Privacy Policy

Last updated: November 6, 2026

AutoChat ("we", "us") is a service that automates replies to comments and direct messages on Instagram on behalf of the Instagram account owner who connected it. This policy explains what information we handle, why, and the choices you have. It covers both account owners and people who interact with a connected account (for example by commenting on its posts or messaging it).

Information we collect

From people who interact with a connected Instagram account, received through Meta's Instagram and Messenger platform:

• Your Instagram-scoped ID and username.
• The text of comments you post on the connected account's posts, and the comment and post IDs.
• Messages you send to the connected account, including button taps and quick replies.
• Whether you follow the connected account (provided by Meta, used only to run a "follow first" step the account owner turned on).
• Information you choose to type into the conversation when asked, such as an email address or phone number.
• Whether you opened a link we sent you (through a link we track), and tags the account owner's automation assigns (for example "link-requested").

From account owners who connect an account: the Instagram professional account ID and username, the linked Facebook Page ID, an access token that lets AutoChat act on the account, and the automations (keywords, messages, links) they configure.

How we use it

• To detect a comment or message that matches an automation and send the reply the account owner set up.
• To continue a conversation (for example waiting for your button tap or your email address) and to avoid sending duplicate messages.
• To let the account owner see who was messaged and what was captured, and to keep an error and delivery log.

We do not sell personal information, we do not use it for advertising, and we do not build profiles of you beyond the automation tags described above.

Who we share it with

• Meta Platforms (Instagram, Facebook): we send replies through their APIs and receive events from them.
• Our service providers: Supabase (database) and DigitalOcean (server hosting) store and process the data on our behalf.
• The connected account's owner, who can see conversations and captured details such as an email address you gave them.
• Authorities, where the law requires it.

Retention

We keep interaction data for as long as the account owner uses AutoChat or until it is deleted. You can ask us to delete your data at any time (see Data Deletion). Access tokens are removed when an account owner disconnects their account.

Your choices and rights

You can ask to access, correct or delete the information we hold about you, and you can stop receiving automated messages by not replying or by telling the account that messaged you. Depending on where you live (for example Canada's PIPEDA, the EU/UK GDPR, or California's CCPA) you may have additional rights, which we will honour. Email rajeev@devbites.com with your Instagram username.

Security

Data is transmitted over HTTPS, webhook requests from Meta are signature-verified, database access is restricted to our server, and the administration area requires a secret token. No system is perfectly secure, and we will notify affected people and regulators where required if a breach occurs.

Children

AutoChat is not directed to anyone under 13 (or the minimum age required by Instagram in your country), and we do not knowingly collect their information.

Changes

We may update this policy. The date above shows the latest version.

AutoChat is operated by Rajeev Kugan (Devbites), Toronto, Canada. Contact: rajeev@devbites.com