Privacy Policy

Who Is Responsible

This OpenReply instance is run by its operator, who is responsible for the personal data described here. For any privacy question or request, contact the operator of this instance.

Data We Collect

• People who use the dashboard: email address, sign-in sessions, and workspace membership and role.
• Connected Instagram professional accounts: account ID and username, profile details and follower counts, the posts and reels used in campaigns, and the access token, which is stored encrypted.
• People who comment on, message, or reply to a story of a connected account: Instagram username and user ID, the text of the comment or message, the keyword that matched, and whether a reply was sent, skipped, or failed. When a campaign asks people to follow first, Instagram tells us whether they follow the account.
• People who tap a tracked link: the time, a keyed hash of the IP address (never the address itself), a keyed hash of the recipient the link was sent to, the browser's user agent, and the referring page.
• Technical records: the raw notifications Instagram sends, delivery errors, and service diagnostics.

How We Use Data

To run the campaigns a connected account set up: matching keywords, sending the private reply and any public reply, preventing duplicate messages, counting link clicks, and showing results to the account's team. We also use it to keep the service secure and to fix failures. We do not sell personal data or use it for advertising.

Where the GDPR applies, the legal basis is the contract with dashboard users, and the legitimate interest of the connected account in answering people who asked for something by commenting or messaging. Security and diagnostic records rely on the legitimate interest in protecting the service.

Instagram And Meta Data

OpenReply uses only Meta's official APIs. It never asks for Instagram passwords, scrapes Instagram, or automates a browser. Access tokens are encrypted at rest and used only for actions the connected account authorized. A private reply only goes to someone who commented or messaged first, within Instagram's messaging rules.

Service Providers

These providers process data only to provide their service to this instance:

• Hetzner Online GmbH hosts the server and database in Finland (EU).
• Cloudflare, Inc. secures and routes every request to the server, including visitors' IP addresses.
• Resend sends sign-in emails.
• Meta Platforms delivers comments and messages through the Instagram API and sends the replies.
• Zernio does the same for any Instagram account connected through it.

Some of these providers may process data outside your country, under their own data protection terms.

How Long We Keep It

• Data is kept while the workspace or Instagram connection it belongs to exists.
• Disconnecting an Instagram account deletes it from this instance together with its access token, campaigns, reply logs, click records, and follower history.
• Raw notifications from Instagram and service diagnostics are deleted after 30 days.
• Database backups are deleted after 14 days.

Your Rights

You can ask for a copy of your data, ask for it to be corrected or deleted, and object to how it is used. This includes people who commented on or messaged a connected account: email the operator of this instance with your Instagram username. We answer within one month. Where the GDPR applies, you can also complain to your data protection authority. The data deletion page explains how deletion works.

Changes

When this policy changes, we update this page and the date at the top.