Privacy policy

Controller

Operator details will follow.

What we process

• User account: email address, name (optional), password hash, language setting.
• Connected Instagram accounts: account ID, username, name, profile picture URL, linked Facebook Page ID and an access token (stored encrypted).
• Campaigns: keywords, texts and selected posts you create.
• Comment and messaging events Meta sends us by webhook: comment ID, text, Instagram ID and username of the commenter, media ID, button taps. We keep only what replies and the activity log need (username, ID, status, comment excerpt in the log).

Purpose

Solely to reply automatically, on your behalf, to comments containing your keywords by direct message and optionally in public, and to check beforehand whether the person follows your account (Art. 6(1)(b) GDPR; for commenters (f) – legitimate interest in delivering requested information). No advertising, no sale of data, no profiling.

Retention

Log entries are deleted after 90 days. Disconnecting an Instagram account immediately deletes its token, campaigns and log. Deleting your user account deletes all associated data.

Recipients and hosting

Server: VPS in Germany. Meta Platforms (Instagram Graph API) to send messages. Password reset emails are sent through Resend (Resend, Inc., USA; standard contractual clauses).

Your rights

Access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority. How to delete your data: Data deletion.

ReplyKit · Last updated: 02.11.2026