Christina

Privacy Policy

Last updated: June 30, 2026

This Privacy Policy describes how MHP Sales Manager (“MHP”, “we”, “our”) collects, uses, and protects information processed by Christina, an internal automation tool we use to manage customer engagement on Facebook Pages and Messenger inboxes that client businesses authorize MHP to manage. Christina is not a public self-serve product.

This policy is specific to Christina. For information about how MHP's public website handles personal data, see our main Privacy Policy. Where the two policies overlap, this Christina-specific policy controls for any information processed by Christina.

1. Data controller

MHP Sales Manager is the data controller for any data processed by Christina.

2. Information Christina receives from Meta (Facebook)

When an authorized MHP employee connects a Facebook Page that a client business has authorized MHP to manage, Christina receives and stores:

  • The Facebook Page's unique ID, display name, and category.
  • A Page Access Token - a credential issued by Facebook that allows Christina to act on the Page's behalf. Tokens are encrypted at rest using AES-256-GCM with an encryption key held only by MHP.
  • The text and metadata of public comments posted to the Page's posts (commenter's Facebook user ID, name as shown on Facebook, comment ID, post ID, timestamp, and the comment text itself).
  • Messages sent to the Page via Facebook Messenger (sender's Page-Scoped User ID, message ID, timestamp, message text, and any attachments).
  • The person's public name and profile picture, retrieved from Facebook's User Profile API using their Page-Scoped ID, so our agents can identify who they are speaking with in the inbox and on the lead's CRM record.
  • Webhook event records (raw payloads received from Meta) for audit and debugging purposes.
  • Logs of automated and human replies that Christina sends back on the Page's behalf.

Christina does NOT collect:

  • Friend lists, the photos a person posts or shares, or any private profile information of Facebook users beyond their public name and profile picture.
  • Email addresses or phone numbers from Facebook.
  • Location data, device data, or browsing data.
  • Any data from Facebook users beyond what they post publicly to a connected Page or send directly to it via Messenger.

3. How Christina uses Facebook data

The data described in section 2 is used solely to:

  • Automatically respond to comments on connected Pages with replies configured by MHP employees.
  • Send automated Messenger replies inside Meta's standard 24-hour messaging window.
  • Log conversation history into MHP's internal customer-relationship-management system so that human agents can follow up where appropriate.
  • Debug and improve Christina's reliability.

We do not use this data for advertising, profiling, training third-party AI models, or any purpose beyond the operation of the Page's engagement workflow. We do not sell or rent it.

4. Information collected through Christina's admin interface

Christina's admin dashboard is restricted to a single authorized MHP employee. We collect:

  • Login credentials (email + bcrypt-hashed password) for the admin account.
  • One HttpOnly session cookie used to keep the admin signed in.
  • Standard server logs (IP address, request path, timestamp) for security monitoring.

The admin interface does not use third-party tracking cookies, advertising cookies, or third-party analytics cookies.

5. Data storage and security

  • All data is stored in Neon Postgres, hosted in the US-East region of Amazon Web Services.
  • Page access tokens are encrypted at rest with AES-256-GCM. The encryption key is held only by MHP.
  • All webhook requests from Meta are cryptographically verified using HMAC-SHA256 (X-Hub-Signature-256) before being accepted.
  • Christina is served exclusively over HTTPS with TLS provided by Railway. No data is transmitted in plaintext.
  • Admin access is protected by a credential login with a bcrypt-hashed password and HttpOnly session cookies.
  • MHP applies the broader data-security practices described in our main company privacy policy (including data minimization, encryption, restricted access, and breach response).

6. Data sharing

Christina does not share, sell, exchange, or disclose Facebook data with any third parties or affiliates for marketing, promotional, or commercial purposes. The only external services Christina communicates with are:

  • Meta (Facebook) - to receive webhook events and send Page replies via the Graph API. This communication is required for Christina to function.
  • MHP's internal CRM - operated by MHP for MHP's own use; data flows to this internal system only.

We may engage essential service providers (hosting, error monitoring) strictly to operate the application. Such providers are contractually prohibited from using Christina's data for any purpose beyond the specific service they perform on our behalf.

7. Data retention

  • Page access tokens are retained until the Page is disconnected from Christina, at which point the token is deleted from the database and the Page's subscription with Meta is revoked.
  • Conversation messages and webhook event records are retained for as long as they are needed for the engagement and audit workflow they were collected for, and are deleted when you request deletion (see our Data Deletion page) or when a Page is disconnected from Christina.
  • When data is deleted, it is removed from Christina's live database immediately and aged out of encrypted database backups within 30 days as those backups expire.

8. SMS / text messaging data

If you provide your phone number and consent to receive SMS messages from MHP, we collect and use that information solely to send you the messages you opted into (lead follow-up, appointment reminders, sales outreach).

  • MHP does not share your phone number or SMS consent data with any third parties or affiliates.
  • MHP does not sell your SMS data or use it for any purpose beyond the messaging program you opted into.
  • Opt-in data and consent information will never be shared with any third party, including affiliates or marketing partners.
  • You can opt out at any time by replying STOP; for help, reply HELP. Message and data rates may apply.

9. Your rights (including GDPR / CCPA)

Subject to applicable law (including the EU General Data Protection Regulation and the California Consumer Privacy Act), you have the right to:

  • Access the personal data we hold about your interactions with Christina.
  • Rectify inaccurate or incomplete data.
  • Erase your data - see our Data Deletion page for instructions.
  • Restrict or object to certain processing.
  • Withdraw consent by deleting your comment on Facebook (Meta propagates the removal to Christina automatically) or by removing our app from your Facebook settings, which triggers an automatic deletion. See the Data Deletion page for details.
  • Lodge a complaint with your supervisory authority.

To exercise any of these rights, email hi@mhpsalesmanager.com. We will respond within 30 days.

10. Children's privacy

Christina is not intended for use by children under 13 (or under 16 in jurisdictions where that is the applicable age). MHP does not knowingly process data from children. If you believe a child has interacted with a Page that MHP manages and you would like the record deleted, please use the Data Deletion process.

11. Cookies

Christina's admin interface uses one HttpOnly session cookie for login. We do not use tracking cookies, advertising cookies, third-party analytics cookies, or any cookies that follow users across sites. MHP's public marketing website may use cookies as described in its own privacy policy; that website is separate from Christina.

12. International transfers

Christina's data is stored in the United States. If you access Christina or interact with Pages that MHP manages from outside the United States, your information will be transferred to and processed in the United States. We rely on appropriate safeguards (including the encryption and access controls described in section 5) to protect that data.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be communicated through Christina's admin dashboard.

14. Contact

Questions or concerns about this policy: hi@mhpsalesmanager.com, or write to MHP Sales Manager, 18511 SW 7th St, Pembroke Pines, FL 33029, USA.