Legal & compliance
MsgMaven Meta App Review Information
Last updated: July 2026
This page explains, for Meta reviewers and connecting businesses, exactly what MsgMaven does, why it requests each permission, and how customer data is handled.
App purpose
MsgMaven helps businesses manage inbound Instagram and WhatsApp customer enquiries in one AI-assisted inbox. It is used only by businesses that connect their own Instagram professional account and WhatsApp Business number. MsgMaven is a customer-support and lead-management tool — nothing more.
What the app does
- Reads inbound Instagram messages after the business grants permission.
- Reads inbound WhatsApp messages from the business's own WhatsApp Business number.
- Displays conversations in a unified inbox.
- Classifies enquiry type (price, size, delivery, booking, availability, and more).
- Suggests editable replies tuned to the business's rules, tone, and policies.
- Helps identify hot leads with a simple lead score.
- Helps teams follow up with inbound enquiries so they do not go cold.
What the app does not do
- Does not scrape Instagram or WhatsApp.
- Does not send cold outreach.
- Does not send bulk spam.
- Does not message users without prior inbound contact or permitted business context.
- Does not sell data to advertisers.
- Does not use user data for unrelated AI training.
- Does not bypass Meta permissions.
- Does not impersonate users.
Test business — Vianah Kids Couture
The first test workflow is for an Instagram-first kids couture boutique, Vianah Kids Couture. Customers ask about outfit price, age/size, delivery city, availability, customization, and payment. MsgMaven captures these inbound messages and suggests team-editable replies. For example:
- Customer: “How much for this dress for my 4-year-old?” → Intent: Price enquiry + size/age → Lead status: Warm/Hot → Suggested reply: “Sure 😊 Please share the screenshot or name of the dress, your child's age, and delivery city. I'll confirm price, availability, and delivery timeline.”
- Customer: “Can you deliver to Pune by Friday?” → Intent: Delivery urgency → Lead status: Hot → Suggested reply: “Yes, we can check that. Please share the outfit screenshot/name, child's age, and your full delivery city/pincode. I'll confirm if Friday delivery is possible.”
Why we need each permission
Exact permission names below reflect our current Meta app configuration. Where a scope name differs in your review environment, the same purpose applies.
Instagram (via Facebook Login)
| Permission | Why it is needed | Where the user sees the benefit |
|---|---|---|
| instagram_basic | Read the connected professional account's basic profile to display it in the app. | Their connected account and handle appear in Settings and the inbox. |
| instagram_manage_messages | Receive inbound DMs via webhooks and send replies inside the messaging window, on the business's behalf. | Inbound DMs appear in the unified inbox; the team can reply from there. |
| pages_show_list | Let the admin pick which of their Facebook Pages (linked to the IG account) to connect. | Account selection screen during onboarding. |
| pages_manage_metadata | Subscribe the Page to message webhooks so inbound DMs are delivered to the inbox. | “Webhooks active” shows green in the diagnostics checklist. |
| pages_read_engagement | Read the Page's linked Instagram account details needed to route messages correctly. | Messages are attributed to the correct conversation and customer. |
WhatsApp Business Platform (Cloud API)
| Capability | Why it is needed | Where the user sees the benefit |
|---|---|---|
| whatsapp_business_management | Read the connected WhatsApp Business Account and phone number details via Embedded Signup. | Connected number and status appear in Settings → Channels. |
| whatsapp_business_messaging | Receive inbound messages via webhooks and send free-form replies inside the 24-hour customer-service window (approved templates for follow-ups outside it). | Inbound WhatsApp enquiries appear in the inbox; the team replies from there. |
Data handling
- What we collect: the connected account's profile details, inbound message content, and customer identifiers (name, handle, phone number) received through official webhooks, plus team notes and tags.
- Why: to display, organise, classify, and reply to inbound enquiries in the business's inbox.
- Where it is displayed: only inside the connecting business's workspace, to its authorised team members.
- Retention: data is retained while the account is connected. On disconnect or deletion request, access tokens are removed and associated conversation data is deleted per our retention policy.
- Security: access tokens are encrypted at rest (AES-256-GCM), webhooks are verified with the app secret signature (X-Hub-Signature-256), and all access is scoped per business with role-based access control.
Reference documents: Privacy Policy · Terms of Service · Acceptable Use Policy · Security · Data Deletion · Disconnect Account.
MsgMaven implements Meta's Data Deletion Request callback at https://app.msgmaven.com/api/meta/data-deletion, which verifies the signed request, revokes the associated Meta connection data, and returns a confirmation code and status URL. Users can also request deletion from the Data Deletion page or by emailing privacy@msgmaven.com.
Demo steps for the reviewer
- Go to MsgMaven.
- Create or access a test workspace.
- Connect the Instagram professional account (via Facebook Login, selecting the linked Page).
- Connect the WhatsApp Business number (via Embedded Signup).
- Receive or view test inbound enquiries.
- See messages appear in the unified inbox.
- Open a conversation.
- View classification tags.
- View the suggested reply.
- Edit and send, or copy the reply, depending on enabled functionality.
- Mark lead status.
- Disconnect the account from Settings → Channels.
- Access the data deletion page to request deletion.
Summary for reviewers
MsgMaven is for inbound business enquiries only. It does not perform scraping, spam, or mass unsolicited messaging. Every business connects and controls its own accounts, and can disconnect or delete its data at any time.