[{"data":1,"prerenderedAt":184},["ShallowReactive",2],{"\u002Fprivacy":3},{"id":4,"title":5,"body":6,"description":164,"extension":177,"meta":178,"navigation":179,"path":180,"seo":181,"stem":182,"__hash__":183},"legal\u002Fprivacy.md","Privacy Policy",{"type":7,"value":8,"toc":163},"minimark",[9,14,21,30,34,62,66,72,83,87,93,97,100,114,118,124,128,134,138,144,148,154,158],[10,11,13],"h2",{"id":12},"overview","Overview",[15,16,17,20],"p",{},[18,19],"app-name",{}," sends an automated Instagram direct message when someone comments a keyword you chose on one of your posts. This policy describes what data we process to run that automation, why we process it, how we protect it, how long we keep it, and how you and the people who comment on your posts can exercise your rights. We process only what the service needs. We do not sell your data and we do not use it for advertising.",[15,22,23,24,29],{},"Contact for any privacy question or request: ",[25,26,28],"a",{"href":27},"mailto:hi@chatsnag.com","hi@chatsnag.com",".",[10,31,33],{"id":32},"data-we-process","Data we process",[35,36,37,44,47,50,53,56,59],"ul",{},[38,39,40,41,43],"li",{},"Your ",[18,42],{}," account email and a securely hashed password. We never store your password in readable form.",[38,45,46],{},"Your Instagram professional account ID and username, obtained when you connect your account through Meta's official Instagram API.",[38,48,49],{},"Your Instagram access tokens, encrypted at rest with AES-256-GCM. Tokens are the credential that lets us send DMs on your behalf.",[38,51,52],{},"Comment events on your posts: the comment text and the commenter's Instagram ID and username, received from Instagram when a comment matches one of your keywords.",[38,54,55],{},"Delivery and activity-log records for the DMs your automations send, so you can see what was sent and why, or why a send did not happen.",[38,57,58],{},"Subscription status. Payments are handled by Paddle as our merchant of record. We never see or store your card details.",[38,60,61],{},"Product analytics and error data via PostHog, so we can understand product usage and diagnose failures.",[10,63,65],{"id":64},"commenter-data-and-our-respective-roles","Commenter data and our respective roles",[15,67,68,69,71],{},"People who comment on your posts never signed up with ",[18,70],{},". When your automation runs, we process a commenter's Instagram ID, username, and comment text only to deliver the DM you configured and to record the outcome in your activity log.",[15,73,74,75,77,78,80,81,29],{},"For your own account data, you and ",[18,76],{}," each play our normal roles: you control your account, and we process it to provide the service. For the commenter data that flows through your automations, you act as the party responsible for the messaging you send to your audience, and ",[18,79],{}," processes that data on your behalf to carry out your instructions. Requests from a commenter about their data are best directed to the account owner who runs the automation, and we will support you in responding. You can also reach us directly at ",[25,82,28],{"href":27},[10,84,86],{"id":85},"meta-platform-data","Meta Platform Data",[15,88,89,90,92],{},"The Instagram account data, comment events, and access tokens described above are Platform Data received through Meta's official Instagram API. We use this data solely to operate the automations you configure, to show you delivery outcomes, and to keep the integration working. We do not transfer it to any party other than the processors listed below, and we delete it as described under Retention and deletion. If you revoke ",[18,91],{},"'s access in your Instagram settings, the access token is invalidated immediately. See our Data Deletion page for the full deletion route.",[10,94,96],{"id":95},"subprocessors","Subprocessors",[15,98,99],{},"The service runs on a small set of processors, each receiving only what its role requires:",[35,101,102,105,108,111],{},[38,103,104],{},"Cloudflare: hosting, compute, and data storage.",[38,106,107],{},"Meta: the Instagram API that delivers comment events and sends the DMs.",[38,109,110],{},"Paddle: billing and subscription management, acting as merchant of record. Paddle handles payment card data directly. We do not receive it.",[38,112,113],{},"PostHog: product analytics and error tracking, hosted in the EU. During the beta period PostHog also records masked session replay in the panel only, to help us diagnose issues. The marketing site is not part of that replay.",[10,115,117],{"id":116},"retention-and-deletion","Retention and deletion",[15,119,120,121,123],{},"We keep your data while your account is active. When you close your account, or when you ask us to delete your data, we remove your account record, your encrypted Instagram access tokens, your automations, and your stored comment and DM activity. We may introduce shorter retention windows for activity data in the future, and we will update this policy if we do. To request deletion, see the Data Deletion page or email ",[25,122,28],{"href":27}," from your account address.",[10,125,127],{"id":126},"security","Security",[15,129,130,131,133],{},"Instagram access tokens are encrypted at rest with AES-256-GCM. Data in transit is protected with standard transport encryption. ",[18,132],{}," is run by a solo operator, and access to production data is limited accordingly.",[10,135,137],{"id":136},"cookies-and-sessions","Cookies and sessions",[15,139,140,141,143],{},"When you sign in to the panel, ",[18,142],{}," sets a session cookie through Better Auth so the app can keep you logged in. This cookie is necessary for the service to function. Product analytics are described under Subprocessors above.",[10,145,147],{"id":146},"your-rights","Your rights",[15,149,150,151,153],{},"Depending on where you live, data protection laws such as the GDPR in the European Union and the LGPD in Brazil give you rights over your personal data, including access and deletion. This applies both to account owners and, through the account owner, to people whose comments are processed by an automation. To exercise any right, email ",[25,152,28],{"href":27},". We will respond within a reasonable time and route requests to the right party where an account owner is involved.",[10,155,157],{"id":156},"contact","Contact",[15,159,160,161,29],{},"Questions or requests: ",[25,162,28],{"href":27},{"title":164,"searchDepth":165,"depth":165,"links":166},"",2,[167,168,169,170,171,172,173,174,175,176],{"id":12,"depth":165,"text":13},{"id":32,"depth":165,"text":33},{"id":64,"depth":165,"text":65},{"id":85,"depth":165,"text":86},{"id":95,"depth":165,"text":96},{"id":116,"depth":165,"text":117},{"id":126,"depth":165,"text":127},{"id":136,"depth":165,"text":137},{"id":146,"depth":165,"text":147},{"id":156,"depth":165,"text":157},"md",{},true,"\u002Fprivacy",{"title":5,"description":164},"privacy","EYOeQbHj6gQ-AvSLB77bfFMPS0ZFYxjaG-n2AvP5NsQ",1785890055984]