Privacy Policy

1. Information We Collect

When you create an account, we collect your email address and authentication credentials. When you connect an Instagram account, we receive an access token and your Instagram business profile information (username, profile picture, page ID) through the Meta (Instagram) API. We do not store your Instagram password.

2. How We Use Your Information

• To provide and operate the IgInbox automation service
• To send and receive Instagram DMs and comment replies on your behalf
• To manage your contacts and conversation history within the platform
• To send transactional emails related to your account
• To improve and maintain the service

3. Instagram Data

We access Instagram data through Meta's official APIs. We only request permissions necessary to operate the service (managing messages, reading comments, accessing profile info). All Instagram access tokens are encrypted at rest using AES-256-GCM encryption. We do not sell or share your Instagram data with third parties.

4. Data Storage & Security

Your data is stored in Supabase (powered by PostgreSQL) with row-level security policies ensuring workspace isolation. All data is encrypted in transit (TLS) and sensitive tokens are encrypted at rest. We implement strict access controls and regularly audit our security practices.

5. Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data (flows, contacts, messages, connected accounts) is permanently deleted within 30 days. You can request data deletion at any time through your dashboard settings or by contacting us. When you disconnect your Instagram account through Meta's app settings, we receive a data deletion callback and automatically remove all data associated with that Instagram account.

6. Third-Party Services

We use the following third-party services to operate IgInbox:

• Meta (Instagram) API — for DM and comment automation
• Supabase — database and authentication
• Vercel — hosting and deployment
• Inngest — background job processing
• Upstash — rate limiting and caching

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Disconnect your Instagram account at any time
• Export your data

8. Meta Platform Terms

Our use of Instagram data is governed by Meta's Platform Terms and Developer Policies. We comply with all applicable Meta policies regarding data usage, storage, and deletion. Users may revoke access at any time through their Instagram settings.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this privacy policy or your data, contact us at info@iginbox.com.