Privacy Policy

Last updated: October 20, 2026

1. Overview

AutoInsta ("we", "us", "our") provides Instagram direct messaging automation, comment-to-DM triggers, and follow-gate verification for creators and businesses. We strictly respect your privacy and process data exclusively to provide automation services under official Meta Platform Terms.

2. Data We Collect

We only access data explicitly granted through your Instagram Professional account authorization via the Meta Graph API:

  • Basic Instagram Business / Creator profile details (username, account ID, profile picture).
  • Inbound comments on your posts and reels for triggering configured automations.
  • Direct message interactions initiated by commenters or users requesting automated links.
  • Public follower relationship status strictly required to evaluate follow-gate unlock conditions.

3. Encryption & Security Standards

All OAuth access tokens and sensitive credentials are encrypted at rest using industry-standard AES-256-GCM with authenticated associated data (AAD) bound to the Instagram account ID and unique per-record initialization vectors (IV). Plaintext tokens are never stored, logged, or exposed.

4. Data Deletion & Account Disconnection (Implemented Behavior)

AutoInsta ensures full control over your data in compliance with GDPR and Meta Developer Data Policies:

  • Instant Credential Destruction upon Disconnect: When you disconnect an Instagram account from Workspace Settings, the associated EncryptedCredential record is permanently hard-deleted from our database immediately, rendering all previous access tokens unusable. The account status is instantly switched to DISCONNECTED, stopping it from counting against workspace account limits.
  • Data Retention Schedules: In accordance with data minimization principles, AutoInsta runs regular automated maintenance cleanup routines:
    • Successfully processed webhook events (PROCESSED) are permanently deleted after 7 days.
    • Granular automation execution step logs (ExecutionStep) are purged after 30 days.
    • Expired temporary OAuth states (OAuthState) are deleted after 24 hours.
    • Expired workspace invites are purged after 30 days.
    • Shared rate limit counters (RateLimitEntry) are purged automatically when expired.
    • Completed data deletion requests (DeletionRequest) and status confirmation records are retained for 90 days for compliance verification, then permanently expunged.
  • Meta Data Deletion Callback Endpoint: When a user removes the application or initiates a data deletion request through Facebook/Instagram settings, Meta sends an authenticated request via HMAC-SHA256 signed_request to our public endpoint:
    POST /api/meta/data-deletionUpon receipt of a verified request:
    • A cryptographic hash (SHA-256) of the Meta user ID is verified; raw Meta user IDs are never stored.
    • In a single atomic database transaction, all stored credentials, webhook events, messages, automation executions, execution steps, contact automation states, contacts, and automations (including post captions and thumbnails) associated with that account are permanently deleted.
    • Scheduled job payloads referencing the account are purged, and older workspace audit logs have account-identifying fields (username, instagramId, pageId) permanently redacted.
    • The InstagramAccount record is anonymized: username, name, profilePicUrl, pageId, and pageName are set to null, the instagramId is replaced with a unique anonymous tombstone, and status is set to DISCONNECTED.
    • An audit log is created containing zero personal identifiers.
    • A unique 32-character confirmation code is generated and returned to Meta with the status tracking URL.
    • If the user ID is not found, an anonymous confirmation code is returned with status NOT_FOUND without revealing whether an account exists. If the account connects or requests deletion later, the status re-evaluates without caching NOT_FOUND permanently.
  • Public Status Tracking: Anyone with a valid confirmation code may verify the real-time status of their deletion request publicly at:
    GET /data-deletion/[confirmation_code]This page displays only the transaction timestamp and completion status, containing zero personal identifiers or user details.
  • Manual Profile Deletion: You may also request deletion of your entire AutoInsta profile, workspaces, and team memberships by emailing our privacy team. All associated data will be deleted within 30 days.

5. Contact Information

For privacy inquiries, data deletion requests, or questions regarding our security practices, contact us at:
admin@autodm.link