1. Introduction
LFS Shanghai ("we", "our", "us") operates as a VIP travel assistance platform for Mongolian tourists visiting Shanghai, China. This Privacy Policy explains how we collect, use, process, and protect your personal information when you interact with our website (lfsshanghai.com), Facebook Page, or Instagram account.
By using our services or messaging us on social media, you agree to the practices described in this policy.
2. Information We Collect
We may collect the following types of information:
- Messaging data: Text content of messages you send to our Facebook Page or Instagram account via Messenger or Direct Message
- Contact information: Name, phone number, email address when you submit a booking or inquiry
- Account identifiers: Facebook/Instagram user IDs (PSIDs) used to route replies back to you
- Usage data: Website activity collected via Google Analytics and the Meta Pixel (pseudonymized — identified by cookie and IP address, not by name)
- Technical data: IP address, browser type, device type
3. Facebook & Instagram Messaging Data
When you send a message to our Facebook Page via Messenger or to our Instagram account via Direct Message, our automated system processes your message to generate a helpful reply. Specifically:
- Your message text is received via Meta's Webhook API and processed in real-time
- We store only your Facebook/Instagram user ID (PSID/IGSID) in our database to prevent sending duplicate replies — this is a deduplication identifier only
- Message content itself is not permanently stored in our database
- We do not use your messages for advertising, profiling, or any purpose beyond generating a direct reply to your inquiry
4. Use of AI Services (GitHub Models / OpenAI)
To generate automated responses to your inquiries, the text of your message is sent to an AI language model provided by GitHub Models (a service by Microsoft that uses OpenAI's GPT-4o-mini model). This is our only sub-processor for message content.
- Only the text content of your message is transmitted — no personal identifiers (name, ID, phone number) are included
- GitHub Models / OpenAI processes your message solely to generate a reply and does not use your message data to train AI models (per their API data processing terms)
- Message content is not retained by GitHub Models / OpenAI beyond the duration needed to generate a response
- You can review OpenAI's data practices at openai.com/policies/api-data-usage-policies
5. Data Retention
We follow a strict minimal-retention policy:
- Message content: Not stored. Processed in memory and discarded immediately after a reply is generated
- System logs: Operational logs (for debugging and error monitoring) are retained for a maximum of 24 hours, after which they are automatically purged
- Deduplication IDs: Facebook/Instagram message IDs used to prevent duplicate replies are stored in our database. These contain no personal content and are rotated; we retain only the most recent 1,000 entries per user group
- Booking/inquiry data: Contact information submitted through our website forms is retained for up to 12 months for service fulfillment purposes
6. Instagram Message Deletion (Unsend)
If you delete (unsend) a message you previously sent to our Instagram account, we immediately honor that deletion:
- Instagram notifies our system of the deletion via a Webhook event in real-time
- Upon receiving an unsend notification, we immediately delete all records associated with that message from our database
- This process is fully automated and occurs within seconds of you unsending the message
- No copies of the deleted message content are retained anywhere in our systems
7. How We Use Your Information
We use collected information for the following purposes only:
- Responding to your inquiries and messages via Messenger and Instagram DM
- Processing and fulfilling travel service bookings
- Sending booking confirmations and service-related communications
- Improving our website and user experience (via analytics)
- Advertising and measurement: we send website activity — such as page views, booking form submissions, and clicks on our Messenger links — to Meta via the Meta Pixel, so that we can measure our advertising and show relevant ads on Facebook and Instagram (see Section 13)
- Complying with legal obligations
We do not send your name, phone number, or email address to Meta through the Pixel, and we do not sell or rent your personal information to anyone. We do not use your data for any purpose not listed above.
Реклам болон хэмжилтийн зорилгоор Meta Pixel-ээр хуудас үзсэн, захиалгын форм илгээсэн, Messenger линк дарсан зэрэг үйлдлийн дата Meta рүү илгээгддэг. Таны нэр, утасны дугаар, э-мэйлийг Pixel-ээр илгээдэггүй. Таны хувийн мэдээллийг хэнд ч зардаггүй, хөлслүүлдэггүй.
8. Third-Party Service Providers
We work with the following sub-processors who may handle your data on our behalf:
- Google Firebase: Database and authentication services — Privacy policy
- GitHub Models (Microsoft/OpenAI): AI response generation — message text only, no personal identifiers
- Meta Platforms: Facebook and Instagram messaging infrastructure, and — via the Meta Pixel — advertising measurement and audience creation for our Facebook and Instagram ads (website activity only; no name, phone number, or email address) — Privacy policy
- Google Analytics: Website traffic measurement
- Railway: Webhook server hosting (no persistent data storage)
Apart from the sub-processors listed above, we do not share your personal information with other third parties. We do not sell or rent your personal information to anyone.
Дээр жагсаасан үйлчилгээ үзүүлэгчдээс бусад гуравдагч талд таны хувийн мэдээллийг хуваалцдаггүй. Таны хувийн мэдээллийг хэнд ч зардаггүй, хөлслүүлдэггүй.
9. Data Security
We implement appropriate technical and organizational measures to protect your information:
- All data in transit is encrypted using TLS/SSL
- Database access is restricted using Firebase Security Rules
- API tokens and credentials are stored as environment variables, never in source code
- We minimize data collection to only what is strictly necessary
10. Your Rights
You have the following rights regarding your personal data:
- Access: Request a copy of the information we hold about you
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your personal data
- Objection: Object to processing of your data
- Portability: Request your data in a portable format
To exercise any of these rights, please contact us via the channels listed in Section 12.
11. Children's Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
- Email: lfs.shanghai1@gmail.com
- Facebook: LFS Shanghai Facebook Page
- Website: lfsshanghai.com
We will respond to all privacy-related requests within 30 days.
13. Cookies and Advertising Technologies
This website uses the Meta Pixel and cookies to measure how visitors use our pages and to show relevant advertising on Facebook and Instagram. The Meta Pixel records events such as page views, booking submissions, and clicks on our Messenger links. We do not send your name, phone number, or email address to Meta through the Pixel. You can block or delete cookies at any time in your browser settings, or use your browser's tracking-protection features — our services will continue to work normally.
Энэ сайт нь Meta Pixel болон cookie ашиглан хэрэглэгчийн хөдөлгөөнийг хэмжиж, Facebook, Instagram дээр тохирсон реклам харуулдаг. Meta Pixel нь хуудас үзсэн, захиалга илгээсэн, Messenger линк дарсан зэрэг үйлдлийг тэмдэглэдэг. Таны нэр, утасны дугаар, э-мэйлийг Pixel-ээр Meta рүү илгээдэггүй. Та браузерынхаа тохиргоогоор cookie-г хүссэн үедээ хааж эсвэл устгаж болно — үйлчилгээ хэвийн ажиллана.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.