Privacy Policy

To provide our Instagram automation services, we collect the minimum data required. Here is exactly what we collect and why:

Data You Provide (About You)

• Instagram Account Information: Your Instagram User ID, username, and profile picture URL, provided by Instagram during login. Your username and picture are shown back to you in your dashboard. We do not receive your Instagram password.
• Authentication Tokens: Long-lived access tokens issued by Instagram (and by Facebook, if you connect a Page). They are stored server-side, used only by our servers to act on your behalf, and are never sent to your browser or to any third party.
• Contact Information (email): Your email address comes from Facebook login if you use it, or from the address you add in Settings. You can change it at any time. We use it only to send you messages about ReplyKaro: account and billing notices, connection and security alerts, usage limits, and ReplyKaro product updates (which have an unsubscribe link). We never sell it, never share it with advertisers or other companies for their marketing, and our only processor for it is our email delivery provider (see Section 3).
• Payment Information: Subscription and payment details are handled entirely by Razorpay. We do not store credit card numbers, UPI IDs, or bank account details on our servers.
• Content You Add: Automations, flows, reply templates, tags, and any text you upload as a knowledge base for AI replies.

Data We Read From Your Connected Account

• Your Posts and Their Performance: Through Instagram's official API we read your recent posts (caption, hashtags, media type, publish time, like and comment counts, link) and your follower count. We use this to show your Content Insights and to match automations to the right post.
• Facebook Pages (if connected): Page ID and name, a Page access token, and the Messenger conversations and comments for that Page that trigger your automations.
• Technical Data: Request logs (such as IP address, browser type, and error details) created by our hosting provider and our own servers for security and debugging.

Data From Your Instagram Audience

• Interaction Data: When someone comments on your posts, sends you a DM, or replies to your story, we receive and process that interaction in real time to trigger your configured automations. This includes the message content and the sender's Instagram Page-Scoped ID (PSID).
• Audience Instagram IDs: We store the Instagram User IDs (IGSID) and Page-Scoped IDs (PSID) of users who interact with your account through our platform, along with their public username when Instagram provides it. This is the minimum necessary to route automated replies correctly.
• Details Your Audience Chooses to Share: If you build a conversation that asks for an email address, phone number, or name, and the person replies, we store that answer in your Leads and Subscribers list so you can use it. We do not look these details up ourselves, and we do not collect them from anyone who is not part of a conversation you set up. You are responsible for having a lawful basis and a clear purpose for the details you ask your audience to share.
• Subscriber Records: For each audience member we keep which automation or post first brought them in, the number of DMs they received and links they clicked, when they were last active, any tags and notes you add, and whether they opted out.
• We do not collect: Location data, contact lists, or any information beyond what the official Instagram and Facebook APIs provide in the context of an interaction.

Your data is used exclusively to deliver the ReplyKaro service. We do not sell, rent, or share your data or your followers' data with any third party for marketing or advertising purposes — ever.

• Executing automated replies to comments, DMs, and story interactions as configured by you.
• Tracking engagement metrics and DM delivery rates for your analytics dashboard.
• Enforcing frequency capping and rate limiting to protect your account from Meta's spam filters.
• Processing payments, managing subscriptions, and sending billing communications.
• Detecting abuse, preventing unauthorized access, and improving platform reliability.
• Responding to your support requests and grievances.

Legal basis for processing (GDPR/DPDP): We process your personal data based on (a) the performance of our contract with you (delivering the service you signed up for), (b) your consent provided during account creation and Instagram OAuth authorization, and (c) our legitimate interests in operating and improving a secure platform.

Your Content Insights

The Content tab in your analytics reads your own recent posts and shows which hours, days, hashtags, caption words, and formats get you the most likes and comments. Only you see this. It is calculated from your own posts and, for comparison, from anonymous benchmarks (below). We do not read the private insights of your posts, because we do not request that permission.

Anonymous Benchmarks and Our Free Tools

To build free tools such as the Best Time to Post tool, we periodically read recent public posts of connected accounts and keep a reduced record of each: the hour and weekday it was posted (IST), the media type, the follower-size band of the account, its engagement rate (likes and comments divided by followers), the length of the caption in bands, whether it has a call to action or emoji, and its hashtags and caption words. We detect a topic for each post by matching those hashtags and words against keyword lists. The full caption text, usernames, and links are not kept for this purpose.

• The public tool only shows totals across many creators. A hashtag or word appears only when at least 10 different creators used it, and a group is shown only when enough creators are in it.
• These records are tied to your account while it exists and are deleted when your account is deleted.
• Opt out: email hello@replykaro.com and we will exclude your account from the benchmarks and remove its records. Opting out does not affect any feature you use.

AI Features

ReplyKaro uses AI only in the features below. For each request, the text needed is sent to our AI provider, OpenAI, over its API and the answer is returned to your account. We send only what the request needs. We do not train our own models on your data, and if you do not use these features nothing is sent.

• AI replies to your audience: the message an audience member sent, recent messages of the same conversation, your instructions and the relevant parts of your knowledge base. These replies are automated; you can switch AI off, and you can reply yourself from the inbox, which pauses the AI for that person.
• Knowledge search: text you add to your knowledge base, or import from your website or Instagram posts, is converted to numeric embeddings so the right part can be found when someone asks a question.
• Learning your style from past conversations: if you choose this import, your past Instagram DM and comment conversations are anonymised and summarised into support notes for your AI assistant.
• AI builders: what you type to draft automations, flows or canvas edits, and a description of the flow being edited.
• AI assistant and diagnosis: a summary of your account setup (which flows and automations exist, whether they are on, and recent delivery errors). It contains no contacts, access tokens or message text.
• AI follow-up messages: the context of an open conversation, to write a follow-up you have enabled.

How OpenAI Handles Your Data

• OpenAI: We use OpenAI through its API. By default, OpenAI does not use data sent through its API to train its models. OpenAI may securely retain API inputs and outputs for up to 30 days to detect abuse, after which they are deleted unless the law requires otherwise. OpenAI's own terms and privacy policy apply to its processing.
• Data we do not send: access tokens, passwords, payment details and your Instagram or Facebook credentials are never sent to OpenAI.
• Accuracy: AI can make mistakes. Review your AI settings and replies, keep instructions factual, and do not rely on AI for legal, medical or financial advice to your audience. We do not use AI to make decisions that have legal or similarly significant effects on a person.
• Your responsibility: Do not put sensitive personal data (such as health, financial account or government ID details) into your AI instructions or knowledge base, and make sure you may lawfully use the content you add.
• Your controls: You can turn AI off for any account, delete knowledge sources at any time (their embeddings are deleted with them), and take over any conversation from the inbox.

Notifications and Emails

We email you only about ReplyKaro: your account and billing, connection problems such as an expired Instagram login, usage limits and security, plus ReplyKaro product updates and tips. Product updates and the upgrade journey include an unsubscribe link, we cap how often we send them, and we stop as soon as you opt out. Account, billing and security notices are not marketing and continue so you can run your account. We do not use your email for any other company's marketing. If you allow browser notifications, we store the address your browser gives us so we can send you alerts, and you can turn this off in your browser at any time.

Admin Access

A small number of authorised ReplyKaro team members can see account, usage, and support information in an admin panel to run the service, fix problems, and answer support requests. Access is limited to what the work requires.

We use industry-standard, secure infrastructure providers to operate the platform. Each sub-processor is bound by data processing agreements:

ReplyKaro is operated from India. To provide our service, your data is transferred to and processed in:

• Australia (Sydney): Primary database via Supabase. Australia maintains strong data protection laws under the Australian Privacy Act 1988.
• United States: Hosting (Vercel), caching (Upstash), AI processing (OpenAI), email delivery (Resend), website analytics (Google), and the Meta Messaging API. The US does not have a blanket EU adequacy decision; transfers are made under appropriate safeguards including standard contractual mechanisms where applicable.
• India: Payment processing via Razorpay. Razorpay complies with the Reserve Bank of India's data localization guidelines for payment data.

If you are an EU/UK resident, by using our service you acknowledge that your data may be transferred outside the European Economic Area (EEA). We take reasonable steps to ensure your data is protected in accordance with this policy wherever it is processed.

• Active Accounts: Data is retained for the duration of your active account.
• Deleted Accounts: When you ask us to delete your account, your automations, audience data, leads, content records, and sessions are erased after a 7-day cooling-off period, during which you can cancel. Requests that come from Meta's data-deletion callback are processed immediately. Larger accounts are erased in batches, and the whole process is normally finished within 30 days.
• DM & Interaction Logs: Interaction logs (including audience PSIDs and message content processed for automation) are retained for 90 days for analytics and support, then automatically purged. Facebook message logs, flow history, and activity logs are purged after 180 days, and short-lived technical records (such as webhook events) after 7 to 30 days.
• Counts That Outlive Logs: Before logs are purged, we keep running totals per account (for example, how many DMs were sent) so your lifetime analytics stay accurate. These totals contain no message text or audience identifiers, and are deleted with your account.
• Redis Cache: Temporary cache data expires automatically within 24 hours to 7 days.
• Payment Records: Transaction, subscription, and invoice records are retained for 7 years as required by Indian financial and tax regulations. After you delete your account they are kept only in an anonymised form that no longer identifies you.

We use essential cookies to run the service, and two website analytics tools described below. We do not use advertising cookies and we do not sell data to advertisers.

• Session Cookie: A secure, HttpOnly cookie to maintain your login session (7-day expiry).
• Referral Cookie: Stores a referral code for attribution purposes only (30-day expiry).
• OAuth State Cookie: A temporary cookie for CSRF protection during Instagram and Facebook login (deleted immediately after use).
• Preference Cookies: Remember which connected account or Facebook Page you are working in, and similar settings you choose.
• Local Storage: Your browser stores small items such as notices you have dismissed, unsent drafts, and chosen templates. They stay on your device.

Website Analytics

We use Google Analytics 4 and Vercel Web Analytics to understand how visitors use our website (pages viewed, device and browser type, approximate location, and referral source). Google Analytics loads only if you accept analytics in the cookie banner, may then set cookies in your browser, and processes this data on Google's servers. See our Cookie Policy. Vercel Web Analytics does not use cookies. We do not use these tools to build advertising profiles. You can block Google Analytics with your browser settings or a tracking-protection extension. No session replay or heat-map tools are used.

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR) applies to how we handle your personal data. In addition to the rights in Section 7, you also have:

• Right to Restriction: Request that we restrict processing of your data in certain circumstances.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your national data protection authority (e.g., ICO in the UK, or your country's DPA in the EU) if you believe we are processing your data unlawfully.
• Right Not to Be Subject to Automated Decisions: You have the right not to be subject to a decision based solely on automated processing that produces legal or significant effects.

For GDPR-related inquiries, contact our Grievance Officer at hello@replykaro.com.

We are committed to complying with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. As a Data Fiduciary under this Act:

• Notice and Consent: Before you sign in we tell you what we collect and why (see Sections 1 and 2, and the notice under the sign-in button). Your consent is free, specific and informed, and is given by continuing with Instagram or Facebook login after that notice. Processing that is needed to comply with law (for example keeping payment records) does not depend on consent.
• Purpose Limitation and Minimisation: We collect only the data needed to provide the service and do not use it for any other purpose.
• Right to Access: In Settings > Security, choose “Download my data” to get a copy of the personal data we hold about you, including the processors it is shared with (Section 3). Large accounts download in parts.
• Right to Correction and Completion: Email the Grievance Officer to correct or complete data we hold. Details that come from Instagram are corrected in Instagram and refresh when you reconnect.
• Right to Erasure and Withdrawal of Consent: Withdraw consent as easily as you gave it: in Settings > Security, choose “Delete my account”. After a 7-day cooling-off period your data is erased (see Section 5), except records the law requires us to keep.
• Right of Nomination: You may nominate another person to exercise these rights if you die or become unable to. Email us the nominee's name and contact details from your registered email.
• Grievance Redressal: Raise a complaint with our Grievance Officer (Section 12). We acknowledge within 24 hours and resolve within 15 days, and never later than 90 days. If you are not satisfied you may complain to the Data Protection Board of India.
• Security and Breach Notification: We use reasonable safeguards, including encryption in transit and access controls. If a personal data breach affects you, we will tell you without delay with what happened, the likely impact, what we are doing and what you can do, and we will report it to the Data Protection Board of India as the law requires.
• Audience Members: If you are a person who commented on or messaged a creator who uses ReplyKaro, the creator decides why your data is used and ReplyKaro processes it for them. You can stop messages using the unsubscribe link in our messages, and you can ask us to erase your data from a creator's account by emailing the Grievance Officer with your Instagram handle.
• Language: This notice is in English. On request we will provide it in any language listed in the Eighth Schedule to the Constitution of India.

ReplyKaro is for adults and is not directed at children. You must be 18 or older to use it. We do not knowingly collect personal data of anyone under 18, we do not track or profile children, and we show no advertising. If you believe a child has provided data, please contact us immediately and we will delete the data without delay.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email (if provided) or through a prominent notice on our platform at least 15 days before the changes take effect. Continued use of ReplyKaro after the effective date constitutes acceptance of the updated policy.

We recommend reviewing this page periodically. The "Last Updated" date at the top of this page always reflects the most recent revision.