Last updated: August 14, 2026
Mentbot is operated by Sarunyhot Suvannachoti, a sole proprietor based in Bangkok, Thailand. For the data described in this policy, that person is the data controller — the one who decides why and how it is processed — and is also the only person with access to production systems. You can reach us at [email protected].
This policy covers the mentbot.com website and the Mentbot application at app.mentbot.com. It is governed by the laws of Thailand, and we handle personal data in line with Thailand's Personal Data Protection Act (PDPA). Links from our site to third-party services are governed by those services' own policies, not this one.
Mentbot's purpose is to act on comments left on the Facebook Pages you administer. To do that, you connect your Facebook account and grant Mentbot permission to work with the Pages you choose. This section describes exactly what we receive from Meta and what we do with it.
Permissions we request, and why:
What we store as a result: your Page's ID, name, username, description and profile picture; an access token for each connected Page, which lets us act on your behalf; and, for each comment our rules evaluated, the comment and post IDs, the text of the comment, and the commenter's name and Facebook ID. If you use the moderation features, we also store the Facebook IDs you have blocked or chosen to mention.
What we never do with it: we do not sell it, rent it, or share it with data brokers. We do not use it for advertising or build advertising profiles from it. We do not send comment content to any AI or machine-learning service — Mentbot matches comments using keyword and hashtag rules that you write, and nothing more. We do not use it for any purpose other than operating the features you switched on.
Account details. When you register we collect your email address and a password (stored only as a cryptographic hash), or the email address and display name from your Google account if you sign in that way. Facebook is never a sign-in method for Mentbot — it is only ever linked to an account that already exists.
Billing details. Subscriptions are handled by Stripe. Your card details go to Stripe directly and never reach our servers. We store the billing name, address, and tax ID you enter for invoicing, and Stripe's identifiers for your customer and subscription records.
Content you create. The reply rules, message templates, and image attachments you configure, plus your notification preferences (including a Telegram chat ID if you connect Telegram alerts).
Technical data. Our servers log request metadata such as IP address, browser user agent, and the pages requested, for security and debugging. The marketing site (mentbot.com) uses Google Tag Manager and the Meta Pixel for visitor analytics and advertising measurement; the application itself (app.mentbot.com) carries no advertising or analytics trackers.
We process your account, Page and content data to perform the contract you entered into when you signed up. We process billing data to meet our legal obligations under Thai tax law. We rely on your consent for the marketing cookies on mentbot.com, and on our legitimate interest in keeping the service secure for server logs. Connecting a Facebook Page is always an explicit act of consent that you can withdraw at any time by disconnecting the Page.
We do not sell personal data. We share it only with the service providers Mentbot runs on, each processing it solely on our instructions:
These providers operate servers outside Thailand, so using Mentbot involves transferring data internationally. We would also disclose data if required by law, or transfer it as part of a sale of the business — in which case this policy would continue to apply until you were told otherwise.
Under the PDPA you may ask us for a copy of the personal data we hold about you, correct it, delete it, object to or restrict how we use it, or withdraw a consent you previously gave. Exercising any of these is free, and we respond within 30 days. Write to [email protected] from the address on your account. If you are not satisfied with our response, you may complain to Thailand's Personal Data Protection Committee.
You can also delete data yourself, immediately: use Delete account in the dashboard settings, disconnect an individual Page from the Pages screen, or remove Mentbot from your Facebook settings — which tells us to erase your Facebook data automatically. Full instructions are on our data deletion page.
All traffic to Mentbot is encrypted in transit with TLS. Facebook access tokens — both the Page tokens and the token for your linked Facebook account — are encrypted at rest with AES-256-GCM, so a database copy alone does not yield working tokens. Passwords are stored only as hashes. Notifications we receive from Meta are verified against a cryptographic signature before we act on them, so a forged request cannot make Mentbot post on your behalf. Access to production systems is limited to the operator named at the top of this policy.
No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal data we will notify you and the Thai authorities as the PDPA requires.
Mentbot is a business tool and is not directed at children. We do not knowingly collect data from anyone under 20. If you believe a child has given us personal data, contact us and we will delete it.
If we change how we handle personal data we will update this page and the date at the top. Material changes will also be announced by email to account holders before they take effect.
