Privacy Policy

1. Introduction

InstaAuto ("we", "our", "us") is a service operated by Axonova Technologies, India, at https://instaauto.in. This Privacy Policy explains what information we collect, why, how long we keep it, and how you can delete it.

2. Information We Collect

• Account information: your name, email address and a hashed password when you register.
• Instagram profile data (via Instagram Business Login, when you connect an account): your Instagram professional account ID, app-scoped user ID, username, and an access token issued by Meta.
• Instagram messages: the text of direct messages sent to your connected Instagram account, and the sender's Instagram-scoped ID, delivered to us by Meta's webhooks.
• Instagram comments: the text of comments on your posts/reels, the comment ID, the commenter's ID and the media type.
• Content you provide: automation rules, reply templates, and AI business information/instructions.
• Billing data: subscription and payment IDs from Razorpay. We never receive or store your card or bank details.
• Usage data: counts of messages and AI replies sent, and logs of automated actions.

3. How We Use Instagram Data

Instagram data is used only to provide the service you configured:

• Matching incoming messages and comments against your automation rules.
• Sending replies and private replies on your behalf through the Instagram API.
• If you enable AI replies, the message text, your business information and recent conversation context are sent to OpenAI to generate a reply. OpenAI does not use API data to train models.
• Showing activity counts and usage limits in your dashboard.

We do not use Instagram data for advertising or profiling, and we do not sell it.

4. Data Storage & Security

Data is stored on servers in a secured database. Instagram access tokens are encrypted at rest (AES-256-GCM). Passwords are hashed. All traffic uses HTTPS, and webhook requests from Meta are verified by signature.

5. Data Sharing

We share data only with the processors needed to run the service: Meta (Instagram API), OpenAI (only when AI replies are enabled), Razorpay (payments) and our email provider (transactional emails). We do not sell or trade personal information.

6. Data Retention

• Account, rule and settings data are kept while your account is active.
• Message and comment logs are kept while the Instagram account remains connected, and are deleted when you disconnect it or delete your account.
• Access tokens are deleted when you disconnect the account, remove the app from Instagram, or delete your account.
• Webhook de-duplication records (message/comment IDs only) are removed after 30 days.

7. Deleting Your Data

You can delete your data at any time in any of these ways:

• In the app: Settings → "Delete my account & data" removes everything immediately. Disconnecting an Instagram account deletes that account's token, rules and logs.
• From Instagram: remove InstaAuto under Instagram Settings → Apps and websites. Meta notifies us and we revoke the token; a data deletion request deletes all data for that Instagram account and gives you a confirmation code you can check at /deletion-status.
• By email: write to support@instaauto.in from your registered address; we complete requests within 30 days.

See the Data Deletion Instructions page for details.

8. Third-Party Services

Your use of Instagram is also subject to Instagram's Privacy Policy and Meta's Terms of Service.

9. Your Rights

You can access, correct or delete your personal data, withdraw consent by disconnecting your Instagram account, and contact us with any privacy question. Rights under India's Digital Personal Data Protection Act, 2023 and other applicable laws are honoured.

10. Changes to This Policy

We may update this policy. Significant changes will be announced on the platform and the "Last updated" date will change.

11. Contact Us

Axonova Technologies, India — support@instaauto.in