Privacy Policy

Last updated 3 August 2026

ReplyRep ("we") provides Instagram comment and message automation for Instagram Business and Creator accounts. This policy explains exactly what Instagram and Facebook data we handle, why, and how to have it deleted.

What we collect from Instagram

When you connect an Instagram professional account through Instagram Login, we receive and store:

• Account identifiers — your Instagram professional account ID, username, and display name.
• An access token, encrypted at rest with AES-256-GCM. It is used only to act on your behalf on the account you connected.
• Media metadata — IDs, type, timestamps, and comment counts for posts we act on. We do not store your photos or videos.
• Comments and messages that trigger an automation you configured: the text, the commenter's Instagram-scoped ID, and their username.
• Delivery records — what we sent, when, and whether it succeeded.

What we do with it

• Match incoming comments and messages against keywords you configure.
• Send the replies you configure, through Meta's official APIs.
• Show you delivery and engagement reporting for your own account.

We do not sell your data, use it for advertising, or share it with third parties for their own purposes.

People who interact with your account

When someone comments on your post or messages you, we store their Instagram-scoped ID, username, and message content so we can respond and so you can see what happened. An Instagram-scoped ID is specific to your account and cannot be used to identify that person elsewhere.

They can opt out at any time by replying STOP, which suppresses all future automated messages from your account to them.

Retention

• Access tokens are deleted immediately when you disconnect an account.
• Message and delivery logs are retained while your account is active.
• Raw webhook payloads are retained for 30 days for debugging, then deleted.
• Everything is deleted within 30 days of account closure or a deletion request.

Security

• Access tokens are encrypted at rest (AES-256-GCM) and bound to the account they belong to.
• Data is isolated per customer at the database level using row-level security, not by application convention.
• All traffic is served over HTTPS.

Your choices

• Disconnect Instagram at any time — this deletes the stored token.
• Remove our app from Instagram's Apps and Websites settings. We are notified and delete your data.
• Request deletion or a copy of your data — see Data deletion.

Contact

[email protected]

Privacy · Terms · Data deletion · Home