Privacy Policy

1. Introduction

InstaBot SaaS ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Instagram automation platform (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Account Information

• Telegram user ID, username, and profile information
• Email address (if provided for billing/notifications)
• Billing information (processed by Stripe/PayPal — we do not store full card details)

2.2 Instagram Connection Data

• Instagram Business/Creator account ID and username
• OAuth 2.0 access tokens and refresh tokens (encrypted at rest)
• Token expiry timestamps
• Account type verification (Business/Creator)

2.3 Usage Data

• Routing rules and filter configurations
• Copy logs: source media IDs, target account IDs, status, timestamps
• Media metadata (captions, hashtags, media types) for processing
• Shortened URLs and referral code mappings
• Analytics: impressions, engagement, reach, video views (from Instagram Insights API)

2.4 Technical Data

• IP address, browser user agent, device information
• Request timestamps, API response codes, error logs
• Rate limit usage and queue statistics

3. How We Use Your Information

• Provide the Service: Authenticate with Instagram Graph API, execute routing rules, process media, apply watermarks, shorten URLs
• Account Management: Create and manage your account, process payments, send billing receipts
• Communications: Send service notifications, security alerts, feature updates, and marketing emails (with opt-out)
• Analytics & Improvement: Monitor system health, debug errors, optimize performance, develop new features
• Security & Compliance: Detect fraud, prevent abuse, enforce Terms of Service, comply with legal obligations
• Earnings Features: Process referral codes, track shortener clicks, calculate estimated earnings

4. Data Sharing & Disclosure

We do not sell your personal data. We share information only in these circumstances:

• Service Providers: Cloud hosting (Vercel/AWS), database (PostgreSQL), queue (Redis), payments (Stripe/PayPal), email (SendGrid), analytics (Plausible). All under DPAs.
• Instagram/Meta: OAuth tokens sent to Graph API for publishing. We do not share your data with Meta beyond API requirements.
• Legal Requirements: When required by law, court order, or to protect our rights/safety.
• Business Transfers: In merger/acquisition, data transfers with notice and continued privacy protection.
• With Your Consent: Any other sharing only with explicit opt-in.

5. Data Security

• Encryption: OAuth tokens encrypted at rest using Fernet (AES-256). TLS 1.3 for all transit.
• Access Control: Row-level security in PostgreSQL. Principle of least privilege for staff access.
• Infrastructure: SOC 2 Type II certified providers. Regular penetration testing.
• Monitoring: Audit logs for all data access. Automated anomaly detection.
• Incident Response: 72-hour breach notification per GDPR. Documented IR plan.

6. Data Retention

• Account Data: Retained while account is active + 30 days after cancellation for recovery.
• Copy Logs: 90 days (extended to 1 year on Pro+/Enterprise for compliance).
• Analytics Data: Aggregated data retained indefinitely; raw data purged after 1 year.
• Billing Records: 7 years for tax/compliance (Stripe/PayPal retain separately).
• Logs: Application logs 30 days; security logs 1 year.

7. Your Rights

Depending on your jurisdiction, you may have:

• Access: Request a copy of your personal data (GDPR Art. 15, CCPA §1798.100)
• Rectification: Correct inaccurate data (GDPR Art. 16)
• Erasure: Request deletion ("right to be forgotten") (GDPR Art. 17, CCPA §1798.105)
• Portability: Receive data in structured format (GDPR Art. 20)
• Restriction/Objection: Limit or object to processing (GDPR Art. 18, 21)
• Withdraw Consent: Where processing is based on consent

To exercise these rights, email privacy@instabot.ioor use the Data Request form in your dashboard. We respond within 30 days (GDPR) / 45 days (CCPA).

8. Cookies & Tracking

• Essential: Session authentication, CSRF protection, rate limiting (cannot be disabled)
• Analytics: Plausible Analytics (privacy-friendly, no cookies, GDPR compliant)
• No: Advertising cookies, third-party trackers, fingerprinting, cross-site tracking

You can disable non-essential cookies via your browser settings.

9. International Transfers

Our infrastructure is hosted in the United States (Vercel/AWS US-East). If you're in the EEA/UK, your data transfers rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework. We ensure adequate safeguards per GDPR Chapter V.

10. Children's Privacy

The Service is not directed to individuals under 13 (or 16 in EEA). We do not knowingly collect data from children. If you believe a child has provided data, contact us for immediate deletion.

11. Third-Party Links

The Service may contain links to third-party websites (Instagram, Meta, Stripe, shortener providers). We are not responsible for their privacy practices. Review their policies before providing data.

12. Changes to This Policy

We may update this policy. Material changes will be notified via email and in-app banner 30 days before effective date. Continued use after changes constitutes acceptance. Check this page periodically.

13. Contact Us

14. Supervisory Authority

If you're in the EEA, you have the right to lodge a complaint with your local data protection authority.List of EU DPAs