Privacy Policy

INSTA-BOT lets an account holder ("you") connect an Instagram account and configure automated keyword-based replies to Instagram DMs and comments. This notice covers:

• Account holders — people who register forINSTA-BOT.
• Instagram interactors — people who send a DM or comment on an Instagram account connected by an account holder. They do not sign up for INSTA-BOT, but message content and identifiers are processed on our servers to deliver automations and show logs to the account holder.
• Website visitors — people who browse our marketing or legal pages before or without signing in.

For account-holder personal data (registration, login, configuration, connected Instagram tokens, and related logs), Nittish Baboria acts as the Data Fiduciary under the DPDP Act.

For personal data of Instagram interactors, the account holder who controls the connected Instagram account is typically the data fiduciary toward those individuals, and INSTA-BOT processes that data on the account holder's instructions to provide automation — i.e. as a Data Processor. Account holders must have a lawful basis to automate replies and must comply with Meta's Platform Terms and applicable law.

Meta / Instagram processes data under its own terms and privacy policies when you use Instagram and the Graph API. We do not control Meta's processing.

From account holders:

• Username, email address, and bcrypt-hashed password (email signup).
• Name, email, and profile picture (Google sign-in).
• Instagram access token, Instagram user ID, username, and connected page name after you connect an account. Tokens are encrypted at rest (AES-256-GCM).
• Keyword rules, reply text, affiliate links, AI settings, and media/post targeting.
• Metadata about your Instagram posts/reels (caption, permalink, thumbnail URL, publish date) for targeting — we store references, not copies of media files.
• Consent timestamp and policy version when you register.
• Technical and security data: IP address, request metadata, user-agent, and security audit events (sign-in/out, password changes, account deletion, admin actions).

From Instagram interactors:

• Instagram sender ID and username (where available).
• Text of DMs and comments, automation replies sent, and thread/log metadata for the account holder's dashboard.

From website visitors (if you accept analytics):

• Pseudonymous visitor and session IDs (browser storage), pages viewed, referrer, UTM tags, time on page, hashed IP, user-agent, and approximate geo from hosting headers.

We do not knowingly collect government ID numbers, payment card data (we do not currently charge), or precise GPS location.

• Provide Instagram DM/comment automation, logs, threads, and in-product analytics.
• Authenticate users, verify email (OTP), and reset passwords.
• Send transactional email (OTP, password reset, contact-form replies).
• Prevent abuse via rate limiting and security monitoring.
• Optional: first-party website analytics to understand usage of public pages (only with consent).
• Optional: when enabled by an account holder, send message text to Google Gemini to generate AI fallback replies.

We do not sell personal data. We do not use Instagram data for advertising or for purposes outside operating this service, consistent with Meta's Platform Terms.

We process account-holder data based on consent given at registration (affirmative opt-in; no pre-ticked boxes) and, where applicable, performance of the service you request. We record consentAcceptedAt and consentVersion (2026-09-26).

Optional site analytics are processed only after you choose "Accept analytics" in our cookie banner or on the Consent page.

Instagram interactor data is processed because it is necessary to perform automations the account holder configured.

We use service providers that process data only to operate INSTA-BOT:

• Meta / Instagram Graph API — send/receive DMs and comments on connected accounts.
• Google — OAuth sign-in; Gemini API when AI replies are enabled.
• Neon (PostgreSQL) — application database.
• Upstash (Redis) — rate limiting (no message content).
• Gmail SMTP — transactional email.
• Vercel — hosting and edge delivery.

We do not rent or sell personal data for third-party marketing. We may disclose data if required by law or to protect rights, safety, and integrity of the service.

Our infrastructure and subprocessors (including database, hosting, email, Google, and Meta) may process or store data in India and in other countries (including the United States and the European Economic Area). Where personal data is transferred outside India, we rely on contractual safeguards with vendors and applicable provisions of the DPDP Act and Rules permitting such transfers. By using the service, account holders acknowledge that cross-border processing may occur for the purposes described in this notice.

• Account data until you delete your account.
• Automation logs and threads while the related Instagram connection exists; deleted when you disconnect or delete your account.
• Signup OTP codes: minutes, then purged.
• First-party analytics: retained for operational reporting; aggregated or deleted per internal retention practices.
• Security audit records: at least one year per DPDP Rules — retained separately from deleted account content and limited to security metadata (not passwords, tokens, or message bodies).

We use essential cookies for login and Instagram OAuth, and optional browser storage for analytics only with consent. Details, including how to change your choice, are in our Cookie Policy.

Subject to applicable law, you may have the right to:

• Access personal data we hold about you.
• Correction of inaccurate or incomplete data (update profile fields or email us).
• Erasure — delete your account from your profile or request deletion by email.
• Withdraw consent — stops future processing; account deletion is the primary withdrawal path for registered users.
• Nominate another individual to exercise your rights in the event of death or incapacity, as permitted under the DPDP Act (contact us with supporting details).
• Grievance — lodge a complaint with us using the contact below; we will address it as required by law.

Instagram interactors who do not have an INSTA-BOT account should contact the relevant Instagram account owner first; we will assist account holders and, where we are legally required, respond to direct requests within our role as processor.

Passwords are bcrypt-hashed. Instagram tokens are encrypted at rest. We apply rate limiting and access controls. No method of transmission or storage is 100% secure; we use reasonable measures required under the DPDP Rules.

INSTA-BOT is intended for users who can enter a binding contract under Indian law (typically 18+). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us for deletion.

We may update this notice when the service or law changes. Material updates are reflected by the "Last updated" date. Continued use after an update may constitute acknowledgment where consent is not required again; where required, we will seek fresh consent.

Data fiduciary: Nittish Baboria. For access, correction, erasure, nomination, consent questions, or grievances:

Grievance / privacy contact — nittishbaboria123@gmail.com