1. Introduction
LFS Shanghai ("we", "our", "us") operates as a VIP travel assistance platform for Mongolian tourists visiting Shanghai, China. This Privacy Policy explains how we collect, use, process, and protect your personal information when you interact with our website (bileg11.github.io), Facebook Page, or Instagram account.
By using our services or messaging us on social media, you agree to the practices described in this policy.
2. Information We Collect
We may collect the following types of information:
- Messaging data: Text content of messages you send to our Facebook Page or Instagram account via Messenger or Direct Message
- Contact information: Name, phone number, email address when you submit a booking or inquiry
- Account identifiers: Facebook/Instagram user IDs (PSIDs) used to route replies back to you
- Usage data: Website activity collected via Google Analytics (anonymized)
- Technical data: IP address, browser type, device type
3. Facebook & Instagram Messaging Data
When you send a message to our Facebook Page via Messenger or to our Instagram account via Direct Message, our automated system processes your message to generate a helpful reply. Specifically:
- Your message text is received via Meta's Webhook API and processed in real-time
- We store only your Facebook/Instagram user ID (PSID/IGSID) in our database to prevent sending duplicate replies — this is a deduplication identifier only
- Message content itself is not permanently stored in our database
- We do not use your messages for advertising, profiling, or any purpose beyond generating a direct reply to your inquiry
4. Use of AI Services (GitHub Models / OpenAI)
To generate automated responses to your inquiries, the text of your message is sent to an AI language model provided by GitHub Models (a service by Microsoft that uses OpenAI's GPT-4o-mini model). This is our only sub-processor for message content.
- Only the text content of your message is transmitted — no personal identifiers (name, ID, phone number) are included
- GitHub Models / OpenAI processes your message solely to generate a reply and does not use your message data to train AI models (per their API data processing terms)
- Message content is not retained by GitHub Models / OpenAI beyond the duration needed to generate a response
- You can review OpenAI's data practices at openai.com/policies/api-data-usage-policies
5. Data Retention
We follow a strict minimal-retention policy:
- Message content: Not stored. Processed in memory and discarded immediately after a reply is generated
- System logs: Operational logs (for debugging and error monitoring) are retained for a maximum of 24 hours, after which they are automatically purged
- Deduplication IDs: Facebook/Instagram message IDs used to prevent duplicate replies are stored in our database. These contain no personal content and are rotated; we retain only the most recent 1,000 entries per user group
- Booking/inquiry data: Contact information submitted through our website forms is retained for up to 12 months for service fulfillment purposes
6. Instagram Message Deletion (Unsend)
If you delete (unsend) a message you previously sent to our Instagram account, we immediately honor that deletion:
- Instagram notifies our system of the deletion via a Webhook event in real-time
- Upon receiving an unsend notification, we immediately delete all records associated with that message from our database
- This process is fully automated and occurs within seconds of you unsending the message
- No copies of the deleted message content are retained anywhere in our systems
7. How We Use Your Information
We use collected information for the following purposes only:
- Responding to your inquiries and messages via Messenger and Instagram DM
- Processing and fulfilling travel service bookings
- Sending booking confirmations and service-related communications
- Improving our website and user experience (via anonymized analytics)
- Complying with legal obligations
We do not use your data for advertising targeting, selling to third parties, or any purpose not listed above.
8. Third-Party Service Providers
We work with the following sub-processors who may handle your data on our behalf:
- Google Firebase: Database and authentication services — Privacy policy
- GitHub Models (Microsoft/OpenAI): AI response generation — message text only, no personal identifiers
- Meta Platforms: Facebook and Instagram messaging infrastructure
- Google Analytics: Anonymized website traffic measurement
- Railway: Webhook server hosting (no persistent data storage)
We do not sell, rent, or share your personal information with any other third parties.
9. Data Security
We implement appropriate technical and organizational measures to protect your information:
- All data in transit is encrypted using TLS/SSL
- Database access is restricted using Firebase Security Rules
- API tokens and credentials are stored as environment variables, never in source code
- We minimize data collection to only what is strictly necessary
10. Your Rights
You have the following rights regarding your personal data:
- Access: Request a copy of the information we hold about you
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your personal data
- Objection: Object to processing of your data
- Portability: Request your data in a portable format
To exercise any of these rights, please contact us via the channels listed in Section 12.
11. Children's Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
- Email: lfs.shanghai1@gmail.com
- Facebook: LFS Shanghai Facebook Page
- Website: bileg11.github.io
We will respond to all privacy-related requests within 30 days.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.