Privacy notice

Information you give us. When you create an account or fill in a form on this site we collect your name, email address, and, where you choose to provide them, your company name, job title, phone number and country.

Information from Instagram. When you connect an Instagram account, Meta sends us an access token plus the profile information you authorise: your account ID, username, profile picture, follower count, and the posts, comments, story replies and direct messages the automation needs in order to act on them. We never ask for, receive or store your Instagram password. Authentication happens entirely through Meta’s official login, and you can revoke our access at any time from Instagram’s settings or from your ReplyRep dashboard.

Information your audience gives you. If you use ReplyRep to capture email addresses or phone numbers from the people who comment on or message your posts, we store those on your behalf. Section 4 explains who is responsible for that data.

Payment information. Card details are collected and stored by our payment processor, Stripe, and never touch our servers. We keep only the billing email, the plan you are on, and the last four digits and brand of the card so you can recognise it.

Usage information. Log data such as IP address, browser, device type, pages visited and the actions you take in the product, which we use to run and improve the service.

We do not collect special category data (health, biometrics, political opinions and similar), and we do not buy personal information from data brokers.

• To create your account and log you in.
• To run the automations you set up: reading the comments, mentions and messages you have asked us to watch, and sending the replies you have written.
• To take payment and send invoices and receipts.
• To show you analytics about your own account: DMs sent, link clicks, reply rates.
• To provide support, and to notify you about outages, security issues or material changes to the service.
• To detect and prevent fraud, abuse and violations of our terms.
• To comply with legal obligations.

We send marketing email only if you opt in, and every marketing email has an unsubscribe link that works. Service and billing emails are not marketing and cannot be unsubscribed from while you hold an account.

We do not sell your personal information, and we do not use the content of your DMs to train machine learning models that serve anyone other than you.

If you are in the UK, EU, EEA or Switzerland, we rely on the following bases under the UK GDPR and GDPR:

• Performance of a contract: running your account and your automations, and taking payment.
• Legitimate interests: keeping the service secure, preventing abuse, and improving the product. We balance these against your rights and interests.
• Consent: marketing email and non-essential cookies. You can withdraw consent at any time.
• Legal obligation: tax, accounting and responding to lawful requests.

This section matters more for ReplyRep than for most tools, so it is worth being explicit.

When ReplyRep sends a DM on your behalf and someone replies with their email address, phone number or anything else, you are the controller of that information and we are your processor. It is your data. We hold it so the product works, we act on your instructions, and we do not use it for our own purposes, sell it, or message those people on our own behalf.

That means a few obligations sit with you, not us:

• Having a lawful basis for contacting the people you contact, and telling them what you will do with their details.
• Honouring their requests to access or delete their data. You can do this yourself from your dashboard; if you need help, email us.
• Complying with Meta’s platform policies and any marketing law that applies where your audience lives.

You can export or delete this data at any time. If you close your account we delete it on the schedule in section 7.

We share personal information only with service providers who help us run ReplyRep, and only as much as they need:

• Meta Platforms: to send and receive Instagram messages through the official API. This is the core of the service.
• Stripe: payment processing.
• Cloud hosting and infrastructure providers: to store data and serve the application.
• Analytics and error monitoring: to understand how the product is used and to fix crashes.
• Email delivery: for service and, where you have opted in, marketing messages.

We may also disclose information where we are legally required to, to enforce our terms, to protect someone’s safety, or as part of a merger or acquisition, in which case we will tell you before your information becomes subject to a different privacy notice.

We use a small number of cookies. Strictly necessary cookies keep you logged in and keep the site secure; these cannot be turned off. Analytics cookies tell us which pages people read and where they get stuck.

You can block or delete cookies in your browser settings. Blocking the necessary ones will stop you being able to log in.

We honour Global Privacy Control (GPC) signals where your browser sends them.

• Account information: for as long as your account is open, then 30 days after you close it, so an accidental deletion can be undone.
• Contacts and leads captured through automations: until you delete them, or 30 days after your account closes.
• Message content: 90 days, so you can see recent conversations and we can investigate delivery problems.
• Billing records: as long as tax law requires, typically six to seven years.
• Server logs: 30 days.

Backups are on a rolling cycle and are overwritten; data can survive in a backup for a short period after deletion, isolated from any further use.

Data is encrypted in transit with TLS and at rest. Access to production systems is limited to the people who need it and is logged. Instagram access tokens are stored encrypted, and because authentication runs through Meta’s official login, there is no password of yours for us to lose.

No system is perfectly secure. If a breach affects your personal information we will tell you and the relevant regulator within the timeframes the law requires.

We and our providers may process information in countries other than yours, including the United States. Where information leaves the UK, EEA or Switzerland we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, together with additional safeguards where needed.

ReplyRep is not for people under 18, and Instagram’s own terms require business and creator accounts to be held by adults. We do not knowingly collect information from children. If you believe a child has given us information, email privacy@replyrep.io and we will delete it.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct it if it is wrong.
• Delete it.
• Receive it in a portable format.
• Object to or restrict how we use it.
• Withdraw consent you previously gave.
• Not be discriminated against for exercising any of these.

Most of this you can do yourself from your dashboard. For anything else, email privacy@replyrep.io and we will respond within 30 days. We will not charge you for a reasonable request.

If you are in the UK or EEA and think we have handled your data badly, you can complain to your national data protection authority. In the UK that is the Information Commissioner’s Office.

If you are a California resident, you have the rights described above under the CCPA/CPRA, including the right to know what we collect and the right to opt out of “sale” or “sharing”. We do not sell or share personal information as those terms are defined.

We update this notice when the product or the law changes. The date at the top always reflects the current version. If a change materially affects your rights we will email account holders before it takes effect.

Privacy questions and rights requests: privacy@replyrep.io
Everything else: support@replyrep.io

ReplyRep is operated by ReplyRep LLC, a limited liability company registered in Delaware, United States.