Privacy Policy

To provide our Instagram automation services, we collect the minimum data required. Here is exactly what we collect and why:

Data You Provide (About You)

• Instagram Account Information: Your Instagram User ID, username, and profile picture URL — provided by Instagram during OAuth login.
• Authentication Tokens: Long-lived Access Tokens issued by Instagram. These are encrypted and stored server-side and are never exposed to the client or any third party.
• Contact Information: Your email address (if provided) for billing communications and critical system notifications.
• Payment Information: Subscription and payment details are handled entirely by Razorpay. We do not store credit card numbers, UPI IDs, or bank account details on our servers.

Data From Your Instagram Audience

• Interaction Data: When someone comments on your posts, sends you a DM, or replies to your story, we receive and process that interaction in real time to trigger your configured automations. This includes the message content and the sender's Instagram Page-Scoped ID (PSID).
• Audience Instagram IDs: We store the Instagram User IDs (IGSID) and Page-Scoped IDs (PSID) of users who interact with your account through our platform. This is the minimum necessary to route automated replies correctly.
• We do not collect: Audience email addresses, phone numbers, location data, or any information beyond what the official Instagram Messaging API provides in the context of an interaction.

Your data is used exclusively to deliver the ReplyKaro service. We do not sell, rent, or share your data or your followers' data with any third party for marketing or advertising purposes — ever.

• Executing automated replies to comments, DMs, and story interactions as configured by you.
• Tracking engagement metrics and DM delivery rates for your analytics dashboard.
• Enforcing frequency capping and rate limiting to protect your account from Meta's spam filters.
• Processing payments, managing subscriptions, and sending billing communications.
• Detecting abuse, preventing unauthorized access, and improving platform reliability.
• Responding to your support requests and grievances.

Legal basis for processing (GDPR/DPDP): We process your personal data based on (a) the performance of our contract with you (delivering the service you signed up for), (b) your consent provided during account creation and Instagram OAuth authorization, and (c) our legitimate interests in operating and improving a secure platform.

We use industry-standard, secure infrastructure providers to operate the platform. Each sub-processor is bound by data processing agreements:

ReplyKaro is operated from India. To provide our service, your data is transferred to and processed in:

• Australia (Sydney): Primary database via Supabase. Australia maintains strong data protection laws under the Australian Privacy Act 1988.
• United States: Hosting (Vercel), caching (Upstash), and the Meta Messaging API. The US does not have a blanket EU adequacy decision; transfers are made under appropriate safeguards including standard contractual mechanisms where applicable.
• India: Payment processing via Razorpay. Razorpay complies with the Reserve Bank of India's data localization guidelines for payment data.

If you are an EU/UK resident, by using our service you acknowledge that your data may be transferred outside the European Economic Area (EEA). We take reasonable steps to ensure your data is protected in accordance with this policy wherever it is processed.

• Active Accounts: Data is retained for the duration of your active account.
• Deleted Accounts: Upon account deletion, all personal data is permanently removed within 30 days.
• DM & Interaction Logs: Interaction logs (including audience PSIDs and message content processed for automation) are retained for 90 days for analytics and support, then automatically purged.
• Redis Cache: Temporary cache data expires automatically within 24 hours to 7 days.
• Payment Records: Transaction records are retained for 7 years as required by Indian financial and tax regulations.

We use essential cookies only. We do not use any third-party advertising, tracking, or analytics cookies.

• Session Cookie: A secure, HttpOnly cookie to maintain your login session (7-day expiry).
• Referral Cookie: Stores a referral code for attribution purposes only (30-day expiry).
• OAuth State Cookie: A temporary cookie for CSRF protection during Instagram login (deleted immediately after use).

No analytics platforms (Google Analytics, Mixpanel, Hotjar, etc.) are used on this website. We do not track your behaviour across other websites.

If you are located in the European Union or United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR) applies to how we handle your personal data. In addition to the rights in Section 7, you also have:

• Right to Restriction: Request that we restrict processing of your data in certain circumstances.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your national data protection authority (e.g., ICO in the UK, or your country's DPA in the EU) if you believe we are processing your data unlawfully.
• Right Not to Be Subject to Automated Decisions: You have the right not to be subject to a decision based solely on automated processing that produces legal or significant effects.

For GDPR-related inquiries, contact our Grievance Officer at hello@replykaro.com.

We are committed to complying with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. As a Data Fiduciary under this Act:

• Consent: We obtain your consent before collecting and processing your personal data. Consent is provided at the time of account creation and Instagram OAuth authorization.
• Purpose Limitation: We collect only the data necessary to provide the service. Data is not used for any purpose beyond what is stated in this policy.
• Data Principal Rights: As a Data Principal (data subject) under the DPDP Act, you have the right to access, correct, and erase your personal data. You may also nominate a person to exercise these rights on your behalf.
• Grievance Redressal: You may raise a complaint with our Grievance Officer (see Section 12). If unresolved, you may approach the Data Protection Board of India once it is constituted.
• Security: We implement reasonable security safeguards to prevent personal data breaches.
• Withdrawal of Consent: You may withdraw consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

ReplyKaro is not directed at children under the age of 13 (or under 18 without parental consent, where applicable). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately and we will delete the data without delay.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email (if provided) or through a prominent notice on our platform at least 15 days before the changes take effect. Continued use of ReplyKaro after the effective date constitutes acceptance of the updated policy.

We recommend reviewing this page periodically. The "Last Updated" date at the top of this page always reflects the most recent revision.