Privacy Policy

This policy describes how autoreplyig, operated by Requex.me ("we," "us," "our"), handles data when you create an account and connect your Instagram business or creator account. It applies to the use of Meta's Instagram Graph API through autoreplyig.

When you connect your Instagram account, you grant us limited access to perform the automations you configure. We request only the minimum permissions required:

• Basic profile (instagram_business_basic), your Instagram user ID and username, used to identify your account in the dashboard.
• Comments (instagram_business_manage_comments), to receive webhook notifications about new comments on your posts and reels, and to post replies when an automation rule matches.
• Messages (instagram_business_manage_messages), to receive webhook notifications for direct messages sent to your account, and to send automated replies when an automation rule matches.
• Media, read-only access to the list of your posts and reels (ID, caption, thumbnail, permalink) so you can pick which post an automation should apply to.

• We do not read your private inbox. We only process DMs that arrive via webhook events while your account is connected, i.e., messages sent to you after connection. We do not bulk-export or browse your existing DM history.
• We do not access your followers, following list, or audience insights.
• We do not access stories, story replies, or live broadcasts unless you explicitly enable a future feature that requires those scopes.
• We do not read or post on other connected social accounts (Facebook Pages, WhatsApp, etc.).
• We do not sell, rent, or share your Instagram data with third parties for advertising or marketing.
• We do not use your Instagram data to train AI models.

We use the data we access for one purpose only: to run the automation rules you configure.

• Matching incoming comments and direct messages against the keyword, regex, or all-events rules you set up.
• Posting public comment replies, sending private replies to commenters, or sending direct messages, only when a rule you created matches.
• Displaying your connected account’s username, post thumbnails, automation status, and delivery analytics (comments captured, DMs sent, link clicks) inside the dashboard you signed in to.
• Refreshing your Instagram access token before it expires, so your automations keep running without re-authorization.

• Access tokens are encrypted at rest using AES-256-GCM with a key held only by our backend. Tokens are never exposed to the browser or to other users.
• Webhook events (comments and DMs) are processed to trigger your configured actions. We retain an event record (timestamp, event type, matched keyword, commenter username) that powers your analytics dashboard.
• Automation configurations (rule name, trigger, match criteria, response template, link buttons) are stored in our PostgreSQL database and visible only to your account.
• Data is hosted on infrastructure located in the EU/US and protected by industry-standard access controls.

We do not share your Instagram data with third parties except where strictly necessary to operate the service: (a) our hosting provider, which stores encrypted data on our behalf, and (b) Meta's Instagram Graph API, which is the source of the data and the destination of replies you send through autoreplyig. We will disclose data only if compelled by valid legal process and will notify you where permitted by law.

• Disconnect at any time. Use the disconnect option in the dashboard. This revokes our access, deletes your access token, and removes all automations associated with that account.
• Revoke from Instagram. You can also revoke our access directly from Instagram → Settings → Apps and Websites → Active.
• Request deletion. Email [email protected] to request deletion of all data associated with your account. We action requests within 30 days.
• Data deletion callback. When you trigger data deletion from Instagram, Meta calls our deletion endpoint and we purge associated records.

Connection records and automation configurations are retained for as long as your Instagram account remains connected. When you disconnect or delete an account, all associated tokens, automation rules, and event records are deleted within 30 days. Anonymized, aggregated metrics (e.g., total automations executed) may be retained indefinitely.

Our use of the Instagram Graph API complies with Meta's Platform Terms and Developer Policies. We do not use Instagram data to build user profiles for advertising, do not attempt to re-identify users, and do not store data longer than necessary for the automation you configured.

We may update this policy as the service evolves. Material changes will be communicated by updating the "Last updated" date above and, for substantive changes, by email or in-app notification.

For privacy questions, data requests, or to report a concern, email [email protected].