Privacy Policy — Insta Automation

Effective date: 22 July 2026. This Privacy Policy explains how Rudraayaan AI Technologies Private Limited ("we", "us", "our") collects, uses, stores, and protects information in connection with Insta Automation (the "Service"). By using the Service, you agree to the practices described here.

Who can use the Service

The Service is offered to users in India only, aged 18 or over, holding an Instagram Professional account. If you are outside India, do not use the Service.

Information we collect

Account data: your Instagram user ID, username, display name, and profile picture URL, plus an encrypted copy of the Instagram access token Meta issues for your account. Automation settings and content: the bio-link items, automation rules, keywords, and message texts you create. Interaction data: when someone interacts with your automations, we record their Instagram-scoped ID, the comment ID, and the state of the conversation flow (for example "asked to follow", "link delivered"), plus a log of automated DMs sent, and their Instagram handle where Meta makes it available to us. Email addresses volunteered by your audience: if you switch on the optional "ask for their email" step, the Service asks — after the automation has already delivered what it promised — whether the person would like updates by email. Nothing is withheld from someone who declines, and a reply of SKIP ends the request. We store only an address a person typed themselves; Meta never gives us one. Technical data: standard server logs (IP address, request time, user agent) kept for security and debugging.

We do not collect your Instagram password — sign-in uses Meta's official OAuth (Instagram Login) only. We do not read or store your inbox beyond the automation conversations described above, and we do not collect sensitive personal data.

How we collect it

Through your explicit authorisation (Instagram OAuth), through Instagram API calls and webhooks made on your behalf to run your automations, and through the details you enter yourself (bio items, automation settings).

Why we use it, and legal basis

We process data to perform our contract with you — signing you in, rendering your public bio-link page, and running your automations — and in our legitimate interest in keeping the Service secure and abuse-free. We do not use your data for advertising, selling, profiling, or AI training. Nothing is used beyond operating the Service.

Sharing and processors

We do not sell or share your data with advertisers. Three processors handle it under contract: Supabase (database hosting — where your profile, automations, and activity records are stored),Hostinger (server hosting — the machine our application runs on, which processes your data in memory and writes server logs), andMeta's Instagram API, which we call using your access token, on your behalf, to read comments on your posts, post your public replies, send private replies, and check follow status where you enabled the follow gate. If we add processors, this page will be updated.

International transfers

Our processors (Supabase, Hostinger, Meta) may store data outside India. Where data leaves India we rely on the processors' contractual safeguards and encryption in transit and at rest.

Security

We use reasonable technical and organisational measures: your Instagram access token is encrypted at rest (AES-256-GCM) and never sent to browsers or third parties, access to production systems is restricted, and all traffic uses HTTPS. No system is 100% secure; if a breach affects you, we will notify you and the relevant authorities as required by law.

Retention

Automation activity records — the DM log and the conversation-flow records of people who interacted with your automations — are deleted automatically after 30 days. Server logs are rotated on a similar schedule. Your profile, bio items, and automation settings are kept only while your account stays connected: if your access token expires or is revoked and never refreshed, or you disconnect the app, everything above is deleted immediately, including activity records younger than 30 days. One exception: we retain a minimal connection ledger — your Instagram user ID, username, and the dates you connected or deleted the app — for security and abuse prevention (for example, detecting repeated delete-and-reconnect cycles). Ledger entries are deleted automatically 12 months after they are recorded. Email addresses volunteered to you are the second exception: they are your business record rather than activity telemetry, so they are not deleted on the 30-day cycle. They are kept until you delete them or disconnect the app, and anyone who gave you an address may have it erased on request.

Your rights

You may access, correct, or delete your data, object to processing, or request a copy. The fastest route is self-service: the "Delete my data" control on your dashboard erases everything immediately — apart from the connection ledger described under Retention — and disconnecting the app from your Instagram settings triggers Meta's deletion callback, which does the same automatically. Deleting your data here does not by itself revoke the app's access on Instagram; remove it under Instagram Settings → Apps and websites to withdraw the authorisation. You can also email support@aisandy.tech; we respond within 30 days.

Government and law enforcement requests

We disclose your data to a public authority only where we are legally compelled to. Every request is reviewed for legality before anything is released — we check that the body is empowered to demand the data, that the instrument is a valid warrant, court order, or statutory notice, and that it identifies specific accounts rather than sweeping broadly. Verbal or informal requests are never actioned. Where we consider a request unlawful, overbroad, or defective, we object in writing, seek to have it narrowed, and instruct counsel to challenge it rather than comply. Disclosure is limited to the minimum the demand compels: only the named accounts and specific fields, never a bulk export, and never your Instagram access token. Every request is logged — the authority, the instrument, the data sought, the data actually disclosed, our legal reasoning, and who authorised the response — and that log is retained for seven years. Where the law permits, we notify affected users before disclosing, so they can seek their own remedy. As of the effective date of this policy, we have received no requests from public authorities.

Children's privacy

The Service is a business tool for adults and is not directed at children. You must be at least 18 to use it. We do not knowingly collect data from children; if you believe a minor's data has reached us, contact us and we will delete it.

Cookies and analytics

The Service uses one essential cookie: your session cookie after Instagram login. We run no third-party analytics or advertising trackers on the Service pages, and we make no automated decisions with legal effect about you.

Changes to this policy

We may update this policy; material changes will be posted here with a new effective date and, where appropriate, notified in-app. Continued use after changes take effect constitutes acceptance.

Liability

Our liability in connection with the Service is limited as described in the Terms of Service, which apply alongside this policy.

Operator, grievance officer, and governing law

The Service is operated by Rudraayaan AI Technologies Private Limited (CIN U62011TS2026PTC216546), Registered Office: H No. 14/964/64/A/1, Krishna Nagar Colony, Ameenpur, Ramachandrapuram, Medak, Telangana 502032, India. Insta Automation is published on Meta platforms as the app "ai_sandy" (Instagram app "ai_sandy-IG"); Card9, AI Sandy, and Insta Automation are brands of Rudraayaan AI Technologies Private Limited. Grievance Officer: Sandeep Naredla, grievance@aisandy.tech. This policy is governed by the laws of India; courts in Hyderabad, Telangana have exclusive jurisdiction.