Privacy Policy — StackPicks AutoDM

This Privacy Policy explains how StackPicks AutoDM (“AutoDM”, “we”, “us”) — a product operated by Piyush Jangir, a sole proprietorship based in India — handles data when a creator connects their Instagram Professional account and uses AutoDM to reply to comments and send direct messages. Questions: stackpicks.dev@gmail.com.

AutoDM uses the Meta Instagram Graph API. Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including the Limited Use requirements. We comply with India's Digital Personal Data Protection Act 2023 and, where applicable, the EU GDPR.

1. Instagram data we access

When you connect your Instagram Professional account through Meta's official OAuth flow, we access only what the bot needs to function:

Account profile — your Instagram business ID and username (to identify your account and prevent the bot from replying to itself).
Access token — a long-lived Instagram access token issued by Meta. It is encrypted at rest using AES-256-GCM and is never displayed, logged, or shared.
Comments & Live comments — the text, comment ID, author username/ID, and parent media ID of comments on your posts, Reels, and Live broadcasts, so we can match your keyword rules.
Direct messages we send — the content of the auto-replies the bot sends on your behalf, plus delivery status and whether the recipient clicked your link.
Follower relationship — whether a commenter follows you, used only to choose follower vs non-follower reply copy.

We do not access your followers list, your private inbox history with other people, your media library beyond comment metadata, or any data unrelated to running your rules.

2. Why we use it

To detect comments matching the keyword rules you create and send the DM you configured.
To post the public comment reply you configured.
To show you analytics (sent, clicked, click-through rate) and a contacts list of who you reached.
To run our AI conversation agent that replies to recipients who message you back — strictly within Meta's 24-hour messaging window that opens when the recipient replies to your DM.
To keep your account safe (rate limits, spam-pattern checks, Meta error handling).

3. How we store and protect it

Data lives in a Supabase (PostgreSQL) database hosted in the Mumbai (ap-south-1) region, protected by row-level security so one creator can never read another's data.
Instagram access tokens are encrypted with AES-256-GCM before storage. Encryption keys are held in server environment variables, never in the database.
Comment and message text is stored only as long as needed for analytics and is truncated to what the feature requires.
We never sell your data, never run ad pixels, and never build profiles of your audience.

4. Third parties we share with

We share the minimum necessary with infrastructure providers, each acting as a processor under contract:

Meta Platforms — to send comment replies and DMs via the Instagram Graph API.
Anthropic (Claude API) — to draft reply copy in your voice. Prompts contain your sample messages and a recipient's username; they are not used to train models.
Supabase — database and authentication hosting.
Razorpay — subscription billing. We never see your card or UPI details.
Resend — to email you weekly digests and connection-health alerts.

5. Data retention

Connection and rule data is kept while your account is active.
Message and comment logs are retained for up to 12 months for analytics, then purged.
When you disconnect Instagram or delete your account, your access token is deleted immediately and remaining data is removed within 30 days.

6. How to delete your data

You are in control and can remove your data at any time, three ways:

In AutoDM — disconnect your Instagram account from the dashboard. This deletes the stored token at once.
From Instagram — go to Instagram → Settings → Apps and websites → remove “StackPicks AutoDM”. Meta notifies us and we purge your data.
By email — write to stackpicks.dev@gmail.com with the subject “Delete my data”. We action it within 48 hours on business days.

7. Your rights

You can request access to, correction of, or deletion of your personal data, and you can withdraw consent at any time by disconnecting. Contact stackpicks.dev@gmail.com (grievance officer: Piyush Jangir).

8. Changes to this policy

If we materially change how we handle Instagram data, we will update this page and the “last updated” date, and notify connected creators by email.