Privacy Policy

Last updated: 28 October 2026

Who we are

Doyspot is a customer relationship management (CRM) service operated by Monocollectif. It collects the submissions that businesses receive through lead forms in their Facebook and Instagram ads and lets their sales teams follow up on them.

Businesses that use Doyspot are the data controllers of the lead data from their own ads. Doyspot acts as a data processor, processing that data on the business's behalf and on its instructions.

What data we process

Lead data. Information people voluntarily share in Meta lead forms:

• Full name, phone number, email address
• Country and city
• Answers to any other questions on the form (such as the service they are interested in)
• The ad, ad set, campaign and form the submission came from

In addition, call notes and sales stages entered by the business's team are stored.

Doyspot user data. The name and email address of people who create an account, an irreversible hash of their password (the password itself is never stored), the business they belong to, and the names and IDs of the Facebook Pages they connect.

Permissions we receive from Meta

When a business connects its Facebook account to Doyspot, it grants the following access. Each is used only for the stated purpose:

• Page list and Page details: so you can choose which Pages to connect.
• Lead form submissions: to bring the leads from your forms into your dashboard.
• Page settings (webhook subscription): to be notified the moment a new lead arrives.
• Pixel / dataset: to report each lead's sales stage back to Meta.

How we use the data

• So the business can contact the person and respond to their request
• To track which stage of the sales process each lead is in
• To measure ad performance: the lead's stage is reported to the business's own Meta pixel through the Conversions API. In these reports, contact details such as email and phone are sent only as irreversible SHA-256 hashes.

We do not sell data, we do not pass it to third parties for advertising, and we never share one business's data with another.

Where we store the data

Data is stored on servers in the European Union (Frankfurt), in a database protected by authentication. Each business's data sits in a separate workspace and is visible only to the users that business has authorised.

The infrastructure providers we use to run the service (hosting and database) access data only to the extent needed to operate the service.

How long we keep it

Lead records are kept for up to 24 months after the related sales process closes, then deleted, or earlier on request. When a business closes its account, its data is deleted within 30 days.

Requests from public authorities

If a public body or law enforcement agency requests personal data, we follow this process:

1. Legality review: the legal basis, scope and the requesting authority's competence are reviewed before any data is shared.
2. Right to challenge: where a request is unlawful, unauthorised or disproportionate, we decline to share and challenge it through legal channels.
3. Data minimisation: where disclosure is required, only the minimum information needed to satisfy the request is provided.
4. Record keeping: each request is logged with its date, the requesting authority, its legal basis, our response and who made the decision.

Unless legally prohibited, we try to inform the person whose data was requested and the business concerned.

Your rights

Under the Turkish Personal Data Protection Law (KVKK No. 6698) and, where applicable, the GDPR, you have the right to know whether your data is processed, to ask for it to be corrected or deleted, and to object to processing. If you filled in a business's ad form, you can send your request to that business or directly to us.

Data deletion requests

How to request deletion is explained on the Data deletion page.

Contact

For any questions: monocollectifofficial@gmail.com