1. Who this policy covers
My Next Prospect is a prospecting and relationship-management service. Copilot assists users with Facebook information visible in their browser and with outreach workflows. This policy covers information processed through these products, including visitors, account holders, workspace members, prospects and appointment participants.
A business using a workspace decides which people to add, what campaigns to run and how to use their information. That business is responsible for its own notices, permissions and lawful use of personal information. Facebook, Meta and other linked services have their own privacy policies; this policy does not replace them.
2. Information processed
- Account and contact information: names, email addresses, sign-in information, workspace membership, account status and settings. Prospect and booking records may include contact details supplied by users or appointment participants.
- Facebook identities and activity: display names, profile IDs, profile URLs, visible comments and reactions, group context, post text and post URLs selected or captured by a user. A missing profile link is not replaced with a link guessed from a name.
- Prospect information: imported list records, notes, sources, tags, qualification details, pipeline status and relationship history. Users may enter information about interests, occupation or retirement and annuity-related topics. Avoid adding sensitive information that is not needed for the relationship.
- Conversations: saved outbound messages and visible inbound Messenger replies, sender and recipient identifiers, thread IDs, message text, available timestamps, unread state and campaign association. AI features may produce intent labels, scores, summaries and suggested responses.
- Campaign and appointment activity: campaign instructions, message drafts, queue and scheduling records, confirmed sends, friend-request outcomes, pauses, errors, appointment details and analytics.
- Operational information: pairing information, browser tab references used by Copilot, capture and reply delivery state, failure reasons and diagnostic logs. Website requests also expose ordinary connection information, such as IP address and browser request headers, to hosting and other services receiving those requests.
3. Facebook and Copilot
Reaction, comment and group-member captures start when you choose a capture action. Copilot reads content Facebook has rendered in your browser; these capture tools do not automatically scroll or load more people. Information queued for transfer is delivered to a paired My Next Prospect website tab and then saved to the workspace.
Copilot can also detect newly visible replies in an open Messenger conversation and queue them for the Inbox. The Sync replies action can recover eligible visible replies. This is browser-based capture, not a sanctioned personal-profile Messenger webhook or an API that discovers every unopened chat. The service cannot promise that every Facebook reply will be captured.
When you start an outreach workflow, Copilot uses the Facebook or Messenger interface to carry out the selected actions and report their outcomes. Facebook receives messages and friend requests made through its interface. Importing or capturing a list does not itself send a message. Facebook permissions, availability and restrictions still apply; access to visible information is not permission to use it for any purpose.
4. How information is used
Information is used to sign people in, manage workspace access, maintain prospect lists and conversation history, prepare and track outreach, detect replies, qualify interest, suggest responses, arrange appointments and display activity and performance. Delivery state and diagnostics help recover interrupted transfers, avoid duplicate records, investigate failures and enforce outreach controls.
AI features process relevant prospect, campaign and conversation context to generate or review responses. AI classifications and suggestions can be inaccurate; they are not verified facts about a person or financial, legal or other professional advice.
5. Access and service providers
Information may be available to authorized members of the relevant workspace and administrators according to their roles, including administrative account-management and view-as-agent functions. It is also processed by services needed to operate the product:
- Database and authentication infrastructure stores account, prospect, campaign, conversation and activity records.
- Lovable hosting and AI services: the AI reply flow sends selected context and reply content through Lovable’s AI gateway to an OpenAI model, including a separate response-quality review where used. Error-reporting integrations may receive error details and page context. This policy does not promise zero provider retention or exclusion from model training; those practices depend on provider terms and the operator’s configuration.
- Meta/Facebook/Messenger: processes activity performed on its services under its own policies.
- Optional calendars: when configured and connected, Google or Microsoft integrations process account identity, calendar availability and appointment/event information and use stored authorization credentials.
- Email notifications: when configured, Resend processes recipient details and notification content, directly or through the Lovable connector gateway.
CSV exports place information in a file controlled by the person downloading it. Connected services and recipients may keep their own copies. Applicable law, lawful requests or resolving security and service disputes may also require disclosure; this policy makes no promise that information is never shared.
6. Cookies and local storage
The website uses browser storage for sign-in sessions, preferences and local progress. Copilot uses Chrome extension storage for pairing, capture drafts, pending capture and reply queues, run state, counters, cooldowns and diagnostics. This storage supports the requested service rather than a complete record of all browsing activity.
Pages request externally hosted fonts from Google. Your browser sends ordinary request information to that service. Hosting and connected services may use their own cookies or storage under their policies. This notice does not assert that every third-party tracking or cookie setting has been independently audited.
Browser settings can clear website storage; Chrome’s extension controls can remove Copilot. Doing so may sign you out or lose unsaved captures and pending transfers. It does not delete records already saved in a workspace or sent to other services.
7. Retention and deletion
Saved information remains in the workspace until it is removed through an available control or an appropriate deletion process. There is no verified automatic deletion timetable covering all records, logs, backups or service-provider copies. Pending extension queues remain locally available for delivery or retry until acknowledged or otherwise removed; cancelling an unfinished capture removes that draft.
Not every removal action is erasure. Removing a chat from the Inbox dismisses it while retaining history. Admin Delete agent archives or disables the account rather than deleting prospect, campaign or conversation history. Disconnecting or unpairing is not a request to erase all saved or locally queued information.
Requests may need to account for shared business records, legal obligations, backups and copies held by recipients or service providers. Deleting an app record does not unsend a Facebook message or erase a recipient’s copy. A comprehensive self-service account-erasure control and a guaranteed backup-deletion schedule are not currently provided by this notice.
8. Your choices and requests
You can choose what to capture or import, pause or stop outreach, disconnect available integrations, remove Copilot, and use available record editing, removal and export controls. These choices have different effects; see the deletion limitations above.
Depending on your location and the circumstances, applicable law may provide rights to access, correct, delete or receive a copy of information, or to object to or restrict processing. These rights are not unconditional. Identity and authority may need to be verified before information is disclosed or changed.
If you are a prospect, contact the business that contacted you to ask about its records or to object to further outreach. If you use a workspace, contact your workspace administrator for help with its records. Neither an opt-out from messages nor an account archive automatically erases past records.
9. Security and international processing
The implementation includes sign-in and workspace access restrictions. These controls do not establish a security certification or guarantee that information can never be lost, accessed without authorization or misused. Use appropriate account and device protection and avoid uploading unnecessary sensitive information.
Service providers may process information in locations different from yours. Specific storage regions, contractual transfer safeguards and provider retention commitments need to be confirmed by the service operator; this notice does not claim a particular residency or compliance certification.
10. Children
My Next Prospect is a business prospecting service, not a service designed for children. Users should not knowingly add children’s information for prospecting. If you believe a child’s information has been included, request review and removal through the channels below. No age-verification guarantee is made.
11. Changes to this policy
This policy may be revised as features and practices change. The updated version will appear on this page with a revised date. Any additional notice required by applicable law should be provided when relevant.
12. Contact and privacy requests
For workspace records, contact your workspace administrator. For outreach received from a business using My Next Prospect, contact that business using the contact details it provided. Describe whether you want access, correction, export, deletion or to stop further contact; do not send passwords or unnecessary sensitive documents.
Direct My Next Prospect privacy contact: pending owner verification. No verified public privacy email address or online privacy-request form is currently listed. A direct contact channel must be confirmed before this notice is finalized for publication or Chrome Web Store submission. This page does not submit a request on your behalf.