Privacy Policy — SealDIVE Inbox
Effective date: 13 November 2026
SealDIVE Inbox (inbox.sealdiving.net, “the Inbox”) is the customer-service tool of Seal DIVE 海豹潛水, a diving school and diving-equipment shop in New Taipei City, Taiwan (“we”, “us”). Our staff use it to read and answer the Instagram direct messages, Facebook Messenger messages and comments that customers send to our Instagram account and Facebook Page. This policy explains what personal data the Inbox handles, why, and the choices you have. It supplements the general privacy policy of our website at www.sealdiving.net/privacy.
1. Data we handle
| Whose data | What | Where it comes from | Kept by us? |
|---|---|---|---|
| Staff who sign in with Facebook | Facebook app-scoped user ID and name; the Instagram professional account and Facebook Page chosen during login; access tokens for them | Facebook Login for Business | Yes. Tokens are stored encrypted (AES-256-GCM). A sign-in session lasts at most 8 hours. |
| Customers who message or comment on our Instagram account or Facebook Page | Instagram username or Facebook name, the Instagram- or Page-scoped ID, message and comment text, time, and our replies | Instagram Graph API, Messenger Platform and Pages API | Ordinary message and comment text is retrieved from Meta when staff open or refresh a conversation or post and is shown only to signed-in staff; it is not kept as a separate archive. |
| Our own posts | Post caption or text, picture or thumbnail, link (permalink), post ID, time and comment count | Instagram Graph API and Pages API | Not kept; retrieved when staff open the Comments tab. |
| Staff and customers (reply records) | Time, account (Instagram or Facebook Page), conversation or comment ID, and whether Meta accepted the reply. The reply text is not stored by us. | The Inbox | Yes, up to 180 days, to prevent a reply from being sent twice and for troubleshooting. |
| Webhook deliveries | When Instagram or Facebook notifies us of a new message or comment, we record technical counters only (time, number of events, whether the signature was valid), without message text or account IDs. | Instagram and Facebook webhooks | Counters, up to 180 days. |
| Our designated internal test accounts | Text of messages and comments sent by our own test accounts | Instagram and Facebook webhooks | Up to 14 days, for quality testing only. |
The Inbox uses one strictly necessary cookie to keep you signed in, and one short-lived cookie to protect the Facebook login against forgery. It has no advertising and no analytics trackers, and we never sell personal data.
2. Why we use it
Only to answer customers' questions about our diving courses, trips and products, and to keep the Inbox secure. We do not use Instagram or Facebook data for advertising, profiling or any automated decision, and we do not transfer it to data brokers.
3. Who processes it for us, and where
- Meta Platforms (Instagram and Facebook) — provides the messages, comments and login.
- Supabase — hosts our database and server functions (encrypted at rest), in the Mumbai, India region.
- Cloudflare — serves the Inbox web pages over HTTPS from its global network.
We do not share Inbox data with anyone else unless required by the laws of Taiwan.
4. How long we keep it
- Access tokens and connected-account details: until you disconnect, remove the app in Facebook settings, or ask us to delete them.
- Sign-in sessions: at most 8 hours. Reply records and webhook counters: at most 180 days. Internal test content: at most 14 days.
5. Your choices and rights
Under Taiwan's Personal Data Protection Act you may ask to see, correct, stop the use of, or delete your personal data.
- Staff: open Account → Disconnect and delete my data in the Inbox, or remove “SealDIVE Inbox” under Facebook Settings & privacy → Settings → Business integrations. When we receive a valid deauthorization notification from Facebook, we delete the stored data associated with that connection. A Meta data-deletion request is processed separately: after a valid request we delete the data and return a confirmation code and a status page where its progress can be checked.
- Customers: you may delete or unsend your messages and comments using Instagram or Facebook, subject to the features available there. To request deletion of personal data held by SealDIVE Inbox, including identifiers in reply records or retained internal test content, follow the email instructions on our Data deletion page.
6. Security
All traffic uses HTTPS. Access tokens are encrypted; our database tables are not exposed through any public API and are accessible only to our own server functions; and only signed-in staff who connected an account can see its conversations.
7. Children
The Inbox is a business tool for our staff and is not directed to children.
8. Changes
We will post any change on this page and update the effective date.
9. Contact
Seal DIVE 海豹潛水 · 3F, No. 75, Fuhe Rd., Yonghe Dist., New Taipei City, Taiwan
Phone: +886 930 016 840 · Email: shawn-hu01@hotmail.com
隱私權政策 — SealDIVE 客服收件匣
生效日期：2026 年 11 月 13 日
SealDIVE 客服收件匣（inbox.sealdiving.net，以下稱「本收件匣」）是海豹潛水 Seal DIVE （新北市永和區的潛水學校與潛水用品店，以下稱「我們」）的客服工具，供員工查看與回覆客人傳到我們 Instagram 帳號與 Facebook 粉絲專頁的私訊（含 Messenger）與留言。 本政策說明本收件匣處理哪些個人資料、用途，以及你的權利；並補充官網隱私權政策（www.sealdiving.net/privacy）。
一、處理哪些資料
| 資料對象 | 內容 | 來源 | 我們是否保存 |
|---|---|---|---|
| 以 Facebook 登入的員工 | Facebook 應用程式範圍使用者 ID、名稱；登入時選擇的 Instagram 專業帳號與 Facebook 粉絲專頁；它們的存取權杖 | Facebook 企業登入 | 是。權杖以 AES-256-GCM 加密保存；登入工作階段最長 8 小時。 |
| 傳私訊或留言給我們 Instagram 或 Facebook 粉絲專頁的客人 | Instagram 使用者名稱或 Facebook 名稱、範圍 ID、私訊與留言內容、時間、我們的回覆 | Instagram Graph API、Messenger 平台、粉絲專頁 API | 一般訊息與留言文字在員工開啟或重新整理時才向 Meta 讀取，只顯示給已登入的員工，不另存副本。 |
| 我們自己的貼文 | 貼文文字、圖片或縮圖、連結、貼文 ID、時間、留言數 | Instagram Graph API、粉絲專頁 API | 不保存；員工開啟「留言」分頁時才讀取。 |
| 員工與客人（回覆紀錄） | 時間、帳號（Instagram 或粉絲專頁）、對話或留言 ID、Meta 是否接受。回覆文字本身不由我們保存。 | 本收件匣 | 是，最多 180 天，用於防止重複送出與排除問題。 |
| Webhook 通知 | Instagram 或 Facebook 通知有新訊息或留言時，只記錄技術計數（時間、事件數、簽章是否正確），不含文字與帳號 ID。 | Instagram、Facebook webhook | 計數，最多 180 天。 |
| 我們指定的內部測試帳號 | 我們自己的測試帳號所傳訊息與留言的文字 | Instagram、Facebook webhook | 最多 14 天，只用於品質測試。 |
本收件匣只使用一個維持登入所必需的 Cookie，以及一個防止 Facebook 登入被偽造的短效 Cookie；沒有廣告、沒有分析追蹤，我們絕不出售個人資料。
二、使用目的
僅用於回覆客人對潛水課程、行程與商品的詢問，以及維護本收件匣安全。不用於廣告、側寫或自動化決策，也不提供給資料仲介。
三、受託處理者與處理地點
- Meta Platforms（Instagram、Facebook）：提供訊息、留言與登入。
- Supabase：資料庫與伺服器函式（靜態加密），位於印度孟買區域。
- Cloudflare：以 HTTPS 從其全球網路提供網頁。
除依中華民國法律規定外，不會提供給其他任何人。
四、保存期間
- 存取權杖與連結帳號資料：保存到你中斷連結、在 Facebook 設定移除本應用程式，或要求我們刪除為止。
- 登入工作階段最長 8 小時；回覆紀錄與 webhook 計數最長 180 天；內部測試內容最長 14 天。
五、你的權利
依《個人資料保護法》，你可以請求查詢、閱覽、補充更正、停止使用或刪除你的個人資料。
- 員工：在本收件匣「帳號 → 中斷連結並刪除我的資料」；或到 Facebook「設定和隱私 → 設定 → 商業整合」移除「SealDIVE Inbox」。 收到 Facebook 有效的取消授權通知後，我們會刪除該連結所保存的資料。Meta 的資料刪除請求另外處理：收到有效請求後刪除資料，並回傳確認碼與可查詢進度的狀態頁。
- 客人：你可以在 Instagram 或 Facebook 刪除或收回你的訊息與留言（依該平台提供的功能）。若要刪除本收件匣保存的個人資料（包括回覆紀錄中的識別碼或內部測試內容）， 請依資料刪除說明的 Email 方式提出。
六、安全
全程 HTTPS；存取權杖加密保存；資料表不透過任何公開 API 開放，只有我們自己的伺服器函式能存取；只有連結該帳號並登入的員工能看到其對話。
七、兒童
本收件匣為員工使用的商業工具，並非以兒童為對象。
八、政策變更
如有變更，會公告於本頁並更新生效日期。
九、聯絡我們
海豹潛水 Seal DIVE · 新北市永和區福和路 75 號 3 樓
電話：0930-016-840 · Email：shawn-hu01@hotmail.com