Meta App Review Submission Kit

QUEEN OF HEAVEN is the official online client-service app for Dr. Nkosazana, a solo spiritual oracle and product seller operating from South Africa. The Instagram account @queenofheaven (the business's public Instagram presence) receives daily DMs from people who see the account's paid Instagram ads and organic posts and want to book a reading or buy a spiritual product.

We use the Instagram Graph API messaging endpoints to automate the first line of client service inside Instagram DMs, so that every person who messages the business after seeing an ad gets an immediate, consistent reply 24/7 while Dr. Nkosazana is offline. The automation:

- Greets a new DM with a welcome menu (Reading / Product / Elite Club).
- Lets the person browse a product catalog and reading list with quick-reply buttons.
- Collects the person's intent ("Yes, I'm ready to pay" / "Maybe later") and notifies Dr. Nkosazana so she can step in personally to take payment and fulfil the order.
- Answers common FAQ (delivery time, delivery cost, payment methods, privacy, why a photo is needed) without human intervention.
- Politely asks non-English messages to switch to English so Dr. Nkosazana can serve everyone fairly.

No message is ever sent to a person who has not first messaged the business. All automated replies stay inside the standard 7-day messaging window. The business never sends promotional or marketing content via DM — every message is a direct response to the person's own message or quick-reply tap. This is purely customer-service automation for an existing Instagram Business account, not a broadcast tool.

How we use it:
We receive the person's DM via the webhook (entry.messaging), store it, and reply with a text message or a message containing quick-reply buttons using the Send API (POST /{ig-user-id}/messages). We never send a message to a person who has not first messaged us. We never send promotional or marketing content — every reply is a direct response to the person's own message or a quick-reply tap they made.

Step-by-step test instructions for the reviewer:
1. Open Instagram on a second test account (not the business account) and DM the business Instagram account @queenofheaven with the word "hi".
2. Within a few seconds you will receive an automated welcome menu with three quick-reply buttons: "Reading", "Product", "Elite Club".
3. Tap "Product" → you receive a category menu. Tap a category → you receive a product list. Tap a product → you receive the product description and price with "Order Now" / "Maybe later" buttons.
4. Tap "Order Now" → you receive a confirmation prompt. Tap "Yes, I'm ready" → you receive a message saying Dr. Nkosazana will get back to you personally.
5. At every step the only messages sent to you are direct responses to your own quick-reply tap. No message is sent without your action.
6. (Optional) Send a message in isiZulu or Afrikaans → you receive a polite one-time nudge asking to continue in English.

Why we need it:
Without send/receive messaging access the automation cannot reply to the people who DM the business after seeing our ads, which is the entire purpose of the integration. There is no other way to deliver this customer-service experience inside Instagram DMs.

How we use it:
We read public comments on the business's posts and reels to detect people asking about bookings or products, and we post a single public reply pointing them to DM us. We do not delete, hide, or edit any user's comment. We only post one public reply per matched comment.

Step-by-step test instructions for the reviewer:
1. On the business Instagram account @queenofheaven, find any recent public post or reel.
2. From a second test account, leave a comment containing a booking keyword (for example "I want a reading" or "how much").
3. Within a few minutes the business account posts a single public reply on your comment inviting you to DM the page.
4. Only one reply is posted per comment. No comment is deleted or hidden.

Why we need it:
Most ad traffic lands on reels where people comment instead of DMing. Without comment management we cannot convert public commenters into DM conversations, which is the top of our sales funnel from paid ads.

How we use it:
Dr. Nkosazana schedules spiritual content posts and reels in advance from the app's Content Hub. At the scheduled time the app publishes the media to the business Instagram account on her behalf. Only the business owner (Dr. Nkosazana, an admin user of the app) can schedule content; no end user can publish to the account.

Step-by-step test instructions for the reviewer:
1. Log in to the app as the admin (Dr. Nkosazana).
2. Open the Content Hub and schedule a single image post for 2 minutes in the future.
3. Wait. At the scheduled time the post appears on the business Instagram account @queenofheaven.
4. Only one post is published per scheduled item. No story, no reel, no comment is created.

Why we need it:
Dr. Nkosazana runs the business alone and cannot post manually at peak times. Scheduled publishing keeps the account active, which is required for ad delivery and organic reach.

How we use it:
Our app reads the connected Instagram Business user's id and name so it can identify which Instagram account is connected and display it to the single admin user (the business owner, Dr. Nkosazana) inside the app's Instagram DM Hub. The user's id is also required as the sender/recipient identifier for every Instagram Messaging API and Instagram Comments API call the app makes on the admin's behalf (sending DM replies to people who message the business, reading and replying to public comments).

Step-by-step test instructions for the reviewer:
1. Log in to the app as the admin (Dr. Nkosazana).
2. Open the Instagram DM Hub. The connected Instagram Business account's username and profile picture are shown at the top of the page, read via this permission.

Why we need it:
Without this permission the app cannot identify the connected account and cannot make any Instagram API call (every Messaging and Comments API call requires the user's id). We only read the business owner's own profile fields (id, name, picture); we do not read any other person's profile.

Screen recording for this permission:
Record a 30-second clip: admin logs in, opens the Instagram DM Hub, the connected Instagram account's username and profile picture appear at the top of the page.

How we use it:
We read the business account's own profile (username, profile picture, follower count) to display it inside the app's Instagram DM Hub so Dr. Nkosazana knows which account she is managing. We do not read any other person's profile.

Step-by-step test instructions for the reviewer:
1. Log in to the app as the admin.
2. Open the Instagram DM Hub. The business account's username and profile picture are shown at the top of the page.

Why we need it:
Required so the app can identify which Instagram Business account is connected and display it to the single admin user who manages it.

Record your screen while doing exactly this, in order. Speak each step out loud.

0:00 — Show the Meta App Dashboard: point at the app name, the Instagram product, and the webhook URL (https://queen-of-heaven-psychic.base44.app/functions/instagramWebhook) already subscribed.
0:20 — Open Instagram on a second phone/test account. DM the business account @queenofheaven with "hi". Show the automated welcome menu arriving.
0:50 — Tap "Product" → tap a category → tap a product → show the product detail with "Order Now". Tap "Order Now" → show the confirmation prompt. Tap "Yes, I'm ready" → show the "Dr. Nkosazana will get back to you" message.
1:30 — Switch to the admin app. Open the Instagram DM Hub. Show the test conversation appearing in the list, with the person's message and the automated replies logged.
2:00 — Show the admin receiving the hot-lead notification (the app creates a Notification record when someone taps "Yes, I'm ready").
2:20 — Back on the test account, send a comment with a booking keyword under a public reel. Show the single public reply appearing from the business account.
2:50 — (Content publish) In the admin app, show one scheduled post in the Content Hub and the post appearing on the Instagram account.
3:10 — Summarize: "Every automated DM is a direct response to the person's own message or quick-reply tap. No promotional broadcasts are sent. The business only replies to people who already messaged us."

Upload the video to the App Review submission. Keep it under 5 minutes.

Before you click Submit on the App Review form, make sure all of these are done:

- Business Verification is complete in Meta Business Settings (Security Center → Start Verification). Reviewers reject apps that are not business-verified.
- The app's Privacy Policy URL is filled in (App Settings → Basic). Use your live site: https://nkosazanayomkhathi.com or your published app URL.
- The app's Terms of Service URL is filled in.
- The webhook is live and subscribed in the Meta App Dashboard (Webhooks → Instagram → subscribe to "messages", "messaging_postbacks" if used, and "comments").
- The Instagram Business account @queenofheaven is connected to the app and shows under Instagram Graph API → Submit for Review.
- The screencast video is recorded and ready to upload.
- A test DM from a second account gets an automated reply RIGHT NOW (reviewers will test this live).
- You are NOT requesting any permission you do not actually use. Only request the four: instagram_business_basic, instagram_business_manage_messages, instagram_business_manage_comments, instagram_business_content_publish.

Common rejection reasons to avoid:
- "Use case too vague" → use the exact text in section 1 above.
- "No screencast" → upload the video from section 6.
- "Sending promotional content" → section 1 and 2 explicitly state we never do this.
- "App not business-verified" → complete Business Verification first.
- "Webhook not subscribed" → subscribe the webhook fields before submitting.