
Data reported by our customers' automation agents: schedules, publishing status, post links and performance metrics (views, interactions, follower counts).
Community data: when a customer uses the AI assistant in its own WhatsApp group or Discord, the member summaries the customer's agent hands to us (a hash of the account id, display name, interaction count, interest and intent tags, a one-sentence summary). We do not keep message text or phone numbers. See "Community data (private groups)" below.
Threads public profile data: for Threads accounts that a customer manages and has registered in tennnzo, we use the official Threads API provided by Meta to read that account's public profile by username: username, display name and profile picture. We store only the profile picture, so the dashboard shows the same avatar readers see on Threads; the biography and verification flag returned by the lookup are not stored.
Connected account data: when a customer connects a Threads account, Facebook Page or Instagram professional account it runs to tennnzo, we keep the access token issued by the platform (encrypted), the platform account id and username, the Page name, when the authorization expires and its scope, and the performance numbers of that account and its posts. See "Connected accounts (direct publishing)" below.
Connected TikTok account data: when a customer connects a TikTok account it runs to tennnzo, we keep the access token and refresh token issued by TikTok (encrypted), the TikTok account id (open_id), username, display name and profile picture, when the authorization expires and its scope, and the account's follower count, public video list and video performance numbers. See "Connected TikTok accounts" below.
Connected X account data: when a customer connects an X (formerly Twitter) account it runs to tennnzo, we keep the access token and refresh token issued by X (encrypted), the X account id, username, display name and profile picture, and when the authorization expires and its scope. See "Connected X accounts" below.
Technical data: cookies needed to keep you signed in, cookies that remember interface preferences (such as language, sidebar state and current workspace), and server logs (time, path, status code) for security and troubleshooting. We do not use advertising cookies or third-party trackers.

Scope of Threads data

Public data only, and only for accounts our customers manage. We do not read private data, messages, post content or follower lists of any Threads account.
Lookups are made with the authorization of tennnzo's own official Threads account. We neither need nor store the passwords or authorizations of our customers' Threads accounts.
Profiles are refreshed once a day so avatars follow changes on Threads; customers can also refresh one at once with "Update avatar from Threads" in the dashboard.
Threads data is never sold, rented, used for advertising or shared with third parties. It is only shown in that customer's dashboard.

Connected accounts (direct publishing)

Customers may connect Threads accounts (with Threads login) Facebook Pages with their linked Instagram professional accounts (with Facebook Login), and Instagram professional accounts without a Facebook Page (with Instagram Login) that they run or are entitled to manage. The account owner or manager signs in and grants the authorization themselves, on a consent screen that lists what is granted. Once connected:

What we write: only posts that the customer approved in tennnzo's review and scheduled (text, images, videos) and the follow-up replies approved with them (replies under the post on Threads; the account's own comments under the post on Facebook and Instagram), patrol replies the customer's staff approved one by one in tennnzo (a reply from the customer's Threads account to someone else's public post: text and at most one image from the customer's media library), and deletions of posts the customer explicitly chose to delete in tennnzo. We never publish content that has not passed the customer's review.
What we read: the account id, username and name (to confirm the right account is connected); the Pages the person manages and their linked Instagram accounts (used only while the customer picks which to connect; those not picked are not kept); the performance numbers of published posts (views, likes, replies or comments, reposts, quotes, shares, saves) and the account's follower count. After connecting we also read the account's own list of past posts (post id, text, link, time and whether it has images or video; images and videos are not downloaded) and record them as the customer's published posts, so the customer sees the posts and performance from before the account was connected (Instagram: up to the 10,000 most recent; Facebook Pages: as far back as the platform provides).
We also obtain permission to read and manage the account's comments, replies, mentions and direct messages, for the staff "Inbox" described under "Inbox (comments, mentions and messages)" below. What the product-tag, paid-partnership, partnership-ad and other advertising permissions are used for is described under "Advertising" below.
Threads post options and platform notifications: the customer's staff can pick a location for a Threads post tennnzo will publish (searched on Threads with that account; we keep the location's id, name and address) or choose to also share the post to the Instagram account linked to that Threads account as a story; both are sent only when that post is published. When the platform notifies us that the account published or deleted a post directly on the platform (Threads, Facebook Pages), we read that post's id, text, link and time and record it as one of the customer's published posts, or mark the matching post as deleted on the platform. Embedded previews of published posts load the platform's embed code, inside an isolated frame, only when someone clicks to show them.
With Instagram Login: we read the Instagram professional account's id, username and account type (to confirm it is a business or creator account and the account being connected), the performance numbers of its published posts and its follower count; the only thing we write is the approved posts we publish. We also obtain the comment-management and messaging permissions, used by the Inbox (below). Instagram Login authorizations expire after 60 days and we renew them automatically before they do. tennnzo cannot delete posts on an account connected this way.
When an account is added or connected by signing in to the platform, we also keep the account's display name and profile picture on the platform (for a Page, its name and picture) to show the account in the dashboard as readers see it; its username becomes the account's name in tennnzo. Profile pictures are kept, replaced and deleted like other platform avatars.
Connect invites: a customer can create an invite link, valid for 24 hours and usable once, and give it to the owner of an account (for example a creator they work with), who signs in and grants the authorization in their own browser; the customer never handles the owner's password. The invite page shows the inviting organisation's name and logo, the platform and what will be authorized. Through an invite we collect from the account owner the same data as above (account id, username, display name, profile picture, the encrypted access token; with Facebook Login also the list of Pages they manage, used only while they tick which to connect, and those not ticked are not kept), and we record how the invite was used: when it was opened, when the sign-in started, which platform account (username) was connected, and the reason and time of any attempt that failed. Account owners do not need a tennnzo account and we never keep their password. To show the result of the sign-in to the same browser we set one strictly necessary cookie on it for 40 minutes (a random value; the server keeps only its hash). The invite link itself is stored only as a hash.
Access tokens are encrypted with AES-256-GCM and stored on the server; the decryption key exists only in the server environment. Tokens are never sent to a browser or given to the customer's agents or other users.
When the customer clicks "Disconnect" in the dashboard, we delete the stored token at once and stop all publishing, deleting and reading. The account owner can also remove the app at any time in their Threads, Facebook or Instagram settings. Numbers already read are part of the customer's performance records and follow the retention below.
Connected account data is never sold, rented, used for advertising or shared with third parties.

Connected TikTok accounts

Customers may connect TikTok accounts they run or are entitled to manage, by signing in with TikTok (Login Kit). The account owner signs in and grants the authorization themselves, on TikTok's consent screen that lists what is granted. Once connected:

What we read (user.info.basic, user.info.profile, user.info.stats): the TikTok account id (open_id), username, display name and profile picture, to confirm the right account is connected and to show which account a video will be posted to in the dashboard and on the posting screen; and the account's follower count, for the customer's performance reports. We do not store the biography or verification flag. Before posting we also ask TikTok which privacy levels and features are currently available to the account (such as the maximum video length and whether comments, Duet and Stitch can be allowed); this is used only on the posting screen and not stored.
What we write (video.publish): only videos and captions that the customer approved in tennnzo's review and confirmed on the posting screen. The privacy level, whether to allow comments, Duet and Stitch, and the commercial content disclosure are all chosen by the customer on the posting screen; we never preselect them, and we never add watermarks or other marks to the video.
What videos we read (video.list): the account's list of public videos (video id, description, link, posting time) and their view, like, comment and share counts, recorded as the customer's published posts and used for performance reports. TikTok only provides public videos, so private videos are never read; we do not download video files or read direct messages or the follower list.
Connect invites also work for TikTok: the customer gives the account owner a single-use link valid for 24 hours, and the owner signs in with TikTok and grants the authorization in their own browser, so the customer never handles their password. We collect the same data as above, plus how the invite was used (see "Connect invites" above).
Access and refresh tokens are encrypted with AES-256-GCM and stored on the server, and the server refreshes them before they expire. Tokens are never sent to a browser or given to the customer's agents or other users.
When the customer clicks "Disconnect" in the dashboard, we delete the stored tokens at once and stop all posting and reading. The account owner can also remove this app's access at any time in the TikTok app's settings.
TikTok data is never sold, rented, used for advertising or shared with third parties; it is used only in that customer's dashboard and reports. When customers use TikTok features, TikTok's Terms of Service and Privacy Policy also apply.

Connected X accounts

Customers may connect X accounts they run or are entitled to manage, by signing in with X (OAuth 2.0). The account owner signs in and consents; X's consent screen lists what is granted. Once connected:

What we read (users.read, tweet.read): the X account id, username, display name and profile picture, read once when connecting, to check that the right account is connected and to show it in the dashboard. We do not read the account's posts, timeline, direct messages, followers or metrics.
What we write (tweet.write, media.write): only posts the customer approved and scheduled in tennnzo, with their images or video (uploaded to X, then posted). We never post content the customer did not approve, and we do not like, repost, follow or send direct messages.
Access and refresh tokens (offline.access) are encrypted with AES-256-GCM on the server and renewed by the server before they expire; they never reach a browser and are not given to the customer's agents or other users.
When the customer clicks "Disconnect" in the dashboard, we revoke the tokens at X and delete them at once, and stop all posting. The account owner can also remove this app at any time in X under Settings and privacy › Security and account access › Apps and sessions › Connected apps.
X data is never sold, rented, used for advertising or shared with third parties; it is used only in that customer's dashboard. When customers use X features, X's Terms of Service, Developer Agreement and Privacy Policy also apply.

Advertising

Customers may bind Meta ad accounts they own or are entitled to manage to a tennnzo workspace, by signing in with Facebook Login and granting the authorization themselves as a manager of the ad account. Once bound:

Ad accounts: we keep the ad account id, name, currency, time zone and business id, the Page ads are run as (with that Page's access token, encrypted), and the Facebook user id and name of the person who signed in with their access token (encrypted; it expires after about 60 days).
Ad performance: once a day we read the spend, impressions, reach, clicks and results of each campaign and ad of the bound ad accounts and keep them as daily numbers for the workspace's Ads pages and the project's reports; when a report is published to the client, the client sees that project's ad performance. We do not read data about any individual in an ad's audience.
Creating and managing ads: we create boosts, partnership ads and catalog ads only when a member of the customer's team does so in tennnzo (or approves a proposal from the customer's agent). Every ad is created paused and only starts spending when a person switches it on, and the workspace's spend per month stays within the cap set by an organisation admin (ads are paused automatically when it is reached). The customer's agents can only propose changes; they cannot create, switch on or change ads.
Branded content: a post marked as sponsored that tennnzo publishes on an Instagram account connected with Facebook Login carries Meta's "Paid partnership" label and, when the project has a brand set, tags that brand. The brand's own Instagram account can approve creators and request partnership-ad permission from tennnzo. We keep only the brand's name, its Instagram account id and username, its Page id, and which brand each post tagged.
Leads (lead ads): when a lead form the customer chose to forward receives a lead, we read that lead from Meta (the fields filled in on the form, such as name, email, phone number and answers) and forward it at once to the destination the customer set (the customer's webhook URL, or an email address). The lead's content is held, encrypted, only to forward it: it is deleted as soon as it is delivered, and after at most 7 days if it cannot be delivered. What we keep is each lead's Meta id, the form, the destination, the delivery status and times, and counts; never names, contact details or answers. Webhooks are signed with the customer's secret; once forwarded, leads are handled under the customer's own privacy policy.
Product catalog: the product list a customer enters in tennnzo (product id, name, description, price, currency, image and product page links, availability, brand) is synced to a Meta product catalog in the customer's business, for Instagram product tags and catalog ads. We keep only the product data the customer entered, the catalog id and sync results, and which products each post tags.
Advertising data is never sold, rented, used for tennnzo's own advertising or shared with anyone other than the destinations the customer sets. Customers can unbind an ad account, stop forwarding leads or remove a destination at any time; when an ad account is unbound we delete its campaigns and numbers in tennnzo (ads on Meta are not affected).

Purposes

Providing the service: managing accounts, reviewing, scheduling and reporting.
For accounts the customer chose to have tennnzo publish: publishing approved posts at their scheduled time, deleting posts on the customer's instruction, and reading their performance.
For connected TikTok accounts: posting the videos the customer approved and confirmed, and reading the account's follower count and the performance of its public videos.
For connected X accounts: posting the posts, images and videos the customer approved.
For connected accounts: showing the comments, mentions and messages they receive in the Inbox so the customer's staff can answer, hide or delete them (every action pressed by a person; the one exception is the customer's link blacklist, see "Inbox" below).
Advertising: creating and managing ads as the customer instructs, showing ad performance in reports, forwarding leads and syncing the product catalog.
Showing each account's current platform avatar in the dashboard and review screens, so reviewers and clients can recognise the account.
Security, abuse prevention, troubleshooting and customer support.
Complying with legal obligations.

We do not sell personal data and do not use it for advertising or to build profiles unrelated to the service.

Storage and sharing

Data is stored with the cloud infrastructure providers we use for hosting, databases and file storage; their data centres may be located outside Taiwan. These providers process data only to provide the service, under contract. Apart from them, we disclose data only when the law requires it or the customer instructs us to.

Within a customer organisation, members see data according to their role; client-side members only see content prepared for them.

Post scoring: the text of posts in review, a summary of the account's persona, and the account's market and platform are sent to the text-scoring service we use (TypeSafe); only scores between 0 and 1 come back, never generated text. Scores are a reference for the customer's internal members; they never hold back or send back a post, and client-side members do not see them.

Table sync: when a customer connects its review table (Feishu Bitable, Lark Base, Notion, Airtable, Google Sheets or DingTalk AI Table) to tennnzo, we write, as the customer configured, each post's account code, planned date, topic, text, images, review status, review comments, post link and publish time into that table, and read back the review actions, text and comment edits made there, recording them on behalf of the table's last editor; where a platform cannot take uploads we write long-lived links to the image on tennnzo's domain (the image only, nothing else); when both sides changed at once, the table's edit that was not taken is written into that table's "sync conflict" column. The credentials for the connection (app secret, integration token, personal access token, service-account key or AI Table connection URL) are entered by the customer, stored encrypted, never shown again and opened only while syncing. The table platform handles the written data under its own terms; the customer can pause or disable the sync at any time, after which we stop reading and writing that table.

Inbox (comments, mentions and messages)

Once a customer connects an account, tennnzo receives and stores the comments and replies the account receives, posts and comments that mention the account, and the account's direct messages (Instagram messages and the Page's Messenger messages; and, when the customer binds a WhatsApp Business phone number, that number's WhatsApp conversations), so that the customer's staff can read and answer them in one place.

What we receive: the text of the comment, reply or message, the type of and link to any attachment, the time, the post it belongs to, and the writer's platform id, username, name and profile picture link (where the platform provides them). For direct messages we only receive new messages after the account is connected.
Why: so the customer can answer the comments and messages their own accounts receive, and hide or delete comments. Every reply is sent or approved by a member of the customer's staff; the customer's agents can only draft replies and cannot decide by themselves to send, like, hide or delete anything.
Link blacklist (automatic hiding): the customer can keep a list of domains (by default a few shopping sites' domains and short links, which the customer can change). When a newly received comment or mention (never a direct message or the account's own words) contains a link to a domain on the list, it is hidden automatically, or deleted where the customer chose deletion for that domain and the platform allows it. We only compare the domains of the links in the text and do not analyse anything else in it; every automatic action is recorded with the rule, the reason and the outcome, shown to the customer's staff in the Inbox, and the customer can switch rules off or remove them at any time.
Accounts the customer sets to "Agent" for the Inbox: these accounts are not connected to the platform through tennnzo. Their comments, replies and mentions are read by the customer's own agent and handed to tennnzo to store (the same content as above, no direct messages), together with the link and text of the post each comment is on (so the customer's staff can see which post it belongs to); replies approved by the customer's staff, and the likes, unlikes, hides and deletions they press (and the hides or deletions the link blacklist schedules), are carried out from the account by the customer's agent exactly as asked. tennnzo does not connect to the platform for these accounts; it records who approved each action or which rule triggered it, which agent carried it out and the outcome.
Who can see it: only the customer's staff responsible for that workspace; the customer's client-side members and other organisations cannot. We do not use this content for advertising, do not sell it and do not build profiles unrelated to the service.
What we write: only the replies, messages, hides, unhides, deletions and likes a member of the customer's staff presses in the Inbox, and the hides or deletions the customer's link blacklist carries out automatically; each action is recorded with who (or which rule) did it and when. For accounts set to "Agent", tennnzo writes nothing to the platform.
Retention: Inbox comments, mentions and messages (and drafts) are kept for 90 days and then deleted automatically every day. The action log is kept but contains no message text. When a customer unbinds a WhatsApp number, that number's conversations are deleted at once.
When an account owner removes this app on the platform, we are notified and stop using that authorization. When an account owner sends Meta a data deletion request, we immediately delete that login's access tokens and the comments, mentions and messages of those accounts in the Inbox, and provide a confirmation code and status page.

Community data (private groups)

What we process: after a customer adds the AI assistant to its own WhatsApp group or Discord, the customer's agent summarizes the previous day's activity for each member once a day and hands the summaries to tennnzo. We keep: a hash of the member's platform account id (the original id is turned into a hash on our server before anything is written to the database; we do not store the original id), the member's display name, the number of interactions, interest and intent tags, a one-sentence summary, and the member role and ticket content entered by the customer's staff. In a Discord server the customer's bot also reports when a member joined and which of the server's invite links they used (the invite code only, not who created it), so the customer can see which account or post the member came from; the customer's staff label each invite link with that account and post.
What we do not keep: message text, and phone numbers. The one-sentence summary is written by the customer's agent; it does not copy the original text and does not contain phone numbers, addresses or order numbers. The message text itself stays on the host where the customer's agent runs, not with tennnzo. Our standard setup (and agents we host) delete it after 30 days; for agents the customer runs itself, deleting it is the customer's responsibility under our agent requirements.
Group list: the host where the customer's agent runs reports the ids and names of the groups the AI assistant is in, when it last received a message there, and the list of groups the host currently serves, so that the customer's staff can pick a group when registering it. The report contains no message text and no senders; it is deleted together with the agent. When the AI assistant is a group admin and removes spam for the customer, the host also reports, per group and day, how many messages it deleted and how many people joined, left or were removed, the time of each join (not who joined), the group's current invite code and group picture, so that the customer can see moderation results and estimate which promo link people came through.
Why: so the AI assistant can answer members' questions in the group, recommend the products the customer lists, hand complaints, refunds, orders and deletion requests over to a person, and so the customer understands what the group's members care about.
Who can see it: only the customer's staff responsible for that workspace; the customer's client-side members and other organisations cannot. We do not use this content for advertising, do not sell it and do not build profiles unrelated to the service.
How to ask for deletion: a group member can ask the AI assistant in the group to pass the request to a person (it opens a "delete my data" ticket), or write to privacy@tennnzo.com with the group and display name. Once we receive a deletion request (through the customer or the data deletion page), we delete the community data about you (hashed account id, display name, interaction counts, tags, summaries, join records and related tickets) and confirm when done. You can also ask the customer who runs the group directly.

Keyword monitoring and account lookup (public content)

The customer's staff can set keywords that tennnzo searches for on a schedule, through an account the customer has connected, in public content on the platforms: Threads keyword search (public posts) and Instagram hashtag search (public posts with the hashtag from the last 24 hours). Staff can also look up the public profile of another Instagram business or creator account by its username (Instagram business discovery).

What we keep (only for public posts the searches found): the platform's post id, the author's username (Threads only; Instagram hashtag search does not provide the author), a text excerpt of up to 500 characters, the link to the post, when it was published, the media type, the like and comment counts the platform provides, and the keywords it matched. We do not download images or videos and keep nothing else about the author.
Account lookup: the business or creator account's details (name, profile picture, biography, website, follower and post counts, public numbers of recent posts) are shown to the person who looked it up and not stored; the only thing stored is the profile picture, when a staff member chooses to use it as the avatar of the customer's own Instagram account.
Why: so the customer's team can follow public conversations about its own brand, products and topics, and take the platform profile picture of its own accounts by username.
Who can see it: only the customer's staff responsible for that workspace; the customer's client-side members and other organisations cannot. The customer's agents can only read the results and propose watch lists; they cannot search, comment, like or post, and a person must approve every list before it is searched.
What we write: nothing. Keyword monitoring and account lookup only read public content; they never post, comment or interact on the platforms.
Search limits: we respect the platforms' limits (searches per Threads account per 24 hours, hashtags per Instagram account per 7 days) and keep only the time, keyword and number of results of each search (no content) to count them, deleted after 8 days.
Retention: search results are kept for 30 days and then deleted automatically (saved results included); when a customer deletes a watch list, its results are deleted at once. This content is never sold, used for advertising or used to build profiles unrelated to the service.

Ad research (third-party public data)

The customer's staff (or the customer's agent, recording a staff member's explicit approval) can look up reference material for writing ads: public data about Taobao / Tmall products (title, price, specifications, buyer reviews, buyer questions and answers) and the titles and engagement counts of recently popular Xiaohongshu notes. A third-party data service obtains this data from public pages and provides it to us. Every lookup is quoted first and runs, charging the customer's credits, only after a person approves it.

What we keep: the product titles, prices, specifications, the text, date and purchased variant of reviews, the text of questions and answers, the titles and engagement counts of popular notes, and each lookup's quote, who approved it (name, where and when), the credits charged and the result. We do not keep buyers' or authors' nicknames, profile pictures, account ids or any other personal data; reviews keep only their text, date and variant.
Purpose: reference material for the customer's ads and sponsored content only. The content is third-party text in Simplified Chinese, for reference only; it must not be copied or republished verbatim.
Who can see it: only the customer's staff responsible for that workspace and that workspace's agents; the customer's client-side members and other organisations cannot. Cached results are shared only within the same organisation, never across organisations.
What we send to the data service: only the product ids or keywords to look up; no customer, account or personal data.
Retention: lookups and their results are kept with the customer's account data and deleted with it; cached product data is deleted after 31 days, keyword data after 2 days.

Retention

Customer accounts and content: kept while the customer uses the service; deleted within 30 days after the customer ends the service or asks us to delete it.
Platform profile pictures (from the Threads lookup, or taken when an account is connected): kept with the account they belong to; when the avatar on the platform changes, the previous picture is marked as replaced. They are deleted when the account or persona is deleted, or on request.
Server logs: kept only as long as needed for security and troubleshooting.
Telegram notification chat ids: kept until the member removes the link, sends /stop or blocks the bot in Telegram, or leaves the organisation (deleted automatically when they leave); the hash of a one-time link code is deleted a day after it expires.
Access tokens of connected accounts: kept until the customer disconnects the account, reconnects it after the authorization stopped working, or ends the service; deleted at once on disconnect.
Access and refresh tokens of connected TikTok accounts: kept until the customer disconnects the account, the authorization stops working, or the customer ends the service; deleted at once on disconnect. The account id, display name, profile picture, follower count and the public video list and performance are kept like the customer's other content.
Access and refresh tokens of connected X accounts: kept until the customer disconnects the account, the authorization stops working, or the customer ends the service; revoked and deleted at once on disconnect. The account id, username, display name and profile picture are kept like the customer's other account data.
Connect invite records (the hash of the invite link, the persona and platform it was for, who created it, times, how it was used and why attempts failed): kept as part of the customer's activity records and deleted with the persona or the customer's data; the temporary sign-in state is removed within 24 hours.
Persona voice records (Looking Glass): the customer's agent describes how a persona speaks from its published content and material the customer provides, and writes it to the persona. We keep each run's result, the previous version, a description of the sources used (kind, label, link, count; not the source text) and times, with the persona, and delete them with the persona or the customer's data.
Inbox comments, mentions and messages (with drafts and the raw notifications the platform sent): kept for 90 days, then deleted automatically; deleted at once on a data deletion request.
Community data (hashed member account ids, display names, interaction counts, tags, one-sentence summaries, tickets): kept while the customer uses the service; after the customer ends the service, or after we receive a deletion request, we delete it and confirm when done. We do not keep message text or phone numbers; the text stays on the host where the customer's agent runs and is deleted after 30 days in the standard setup.
Public posts found by keyword monitoring: kept for 30 days, then deleted automatically; the search log (no content) is kept for 8 days.
Patrol replies: the reply and its outcome are kept while the customer uses the service; the other person's username and post excerpt shown to the approver are kept for 30 days, then deleted automatically. Patrol candidates (public posts the customer's agent found by keyword and saved for review: post id, link, author, excerpt, posting time and the agent's grading) are kept for 30 days, then deleted with their content automatically.
Ad account access tokens and ad performance: kept until the customer unbinds the ad account or ends the service; unbinding also deletes that account's campaigns and numbers in tennnzo.
The content of leads from lead ads: deleted as soon as it is delivered to the customer's destination, and after at most 7 days if it cannot be delivered. Delivery records (Meta lead id, status, times) and counts are kept like the customer's other content.

Security

All traffic is encrypted with HTTPS; access is limited by organisation and role; the platform's Threads authorization and the access tokens of connected accounts are kept on the server only (the latter also encrypted with AES-256-GCM) and never sent to a browser. No system is perfectly secure; if an incident affects your data, we will notify you as required by law.

Your rights

Under Taiwan's Personal Data Protection Act you may ask to access, obtain a copy of, supplement or correct, stop the processing or use of, and delete your personal data. Write to privacy@tennnzo.com. See the Data Deletion page for how deletion works.

Children

The service is intended for businesses and professional users and is not directed at children.

Changes and contact

If this policy changes materially, we will update the date on this page and tell users in the service.

Contact: 不好意思股份有限公司 (Excuse Me Lab Co., Ltd., Taiwan Unified Business No. 62186614), email privacy@tennnzo.com.