Privacy Policy

Last updated: August 24, 2026

1. Introduction

Instoly ("we", "our", or "us") operates the Instoly platform (instoly.com), a creator engagement platform that helps you grow and connect with your Instagram community. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

2. Information We Collect

2.1 Account Information

When you create a Instoly account, we collect:

  • Email address
  • Mobile number (required to verify your account and sign in)
  • Display name
  • Password (stored in hashed form — we cannot see your password)
  • Country and currency preferences

2.2 Instagram Account Data

When you connect your Instagram account, we receive:

  • Instagram username and user ID
  • Profile picture URL
  • Follower count
  • Account type (Business or Creator)
  • OAuth access token (used to send messages on your behalf)

2.3 Mobile Number and Verification Data

To verify your mobile number and secure your account, we collect:

  • Your mobile number in international format
  • Verification status and the date your number was verified
  • One-time passcodes we generate to verify your number and your sign-ins. These are stored only in hashed form and expire within minutes
  • Delivery status of the verification messages we send you (for example delivered or failed), so we can retry or offer another channel
  • Details of devices you choose to trust, so you are not asked for a passcode on every sign-in

We use your mobile number for account verification, sign-in, and essential service notices only. We do not use it for marketing without your consent, and we do not sell or share it with advertisers.

2.4 Comment and Message Data

To provide our DM engagement service, we process:

  • Comments on your Instagram posts (text and commenter's ID)
  • Messages sent on your behalf
  • Trigger keywords you configure in your flows

2.5 Billing Data

  • Which plan or credit pack you bought, when, and for how much
  • A payment reference and the payment method type (card, UPI, netbanking)
  • Your subscription status and renewal date
  • Invoices and receipts we generate for you

We do not collect or store card numbers, CVVs, UPI PINs or bank credentials. Those are entered on Razorpay's checkout and never reach us.

2.6 Usage Data

We collect basic analytics such as page views, feature usage, and error logs to improve the service.

3. How We Use Your Information

  • Core Service: Matching comments to trigger keywords and sending DM replies
  • Account Management: Authentication, profile management, and billing
  • Account Security: Verifying your mobile number and confirming sign-ins with a one-time passcode
  • Analytics: Providing you with flow performance statistics (DMs sent, clicks, conversions)
  • Service Improvement: Debugging issues, improving performance, and developing new features
  • Communication: Sending you important service updates and notifications

4. Third-Party Services

We interact with the following third-party services:

  • Meta/Instagram: We use the Instagram Graph API and Messenger Platform to send DMs and read comments. Your Instagram data is processed in accordance with Meta's Platform Terms.
  • WhatsApp (Meta): We use the WhatsApp Business Platform to deliver one-time passcodes to the mobile number you provide. Your number is shared with Meta solely to deliver these messages, and is handled in accordance with WhatsApp's Privacy Policy. We may add SMS as an alternative delivery channel in future.
  • Razorpay: Payments are processed by Razorpay, an RBI-authorised payment aggregator. Card numbers, UPI identifiers and bank credentials are entered on Razorpay's own checkout and never reach our servers. We receive and store only a payment reference, the amount, the payment method type, and what was bought — enough to show you a receipt and to honour our Refund & Cancellation Policy. Your name, email and phone number are shared with Razorpay to process the payment, and are handled under Razorpay's Privacy Policy.
  • Google Gemini: When you use an AI feature, the text or image you submit is sent to Google's Gemini API to generate the result. We do not send your Instagram credentials, your follower data or your DM history unless it is part of what you explicitly asked the feature to work on.
  • Amazon Web Services: Images and files you upload — product photos, invoice attachments, AI outputs — are stored on Amazon S3 and served through CloudFront.
  • MongoDB Atlas: Your data is stored securely on MongoDB Atlas cloud infrastructure with encryption at rest.

We do not sell your personal information to third parties.

5. Team Seats and Shared Access

An account owner can create team seats — additional logins that operate inside their account. If you are using Instoly through a seat someone created for you, you should understand what that means:

  • The account owner can see the work done from your seat, because it belongs to their account rather than to you.
  • The owner can see your name, the email address the seat was created with, and when you last signed in.
  • The owner can remove your seat at any time, which ends your access immediately.
  • You cannot see the owner's billing details, payment methods or invoices, and they cannot see any password you set.

A seat is not a separate account. If you want an account of your own, sign up with your own email address.

6. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us. When you disconnect your Instagram account, we immediately delete your access token and Instagram-specific data.

7. Data Security

We implement industry-standard security measures including:

  • HTTPS encryption for all data in transit
  • Hashed passwords using bcrypt
  • One-time passcodes stored hashed, with short expiry and limited attempts
  • JWT-based authentication with httpOnly cookies
  • MongoDB Atlas encryption at rest
  • Access token isolation per user

8. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Disconnect your Instagram account at any time
  • Update your mobile number or revoke trusted devices at any time
  • Export your data in a portable format

9. Instagram Data Deletion

If you remove Instoly from your Facebook/Instagram connected apps, we will receive a data deletion request from Meta. We will delete all your Instagram-related data (tokens, username, profile info, comment history) within 48 hours.

10. Children's Privacy

Our service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our website.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at: contact@instoly.com