ProtikManager

Privacy Policy

Last updated 12 August 2026

1. Who we are and what this covers

ProtikManager is a management platform for internet service providers (ISPs). It helps an ISP manage its network equipment, subscriber accounts, billing and customer support.

This policy explains what information the platform collects, how it is used, who it is shared with, and how it can be deleted. It covers both the ProtikManager platform and the Facebook Messenger assistant that an ISP can connect to its own Facebook Page to answer customer questions.

2. Who controls your information

Each ISP that uses ProtikManager operates its own separate workspace and connects its own Facebook Page. That ISP decides what customer records it keeps and which features it switches on, and it is the controller of its customers' information.

ProtikManager provides and operates the software, and processes information on the ISP's behalf. Workspaces are kept separate from one another — one ISP cannot see another ISP's customers, messages or records.

If you are a customer of an ISP and you want your records corrected or removed, you can contact your ISP directly or contact us using the details in section 15 and we will pass the request on.

3. Information we receive from Facebook and Messenger

When you send a message to an ISP's Facebook Page that has the assistant switched on, we receive and process:

Your Page-scoped ID. This is an identifier Meta generates that is unique to you for that one Page. It cannot be used to identify you on Facebook generally or on any other Page.
The text of the messages you send to the Page, and the replies sent back to you.
The type of any attachment you send — for example "image" or "video". Attachment files are not downloaded; they stay with Meta and are replaced with a short note telling the assistant that a file was sent without text.
Conversation labels applied by the ISP's staff. The ISP's staff can label a conversation in their Meta inbox with the customer's account number or service area. We read those labels so the assistant knows which account it is helping.
A Page access token, provided by an administrator of that Page, which lets the assistant read the labels above and send replies.

What we do not collect. ProtikManager does not use Facebook Login. We never ask you to sign in with Facebook, and we do not request or receive your Facebook profile — no name, profile photo, email address, birthday, gender, location, friends list, posts, likes or any other public profile field. The only identifier we receive about you from Meta is the Page-scoped ID described above.

4. Facebook permissions we use

The Page administrator grants these permissions when connecting a Page. Each one is used only for the purpose listed:

Permission	Why it is needed
`pages_messaging`	Receive messages sent to the Page, send replies, and hand a conversation over to a human agent when needed.
`pages_manage_metadata`	Subscribe the Page to message webhooks and read the conversation labels the ISP's staff apply.
`pages_show_list`	Confirm that the person connecting the Page administers it, and read that Page's labels.
`pages_read_engagement`	Read the connected Page's own details where Meta requires it alongside the permissions above.

5. Other information we process

Separately from Messenger, the platform stores information the ISP enters or that you provide directly:

Subscriber records kept by the ISP: name, service address, contact number, email address, internet plan, billing and payment status, and — where the ISP's technicians have recorded it — the map coordinates of the service installation.
Customer portal accounts: your email address and password. If you sign in with Google, we receive your Google account ID, email address and name from Google; we do not receive or store your Google password or profile photo.
One-time passcodes used to verify a request, together with the email address or mobile number the code was sent to, and the IP address that requested it.
Support tickets: the name, contact number and address you provide, plus the messages and any files attached to the ticket.
Activity logs recording actions taken in the platform, including the IP address and the action performed. These are an audit trail for the ISP.

6. How we use information

We use the information above to:

answer your questions about the ISP's service;
confirm which account you are asking about, so account information is only given to the right person;
tell you your outstanding balance, due date, plan and price;
check whether your connection is currently online and whether there is a known outage in your area;
create a support ticket for the ISP's staff when a problem needs a human, and notify those staff;
send billing notices, payment confirmations, statements and one-time passcodes by email or SMS;
keep the platform secure, investigate abuse, and resolve disputes.

We do not use your information for advertising, and we do not build advertising profiles.

7. Automated replies and AI processing

Replies in Messenger are generated by an AI assistant. To produce a reply, the following is sent to a large-language-model provider: your message, a short window of recent messages in the same conversation, relevant excerpts from documents the ISP has uploaded, and — where the assistant has confirmed your account — your name and account number together with the specific result it looked up (for example your balance or connection status).

The provider is chosen by the ISP and is either Anthropic or OpenAI. Each ISP uses its own API key with that provider.
The search index used to find relevant document excerpts is built on our own servers. That step does not send your message to any third party.
A human agent from the ISP can take over the conversation at any time, which pauses the assistant.

We do not sell personal information and we do not share it for advertising. We share it only with the service providers below, and only to the extent shown:

Provider	What is shared
Meta (Facebook)	Your Page-scoped ID and the reply text, in order to deliver the reply to you in Messenger.
Anthropic or OpenAI	The message content and account details described in section 7, using the ISP's own API key.
Semaphore (SMS)	Your mobile number and the text of the SMS, when the ISP sends billing notices or passcodes by SMS.
Xendit and PayMongo (payments)	No personal information. Only the amount, a billing reference number and the return links. Card and e-wallet details are entered on the payment provider's own page and never reach us.
The ISP's own email server	Your email address and the contents of billing notices, statements, passcodes and verification messages.
Google	reCAPTCHA runs when an account is registered, to block automated sign-ups. Google Sign-In is used only if you choose it. Encrypted platform backups are stored in the operator's own Google Drive.
OpenStreetMap and OSRM	Map tiles and driving directions for the ISP's technicians. Used only inside the staff application when a technician navigates to an installation; it is not triggered by customer activity.

We may also disclose information where we are required to by law, or to protect the rights and safety of our users.

9. How long we keep information

Messenger conversation history used to give the assistant short-term memory is kept for 30 days, and only the most recent messages of each conversation are retained.
The link between your Page-scoped ID and an account is a cache that expires after 60 minutes and is re-checked from scratch afterwards.
Documents the ISP uploads for the assistant to answer from are kept until the ISP deletes them. Deleting a document removes both the file and its search index entries.
Troubleshooting and audit records — a record of each lookup the assistant performed, including the fault description it was given — are kept for security review and dispute resolution until the account is deleted, or until you ask us to remove them (see section 10).
Subscriber, billing and support records are kept by the ISP for as long as it needs them to provide and account for the service.
Server health measurements are kept for 30 days.

10. Data deletion

You can ask us to delete the information we hold about your Messenger conversation with an ISP's Page.

How to request deletion. Email rafaelmartinmariano@gmail.com with the subject line “Data deletion request” and include:

the name of the Facebook Page you messaged, and
the Facebook account you messaged from (so we can identify the correct conversation).

What we delete. The stored link between your Page-scoped ID and any customer account, the retained conversation history for that thread, and the troubleshooting and audit records associated with it.

How long it takes. We will confirm and complete the request within 30 days.

Please note that the messages themselves also exist in the Page's inbox on Facebook. Those are held by Meta and the Page owner — deleting them is done from Facebook, or by asking the ISP that owns the Page.

Some deletion is also available directly, without contacting us:

An ISP can change or remove the Facebook Page connected to its workspace, and can delete any document it uploaded for the assistant.
A customer portal user can unlink an account from their portal login at any time.
To request deletion of your ISP account records generally, contact your ISP, or email us at rafaelmartinmariano@gmail.com and we will forward the request.

11. Security

Facebook Page access tokens and AI provider API keys are encrypted at rest.
Passwords and one-time passcodes are stored only as irreversible hashes, never in readable form.
Traffic to the platform and the customer portal is protected with TLS.
Each ISP's data is isolated to its own workspace, and staff access is limited by role-based permissions set by the ISP.
Requests from the automation service that runs the assistant are authenticated with a shared secret, and the assistant re-verifies for itself which account a conversation belongs to rather than trusting what it is told.

No system is perfectly secure, but we take these measures to protect information against unauthorised access, alteration and loss.

12. Children

ProtikManager is a business tool for internet service providers and their account holders. It is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us with information, contact us and we will delete it.

13. International transfers

ProtikManager operates from the Philippines. Some of the service providers listed in section 8 — in particular the AI, payment and messaging providers — process information on servers outside the Philippines. Where that happens, the information is limited to what is described in this policy.

14. Changes to this policy

We may update this policy as the platform changes. When we do, we will update the “Last updated” date at the top of this page. Material changes will be described on this page. Continued use of the service after an update means you accept the revised policy.

15. Contact us

For any question about this policy, your information, or a deletion request:

ProtikManager
Email: rafaelmartinmariano@gmail.com
Phone: +63 9357237046
Address: Bulacan, Philippines