Last updated: October 13, 2026
Mentbot is operated by Chokedee Mechai Chokechai Mewua Soft Co., Ltd., a company based in Bangkok, Thailand. The company is the data controller for the data described in this policy — the party that decides why and how it is processed — and access to production systems is limited to the operator. You can reach us at [email protected].
This policy covers the mentbot.com website and the Mentbot application at app.mentbot.com. It is governed by the laws of Thailand, and we handle personal data in line with Thailand's Personal Data Protection Act (PDPA). Links from our site to third-party services are governed by those services' own policies, not this one.
Mentbot's purpose is to act on comments left on the Facebook Pages you administer and on the Instagram professional accounts linked to those Pages. To do that, you connect your Facebook account and grant Mentbot permission to work with the Pages you choose. An Instagram account is reached through the Facebook Page it is linked to, using that Page's access — never through a separate Instagram login. This section describes exactly what we receive from Meta and what we do with it.
Permissions we request, and why:
Instagram permissions, and why. These are optional: if you decline them, Mentbot keeps working on your Facebook Pages and does nothing on Instagram.
What we store as a result: your Page's ID, name, username and description; the ID, username and name of each Instagram account linked to it; an access token for each connected Page, which lets us act on your behalf, plus a copy of that token for each linked Instagram account, because Instagram actions are made with the Page's access; and, for each comment our rules evaluated, the comment and post IDs, the text of the comment, the commenter's name and Facebook ID (on Instagram, their username and Instagram-scoped ID), and the text of any reply or private message sent in response, whether Mentbot sent it or you sent it from the dashboard. If you use the moderation features, we also store the Facebook IDs you have blocked or chosen to mention.
Profile pictures — yours and your commenters' — are not stored in our database. They are loaded from Meta when the dashboard shows them, and the link to each one is cached for up to 24 hours.
What we never do with it: we do not sell it, rent it, or share it with data brokers. We do not use it for advertising or build advertising profiles from it. We do not send comment content to any AI or machine-learning service — Mentbot matches comments using keyword and hashtag rules that you write, and nothing more. We do not use it for any purpose other than operating the features you switched on.
Account details. When you register we collect your email address and a password (stored only as a cryptographic hash), or the email address and display name from your Google account if you sign in that way. Facebook is never a sign-in method for Mentbot — it is only ever linked to an account that already exists.
Billing details. Subscriptions are handled by Stripe. Your card details go to Stripe directly and never reach our servers. We store the billing name, address, and tax ID you enter for invoicing, and Stripe's identifiers for your customer and subscription records.
Content you create. The reply rules, message templates, and image attachments you configure, plus your notification preferences (including a Telegram chat ID if you connect Telegram alerts).
Technical data. Our servers log request metadata such as IP address, browser user agent, and the pages requested, for security and debugging. The marketing site (mentbot.com) uses Google Tag Manager and the Meta Pixel for visitor analytics and advertising measurement. Both the marketing site and the application (app.mentbot.com) use PostHog for product analytics and session recordings, and the application and our servers send it error reports. Recordings mask what you type into form fields and hide comment text and commenter names in the dashboard's comment views, though a recording can still show a commenter's name or a reply you sent where it appears elsewhere on screen. The application carries no advertising trackers.
We process your account, Page and content data to perform the contract you entered into when you signed up. We process billing data to meet our legal obligations under Thai tax law. We rely on your consent for the marketing cookies on mentbot.com, and on our legitimate interest in keeping the service secure and working for server logs, error reports and product analytics. Connecting a Facebook Page, and granting the Instagram permissions, is always an explicit act of consent that you can withdraw at any time by removing Mentbot in your Facebook settings or asking us to disconnect the Page.
We do not sell personal data. We share it only with the service providers Mentbot runs on, each processing it solely on our instructions:
These providers operate servers outside Thailand, so using Mentbot involves transferring data internationally. We would also disclose data if required by law, or transfer it as part of a sale of the business — in which case this policy would continue to apply until you were told otherwise.
Under the PDPA you may ask us for a copy of the personal data we hold about you, correct it, delete it, object to or restrict how we use it, or withdraw a consent you previously gave. Exercising any of these is free, and we respond within 30 days. Write to [email protected] from the address on your account. If you are not satisfied with our response, you may complain to Thailand's Personal Data Protection Committee.
You can also start a deletion yourself: remove Mentbot in your Facebook settings and choose to delete its data, which tells us to erase your Facebook and Instagram data. To close your Mentbot account, or to disconnect a single Page, email us. Full instructions are on our data deletion page.
All traffic to Mentbot is encrypted in transit with TLS. Facebook access tokens — the Page tokens, including the copy kept for each linked Instagram account, and the token for your linked Facebook account — are encrypted at rest with AES-256-GCM, so a database copy alone does not yield working tokens. Passwords are stored only as hashes. Notifications we receive from Meta are verified against a cryptographic signature before we act on them, so a forged request cannot make Mentbot post on your behalf. Access to production systems is limited to the operator.
No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal data we will notify you and the Thai authorities as the PDPA requires.
Mentbot is a business tool and is not directed at children. We do not knowingly collect data from anyone under 20. If you believe a child has given us personal data, contact us and we will delete it.
If we change how we handle personal data we will update this page and the date at the top. Material changes will also be announced by email to account holders before they take effect.
