Privacy Policy

1. What Jumpr Is

Jumpr is a technical bridge between Meta and Odoo Online. It receives events through Meta's official webhooks for Messenger and Instagram Messaging, validates and normalizes those events, and forwards them to the Odoo webhook configured by our customer.

Jumpr is not a CRM, does not decide whether a lead is created, does not reply to end users, and does not access complete conversation histories.

2. Our Role as Service Provider / Processor

Jumpr acts strictly as a Data Processor / Service Provider on behalf of our customers.

Our customer, meaning the business that connects its Meta Page or Instagram account, is the Data Controller for end-user messaging data. Jumpr processes that data only according to the customer's instructions and solely to provide the integration service.

For Jumpr administrator accounts authenticated through Google, Jumpr acts as the Data Controller.

3. Information We Collect

For Jumpr administrator accounts, we may collect:

• Name.
• Email address.
• Profile picture.
• Google ID.
• Session information.

For configured integrations, we may store:

• Integration name.
• Channel.
• Meta App ID.
• Encrypted App Secret.
• Encrypted Access Token.
• Verify Token.
• Odoo webhook URL.
• Company ID.
• Integration status.

For Meta events processed on behalf of our customers, we may process:

• Channel.
• Event type.
• Sender ID, including PSID or IGSID.
• Recipient ID.
• Message ID.
• Message text, when provided by Meta.
• Attachment metadata.
• Timestamp.
• Echo indicator.
• Sender name or username when Meta makes that information available.

4. How We Use Information

We use information only to:

• Authenticate Jumpr administrators.
• Allow integrations to be configured and operated.
• Validate Meta webhook signatures.
• Normalize incoming events.
• Enrich events with sender names when available.
• Forward events to the customer's configured Odoo webhook.
• Record delivery status and technical errors.

We do not use this data for advertising, profiling, sale of personal data, model training, or unrelated purposes.

5. Retention

Complete webhook payloads stored temporarily in Cloudflare KV are automatically deleted after 72 hours.

Operational metadata stored in Cloudflare D1 may be retained for up to 90 days for auditing, security, and diagnostic purposes.

Integration credentials are deleted when the customer deletes the corresponding integration.

Cached sender profile information, such as names or usernames, may be stored temporarily to reduce repeated requests to Meta.

End-user data stored within the customer's Odoo environment is governed by that customer's own retention policies and practices.

6. Data Sharing / Sub-processors

Jumpr shares or processes data only with services required to provide the integration:

• Cloudflare — hosting, serverless execution, KV storage, and D1 database.
• Google — OAuth authentication for Jumpr administrators.
• Meta — source of Messenger and Instagram webhook events and related API data.
• Customer's Odoo Online — destination selected and configured by the customer.

Jumpr does not sell personal data or share it with advertisers or data brokers.

7. Relationship with Our Customers' Privacy Policies

Our customers are required to maintain their own publicly accessible Privacy Policy disclosing their use of Meta communication channels and their use of Logic Omnipresence / Jumpr and Odoo as service providers.

End users who contact a business through Messenger or Instagram should refer to that business's Privacy Policy for information about how their inquiry and personal data are handled, including retention and deletion practices.

8. Security

Jumpr uses reasonable technical security measures, including:

• HTTPS.
• HttpOnly session cookies.
• Meta signature validation using X-Hub-Signature-256.
• Encryption at rest for stored secrets and access tokens.
• Separation between temporary webhook payloads and persistent operational metadata.

9. Data Subject Rights & Meta Data Deletion

Jumpr administrator users may contact [email protected] to request access to or deletion of their Jumpr administrator account.

End users who wish to delete data related to a message sent to a business through Messenger or Instagram should contact that business directly using the contact and data deletion instructions contained in the business's own Privacy Policy.

End users may also contact [email protected] and provide the relevant Meta Page or Instagram account, channel, and sender ID. Jumpr will delete or anonymize applicable temporary data that it still retains within 15 business days, except where limited retention is required by law, security obligations, or abuse prevention.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The current version will be published on the official Jumpr website.