Authorised Page
Access is granted by the merchant and limited to the eligible Business Page it selects.
Data and security
Least-privilege access and an auditable data path
Our security statements reflect the current architecture, not certifications or audits that ComeSeeBuy does not yet hold.
Signed webhook events
Incoming Meta webhook events are checked against a signature based on the app secret.
Duplicate protection
A repeated event delivery must not create a second reservation or a second message.
Data minimisation
We do not store payment-card numbers or raw webhook payloads when a normalised event and payload hash are sufficient.
Encrypted transport
Public traffic uses HTTPS; secrets are kept outside the source repository.
Merchant control
Disconnecting stops future access, while a verified request starts deletion or irreversible anonymisation of eligible data.