Privacy policy

sotish platform and Meta

MAJENTO LLC also operates sotish, a platform for shops with an administration interface at admin.soti.sh, an API at api.soti.sh, and shop storefronts in Telegram. This section covers the platform and its Meta integration. The website section below covers visits to majento.ai. Shop owners provide their own notices for their customers and decide how they use their customer and advertising data.

Data received from Meta and permissions

When a shop owner connects Meta through Facebook Login for Business, we receive the Facebook user ID and name, an access token and its expiry, granted permissions, and the IDs and names of accessible advertising accounts and pixels. We store the selected connection and temporary connection drafts. We read advertising account status and, when reporting is enabled, campaign IDs and names, daily spend, impressions, clicks and currency. Connection diagnostics may also read account currency and time zone, Facebook Pages and their IDs and names, and linked Instagram business account IDs and usernames.

Permission	Data and purpose
public_profile	Facebook user ID and name to identify the person connecting the shop
ads_management	Access to the selected advertising account and pixels, connecting advertising tools and managing a customer-list audience when enabled
ads_read, when granted	Reading campaign statistics; the reporting scenario also accepts ads_management
pages_show_list	Listing accessible Facebook Pages for advertising connection diagnostics
pages_read_engagement and instagram_basic	Reading the linked Instagram business account in Page diagnostics
pages_manage_ads, when granted	Checking the Page advertising access needed for the shop's advertising scenario

Meta's login configuration and the permissions you grant determine which assets are available. A granted permission authorizes the associated integration; the shop's enabled features determine the actual processing.

Data sent to Meta

When a shop enables the integration, sotish sends server events through Meta Conversions API to the selected pixel. Events include PageView, ViewContent, AddToCart, InitiateCheckout, Lead and Purchase. They carry the event type, time and ID, source URL, product IDs, quantities, prices, order value and currency as relevant to the event. Matching data may include the customer's normalized first name, telephone number and Telegram identifier, hashed with SHA-256 before transmission. Meta click and browser identifiers (fbc and fbp), IP address and browser user agent are sent in their required format when available. Hashing supports matching and the data remains personal data.

When Custom Audiences is enabled, sotish sends SHA-256 hashes of normalized customer telephone numbers to the shop's customer-list audience. The audience sync checks current customer consent and requests removal of members after consent withdrawal. Customer-linked conversion events also require current consent at queueing and delivery. Advertising-link events can use the Meta click identifier and technical request data to attribute a visit.

The shop owner must provide the required notice and obtain the permissions and consent required for its advertising activity. MAJENTO processes shop data to deliver the contracted integration on the shop owner's instructions. Customer consent supports advertising matching and audience processing. Mandatory legal obligations govern any records retained for compliance. We use Meta data for the shop's connection, reporting, attribution, audience synchronization, support and security. Access to platform data is limited to these purposes and the recipients described below.

Hosting, access and providers

The platform backend and shop databases run on Hetzner infrastructure in Germany. Meta access tokens are encrypted at rest with AES-256-GCM. Authorized shop users receive access according to their role; authorized MAJENTO personnel receive access for operation, support and security. External agents authorized by a shop use its API with scoped access. The Meta token stays on the backend.

Our infrastructure providers include Hetzner for hosting and Cloudflare for platform delivery and backups. Meta receives the advertising data described above. Telegram provides the storefront environment. The majento.ai website uses Vercel and the optional analytics providers described below. These providers may process data in other countries under their own terms and privacy policies. See Hetzner's data privacy information, Cloudflare's privacy policy, Telegram's privacy policy and Meta's privacy policy.

Retention and deletion

We keep the Meta connection and related platform data while the shop's connection is active. We delete Meta tokens, user identifiers and cached Meta data within 30 days after disconnection, shop closure or a verified deletion request. Disconnection removes the stored connection token and stops further use of that connection. Our deletion procedure covers the associated Meta connection data held by sotish. Shop orders and accounting records follow the shop's own retention duties. Meta handles data already received under its own policies.

You can request deletion in these ways:

1. At admin.soti.sh, open the shop's Meta integration and select "Disconnect Meta". For assistance with associated records, email us with the shop address.
2. Email hello@majento.ai with the subject "Meta data deletion" and identify the shop and the connected Facebook account. We may ask for information to verify your authority over the relevant data.
3. In Facebook's Apps and websites settings, remove sotish and use the option to request deletion of data held by the app. Facebook submits a signed request to our deletion callback. The request provides a confirmation code and a status-page link.

The Meta data deletion page provides the instructions and lets you check a request with its confirmation code. Treat the code as private. A completed callback request concerns the Meta user's integration data held by sotish across the shops connected by that user. Requests concerning a buyer's shop records can be made to the shop owner or to hello@majento.ai.

Your rights and security contact

You may ask for access to your personal data, correction, deletion, restriction or a copy, and object to processing or withdraw consent where applicable. Contact hello@majento.ai. We verify the request and explain the response and any retention required by law. You may also contact the competent data protection authority under applicable law. Withdrawal changes future processing; the effect of earlier lawful processing remains governed by applicable law.

Send privacy questions and vulnerability reports to hello@majento.ai. Include the affected service and enough detail for us to investigate. Share credentials and personal data only through a channel agreed with us.

The integration is subject to Meta Platform Terms, Meta Business Tools Terms and, for customer-list audiences, Meta Customer List Custom Audiences Terms. This section was updated on 14 October 2026.

Website privacy

Data used to deliver the site

Our hosting provider, Vercel, receives technical request data such as IP address, browser information and requested URL to deliver pages, prevent abuse and diagnose errors. Hosting infrastructure may process data outside Uzbekistan. See Vercel's privacy notice.

The majento.ai brochure website provides information about our work and contact links. Account registration, payments and file uploads belong to separate product services, including sotish, whose data practices are described above. Contact buttons open email or Telegram. When you contact us, we use the information you send to answer your request and discuss the project. Those channels have their own privacy policies. Please do not send passwords, customer databases or sensitive personal information through an initial enquiry.

Umami statistics without cookies

We use Umami Cloud for page visits and contact-link statistics: pages, referrers and UTM tags, device type and approximate country. The tracker uses no cookies; events do not contain your name, phone number or correspondence. To prevent duplicate contact counts, the browser keeps the visit source and contact markers in sessionStorage with a 30-minute counting window. Statistics are stored in EU (Frankfurt) for up to six months; an aggregate dashboard is available through a public link. Global Privacy Control prevents loading the tracker and disables event transmission. See the Umami documentation.

Optional analytics and browser storage

Data or setting	Purpose and control
Technical request data	Page delivery, abuse prevention and error diagnosis by the hosting provider
Enquiry correspondence	Answering your request and discussing a project
Optional analytics	Visit statistics, enabled only after consent
Browser consent choice	Stored locally for up to 12 months; change it through Privacy settings

With your permission, we use Google Analytics 4 and Vercel Web Analytics to understand page visits, referring sites, device types and approximate countries. Google Analytics uses first-party analytics cookies to distinguish visits. Advertising personalization and Google signals are disabled. Vercel Web Analytics does not use advertising cookies. We retain UTM campaign tags and remove other query parameters and fragments before sending analytics events. See Google’s privacy policy and how Vercel Web Analytics processes data.

Google Analytics and Vercel Web Analytics are off until you choose "Enable" in the small notice. "Close" keeps the current choice. The notice flag and consent choice stay in local storage for up to 365 days. "Privacy settings" in the footer reopens the notice; "Disable Google Analytics" disables future Google Analytics and Vercel events and clears Google Analytics cookies. Umami continues without cookies. Global Privacy Control prevents all three analytics scripts from loading. Withdrawal affects future collection; it does not erase statistics already collected. The sotish Meta integration uses the separate data flows described above.

Access, retention and requests

Access to correspondence is limited to people who need it to handle your enquiry or project. We keep it while the discussion or contractual relationship requires it, and where record-keeping obligations apply. Technical logs follow the hosting provider's retention settings.

To ask about your data, request a correction or deletion, or raise a privacy concern, email hello@majento.ai. We may need information to identify the relevant correspondence. We will explain any records we need to retain.

Changes

We update this page when the website's data practices change. The revision date appears above.