Privacy Policy

BAiR is operated by Web3 Data Limited (網三數據有限公司), Taiwan. BAiR helps hospitality businesses connect selected third-party business accounts, view and synchronize authorized business information, and use the features they choose. In this policy, “merchant” means the business using BAiR and “you” means a person who uses BAiR for that merchant.

This policy explains what information BAiR receives, why we use it, when it may be disclosed, and the choices available to merchants and their authorized users. A connected platform's own terms and privacy policy also apply to information processed by that platform.

Information we receive

We receive information that merchants and their authorized users provide to BAiR, such as work email, mobile number, venue or business name, account and workspace details, support requests, configuration choices, and content submitted for a selected BAiR feature.

When an authorized user connects a third-party business account, BAiR receives only the information needed for the selected feature and the permissions the user grants. Depending on the connection, this may include:

• business-account and resource identifiers;
• business profile and location information;
• published content and related metadata;
• analytics, performance, Search Console, Business Profile, or Insights data;
• selected Google Drive files and their contents when the user explicitly selects them;
• Instagram professional-account conversations, including message text, participant-scoped identifiers, message identifiers, and timestamps; and
• authorization credentials and connection status needed to maintain the connection.

BAiR also creates operational records needed to run and protect the service, such as IP address, browser or device information, request timestamps, security events, connection events, job status, error records, tenant and source mappings, and audit records. We do not ask users to send passwords or access tokens through support channels.

How we use information

We use this information to:

• authenticate and maintain a connection requested by an authorized user;
• retrieve, organize, synchronize, and display authorized business information in the correct merchant workspace;
• provide the specific analytics, content, or messaging feature the merchant selected;
• respond to support and deletion requests;
• diagnose failures, prevent abuse, protect accounts, and maintain source and audit records; and
• comply with applicable legal obligations and enforce agreements.

BAiR uses Google user data only to provide or improve the user-facing features that the user requests. The section Google user data below describes exactly what Google data BAiR accesses, how it is used, and with whom it is shared. BAiR does not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.

BAiR does not use connected-platform data for cross-context behavioral advertising. BAiR does not sell connected-platform data.

When information is disclosed

Information is available to the merchant and the authorized users of that merchant workspace. We may also disclose information:

• to service providers that process it for us to operate, host, secure, monitor, support, or back up BAiR;
• to artificial-intelligence service providers for AI-assisted features, namely Anthropic (Claude), for understanding text, drafting replies, and classifying images, and OpenAI, for retouching photos and generating marketing images from photos the merchant uploaded to BAiR. BAiR has configured its accounts with these providers so that the data we send is not used to train their models (Google user data and Instagram data are disclosed only as described in the Google user data and Instagram data sections);
• to participants in an external approval destination when an enabled workflow sends content there for review;
• when a merchant directs us to disclose it or connects a feature whose operation requires the disclosure;
• when required by law or needed to protect rights, safety, accounts, or the service; or
• as part of a corporate transaction, subject to appropriate confidentiality and data-protection terms.

Service providers may process information only for the services they provide to BAiR and under the applicable agreement with us. An external destination may be controlled by the merchant or another provider; copies delivered there are also governed by the destination's terms and the merchant's own policies.

Google user data

This section applies to information BAiR receives from Google APIs after a merchant's authorized user grants access. If this section differs from another part of this policy for Google user data, this section controls.

What Google data BAiR accesses

BAiR requests only the following Google permissions (scopes), and only after the user consents:

• Google Analytics (analytics.readonly): read-only access to sessions, event counts by source, medium, and channel, landing pages, and event names for the property the user selects.
• Google Search Console (webmasters.readonly): read-only access to clicks, impressions, click-through rate, and average position, broken down by query, page, country, device, and date, for the property the user selects.
• Google Business Profile (business.manage): performance metrics, search keywords, and listing information for the location the user selects, including name, phone number, address, hours, categories, website, reviews, and photos.
• Google Drive (drive.file): only the files the user selects in the Google Picker. BAiR cannot see other files in the user's Drive.

How BAiR uses Google user data

BAiR uses Google user data only to show the merchant its own dashboards and reports and to help the merchant manage its own listings and content. BAiR does not use Google user data for advertising, does not sell it, does not give it to data brokers, and does not use it for credit or lending decisions.

With whom Google user data is shared, transferred, or disclosed

BAiR does not share, transfer, or disclose Google user data to anyone other than the recipients below.

Infrastructure service providers (all Google user data). These providers host or store the data on BAiR's behalf and may process it only to provide those services to BAiR:

• Neon: Postgres database hosting;
• Cloudflare: file storage (Cloudflare R2) and network proxying; and
• Vercel: web application hosting and proxying.

BAiR also stores and processes Google user data on servers and databases that BAiR itself operates.

AI service providers (limited Google user data). BAiR uses two AI service providers: Anthropic (Claude) and OpenAI. Google Analytics, Search Console, and Business Profile performance and keyword data are not sent to any AI provider. Business Profile listing content (name, address, hours, categories, reviews, and photos) and Drive files that the merchant selects may be processed by Anthropic (Claude) to classify images and draft recommendations for that same merchant. Photos that the merchant uploaded to BAiR, including photos imported from Google Drive through the drive.file scope, may also be processed by OpenAI image models to retouch them and to generate marketing images for that same merchant. BAiR has configured its accounts with Anthropic and OpenAI so that the data BAiR sends them is not used to train their models. BAiR does not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

No other transfers. BAiR does not transfer Google user data to any other party except: (1) with the user's consent; (2) to comply with applicable law; (3) for security purposes or to investigate abuse; or (4) as part of a merger, acquisition, or sale of assets, in which case the acquirer must give the data the same protections described in this policy.

Limited Use

BAiR's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Human access

No BAiR personnel read Google user data, except: (1) with the user's consent; (2) for security purposes, such as investigating abuse; (3) to comply with applicable law; or (4) for internal operations, where the data has been aggregated and anonymized.

Retention and deletion of Google user data

BAiR keeps Google user data while the Google connection is active. When a user disconnects a Google connection, BAiR deletes the stored authorization credential for that connection and stops synchronizing. A merchant or user can request deletion of the Google user data received through a connection at any time by emailing service@flyingclub.io or following the BAiR Data Deletion Instructions. BAiR completes deletion within 30 days of receiving the request. Users can also revoke BAiR's access at any time in their Google Account permissions page.

Instagram data

This section applies to information BAiR receives from Instagram (Meta) APIs after a merchant's authorized user connects an Instagram professional account. If this section differs from another part of this policy for Instagram data, this section controls.

What Instagram data BAiR accesses

BAiR requests only the following Instagram permissions, and only after the user consents:

• instagram_business_basic: the merchant's own account profile (username, name, profile picture, follower count) and its published media (captions, media URLs, permalinks, timestamps).
• instagram_business_manage_insights: read-only performance metrics for the merchant's account and its posts, such as views, reach, accounts engaged, likes, comments, saves, shares, and profile views.
• instagram_business_content_publish: the ability to publish media and captions that the merchant creates and chooses to post to its own account.
• instagram_business_manage_comments: comments on the merchant's own media, including comment text, the commenter's username, and timestamps, so the merchant can read and reply to them. BAiR retrieves comments on request and does not keep a separate copy of them.
• instagram_business_manage_messages: direct messages sent to the merchant's account, including message text, the sender's Instagram-scoped ID and username, and timestamps, so the merchant can read and reply to them. BAiR stores message text. It does not store message attachments.

How BAiR uses Instagram data

BAiR uses Instagram data only to let the merchant manage its own Instagram account: to show its insights, to publish its posts, and to read and reply to comments and messages. Replies to comments and direct messages are written and sent by a human operator of the merchant. BAiR does not send automated replies unless the merchant has turned on a fixed-text keyword auto-reply that it configured, which is off by default. AI-drafted replies are shown to the merchant's staff for review and are never sent to Instagram automatically. Every reply is sent by a person. BAiR does not use Instagram data for advertising, does not sell it, and does not give it to data brokers.

With whom Instagram data is shared, transferred, or disclosed

BAiR does not share, transfer, or disclose Instagram data to anyone other than the recipients below.

Infrastructure service providers. These providers host or store the data on BAiR's behalf and may process it only to provide those services to BAiR:

• Neon: Postgres database hosting;
• Cloudflare: file storage (Cloudflare R2) and network proxying; and
• Vercel: web application hosting and proxying.

BAiR also stores and processes Instagram data on servers and databases that BAiR itself operates.

WhatsApp (Meta), for staff review. If the merchant has enabled a WhatsApp staff review group, AI-drafted reply text is shown there so that the merchant's staff can review it. WhatsApp and Meta therefore receive that draft text.

AI service providers. BAiR uses two AI service providers: Anthropic (Claude) and OpenAI. Instagram insights metrics are not sent to any AI provider. For direct messages, the text of the message, up to 12 prior messages in the same conversation, and the venue's name, address, hours, and booking URL may be sent to Anthropic (Claude) to draft a suggested reply. The sender's username and Instagram-scoped ID are not sent. Images from the merchant's media library, which may include images imported from the merchant's own Instagram posts, may be processed by Anthropic (Claude) to classify and describe them, and may be used as a fallback source image when OpenAI image models retouch photos or generate marketing images for that same merchant. BAiR has configured its accounts with Anthropic and OpenAI so that the data BAiR sends them is not used to train their models. BAiR does not use Instagram data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

No other transfers. BAiR does not transfer Instagram data to any other party except: (1) with the user's consent; (2) to comply with applicable law; (3) for security purposes or to investigate abuse; or (4) as part of a merger, acquisition, or sale of assets, in which case the acquirer must give the data the same protections described in this policy.

Retention and deletion of Instagram data

BAiR keeps Instagram data while the Instagram connection is active. When a user disconnects an Instagram connection, BAiR deletes the stored authorization credential for that connection and stops synchronizing. A merchant or user can request deletion of the Instagram data received through a connection at any time by emailing service@flyingclub.io or following the BAiR Data Deletion Instructions. BAiR completes deletion within 30 days of receiving the request. Users can also remove BAiR's access at any time in their Instagram account settings under Apps and websites.

Storage, access, and security

Platform authorization credentials are kept on the server side and are not intentionally returned to the browser or written into merchant-exported datasets. BAiR associates connected records with the authorizing merchant workspace and limits platform operations through connection, tenant, account, and feature controls.

We use administrative, technical, and organizational measures intended to protect information. No method of storage or transmission is completely secure, and we do not promise absolute security.

Retention

We retain information while it is needed to provide the selected feature, maintain the merchant workspace, meet security and audit needs, resolve disputes, or satisfy legal obligations. Retention varies by data category and storage system. We assess verified deletion requests against the affected data, applicable storage and backup systems, and any security, dispute-resolution, or legal retention need. We will explain any category that must be retained and the reason. Revoking future platform access does not by itself remove information previously received by BAiR, copies delivered to an external destination, or information held by the connected platform.

Your choices

An authorized user can limit the information BAiR receives by declining a permission, selecting only the intended resource, or not enabling a feature. A merchant can ask us to disconnect a connection or delete covered connected-platform data. The merchant can also revoke BAiR directly in the connected platform's account settings. Revoking access at the platform prevents future authorized API access but does not by itself delete information already held by BAiR.

Deletion requests must come from a person authorized for the affected merchant workspace. See the BAiR Data Deletion Instructions.

International processing and third-party platforms

BAiR and its service providers may process information in countries other than the country where the merchant or user is located. Connected platforms and external destinations process information under their own terms, privacy policies, and location practices.

Changes to this policy

We may update this policy when BAiR's features, data practices, or legal obligations change. We will post the updated policy and change the date above. If a change materially affects how connected-platform data is used, we will provide additional notice when required.

Contact

For privacy questions or requests, email service@flyingclub.io or use the instructions on our Contact page. Do not include passwords, access tokens, or sensitive message contents in a request.