Privacy Policy

1. Information We Collect

InstAuto operates strictly as an automation software facilitating automated responses to user interactions on public Instagram Reels. We collect only the minimal data required to execute your automations:

• Account Credentials: Name, email address, and hashed passwords (using cryptographic salt + scrypt) when you register directly on InstAuto.
• Meta / Instagram Authorization Data: When you connect via official Meta OAuth, we receive your Facebook Page ID, Instagram Business Account ID (`ig_user_id`), Instagram handle, and a temporary authorization token.
• Public Interaction Metadata: When an Instagram user comments on your designated Reels, Meta webhooks notify our server of the comment ID, timestamp, and text content to evaluate your keyword rules.
• What We NEVER Collect: We never request, collect, or store your personal Instagram account password, private direct message archives, credit card numbers, or biometric information.

2. How We Use Your Data

Your data is used solely to operate the InstAuto platform and fulfill the automation instructions you configure:

• To verify incoming comments against creator-defined trigger rules (e.g. matching keywords like "PRICE" or "LINK").
• To send designated automated direct messages and public comment replies via official Meta Graph API endpoints.
• To display delivery logs, success counts, and error statuses within your private creator dashboard.
• To communicate essential account updates, password reset OTPs, and subscription billing confirmations.

3. Meta Graph API & Webhook Compliance

InstAuto operates in strict adherence to the Meta Platform Terms and Developer Policies:

4. Hardware-Grade AES-256-GCM Token Encryption

All access tokens granted through Meta are encrypted at rest using military-grade AES-256-GCM (Galois/Counter Mode) authenticated encryption with unique initialization vectors (IV) and authentication tags. Unencrypted access tokens are never saved to plain disk or exposed in client-side logs.

5. Third-Party Disclosure & Data Selling

We do NOT sell, rent, monetize, or trade your personal or Instagram account data to third-party data brokers, advertising networks, or analytics firms. Data is only transmitted to Meta servers strictly as necessary to execute requested API actions.

6. Data Retention & User Deletion Rights

You have full sovereignty over your data at all times:

• Instant Disconnect: You can disconnect your Instagram account anytime from your dashboard settings, instantly purging your access token from our vault.
• Complete Account Scrubbing: You may request complete account and data deletion by visiting our User Data Deletion page or emailing us at admin@hyukon.in. All associated records, logs, and tokens will be permanently scrubbed within 24 hours.

7. Contact & Grievance Redressal

For privacy inquiries, data deletion requests, or questions regarding this policy, contact our dedicated data team: