Privacy Policy

Who we are

Relay is operated by Biren Nayak, trading as “Relay”, a sole proprietorship registered in Bengaluru, Karnataka, India (Udyam Registration No. UDYAM-KR-03-0755662). It replies to comments and sends direct messages on connected Instagram professional accounts using Meta’s official Instagram Platform API, only for accounts the operator owns or is authorised to manage. Data controller contact: birennayak845@gmail.com.

What we store

• For each connected account: the Instagram account ID, username, profile picture URL, and a long-lived access token (used to call the API on the account’s behalf).
• For comments that match a configured rule: the comment ID and text, the commenter’s Instagram-scoped ID and username, and a record of whether a reply or DM was sent.
• Automation rules, a log of outbound replies and messages, and a list of users who asked not to be messaged (“opt-outs”).
• The operator’s email address, for sign-in.

Comments that do not match a rule are not read or stored. If the operator does not enable the optional inbound-message feature, direct message content is not stored.

How it is used

Solely to deliver the automations the operator configures — matching comments to rules, posting replies, sending private replies, honouring opt-outs, and showing the operator activity and health information. Data is never sold, shared with third parties for their own purposes, or used for advertising or profiling.

Where it is stored

In a Supabase (PostgreSQL) database and on Vercel infrastructure, both hosted in the United States and accessed only by the operator. Access tokens are held server-side and are never sent to the browser.

Retention and deletion

Disconnecting an Instagram account from the Relay dashboard deletes that account, its rules, and its comment and activity records, and revokes the app’s webhook subscription. To request deletion of any data associated with your Instagram account, or to ask a question about this policy, email birennayak845@gmail.com. Requests are actioned within 30 days. This address is also the data deletion request contact for Meta App Review purposes.

Your rights

You may ask what data is held about you, ask for it to be corrected or deleted, and withdraw consent by having the relevant Instagram account disconnected. Use the contact address above.

Changes

If this policy changes, the “last updated” date above will change with it.