Privacy Policy

Application: InstaAuto | Developer: Aniket Sharma | Last Updated: 9 May 2026

1. About InstaAuto

InstaAuto is an Instagram comment-to-DM automation platform. It allows Instagram Business account owners ("Users") to configure keyword triggers on their posts and reels so that when a follower comments a specific keyword, an automated Direct Message (DM) is instantly sent to that follower via the official Meta (Facebook/Instagram) Graph API. InstaAuto is developed and operated by Aniket Sharma ("we", "us", or "our").

This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. By using InstaAuto, you agree to the practices described below.

2. Information We Collect

2.1 Account Information

When you register for an InstaAuto account you provide your name, email address, and password. We store these to authenticate you and operate your account.

2.2 Meta Platform Data (Facebook & Instagram)

When you connect your Instagram Business account via Facebook Login, we receive and store the following data from Meta's Graph API solely to provide the automation service:

Permission	Data Accessed	Why It's Needed
`instagram_business_basic`	Instagram Business account username, ID, profile picture, follower count	Identifies the connected account in the dashboard; links automation rules to the correct Instagram account
`instagram_business_manage_messages`	Ability to send Direct Messages on behalf of the Instagram Business account	Core product feature. When a follower comments a configured keyword on a post or reel, InstaAuto uses this permission to send that follower a personalised DM automatically. Without this permission the product cannot function.
`pages_show_list`	List of Facebook Pages the user manages	Instagram Business accounts are linked to Facebook Pages. We need this to identify which Facebook Page is connected to the user's Instagram account so Graph API calls are made on the correct page.
`pages_read_engagement`	Comments and engagement events on Facebook Page posts (which include linked Instagram posts)	Meta delivers comment webhooks through the Facebook Page. We subscribe to these webhooks to detect when a keyword comment is made on an Instagram post so the DM trigger can fire in real time.

We request only the permissions listed above. We do not access your personal Facebook profile, personal Facebook posts, Facebook friends list, or any Instagram personal account data. Access tokens are stored encrypted in our database.

2.3 Automation & Usage Data

We store the automation rules you create (keyword triggers, DM message templates), logs of automated DMs sent (Instagram recipient user ID, timestamp, delivery status), and analytics data about your automations (success rate, total DMs sent).

2.4 Technical Data

We collect standard server logs including IP address, browser type, device type, and pages visited. We use cookies and local storage solely for authentication (JWT tokens) and session management — not for tracking or advertising.

3. How We Use Your Information

Authenticate you and operate your InstaAuto account
Execute your keyword-to-DM automation rules via the Instagram Graph API
Display your connected Instagram account and automation rules in the dashboard
Provide analytics on DMs sent, delivery status, and engagement
Send you service-related notifications (e.g., token expiry warnings, billing receipts)
Diagnose technical issues and improve the reliability of the platform
Comply with applicable legal obligations and Meta's Platform Terms

We do not use your data for advertising, profiling, or sale to third parties.

4. Meta Platform Terms & Restricted Data Use

InstaAuto operates as a Meta-reviewed application and complies fully with Meta's Platform Terms and Developer Policies. In particular:

We only use Meta Platform Data for the purposes described in this Privacy Policy and disclosed to Meta during App Review.
We do not transfer, sell, or share Meta Platform Data with any data broker, ad network, or analytics provider.
We do not use Meta Platform Data to make eligibility determinations (credit, insurance, employment, etc.).
We store access tokens encrypted at rest and transmit all data over TLS/HTTPS.
We delete all Meta Platform Data associated with your account within 30 days of account deletion or access revocation.

5. Data Sharing & Disclosure

We do not sell your personal data. We share data only in these limited circumstances:

Hosting Infrastructure: Our application runs on cloud hosting services. These providers process data only on our instructions and are bound by data processing agreements.
Legal Compliance: We may disclose information when required by law, court order, or government regulation.
Business Transfer: In the event of a merger or acquisition, user data may be transferred as part of that transaction. You will be notified beforehand.
With Your Explicit Consent: For any other sharing not described here, we will ask your permission first.

6. Data Retention

We retain your account data and automation configuration for as long as your account is active. DM logs are retained for a maximum of 90 days for analytics and debugging purposes. When you delete your account or revoke Meta access, all associated data (including access tokens, automation rules, and Meta Platform Data) is permanently deleted within 30 days. Minimal billing records may be retained for up to 7 years as required by applicable tax law.

7. Security

All data is transmitted over HTTPS / TLS 1.2+
Instagram and Facebook access tokens are encrypted at rest using AES-256
Authentication uses JWT tokens with short expiry windows
Access to production databases is restricted to authorised personnel only
Regular security reviews of our codebase and dependencies

8. Your Rights

You have the following rights over your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete data.
Deletion: Request deletion of your account and all associated data. You can do this via the dashboard or by emailing us. See our Data Deletion page for full instructions.
Revoke Meta Access: Disconnect your Facebook/Instagram account at any time through InstaAuto's dashboard or via Facebook Settings → Apps and Websites.
Portability: Request an export of your automation rules and account data in a machine-readable format.
Opt-out of Marketing: You can unsubscribe from any marketing emails using the link in those emails.

To exercise any of these rights, contact us at anisaab646774@gmail.com. We will respond within 30 days.

9. Cookies & Local Storage

InstaAuto uses cookies and browser local storage only for essential purposes: storing your authentication token (JWT) to keep you logged in and remembering your session preferences. We do not use any third-party tracking cookies, advertising cookies, or analytics SDKs that track you across other websites.

10. Children's Privacy

InstaAuto is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with their information, please contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and, for material changes, notify you via email or an in-app notice. Continued use of InstaAuto after a change constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact:

InstaAuto

Developer: Aniket Sharma

Email: anisaab646774@gmail.com

Website: https://www.reeltodm.com

Data Deletion: https://www.reeltodm.com/data-deletion