Skip to content
ReplyHook
Waitlist

Privacy policy

Last updated: October 23, 2026

This text is a draft and will be reviewed by a lawyer.

Scope

This policy explains how [Company name] (“ReplyHook”, “we”) processes personal data in the ReplyHook service at https://replyhook.app. The service lets owners of Instagram professional accounts (“Customers”) automatically respond to comments and messages on their own accounts via the official Instagram API.

Data we process

  • Customer account: name, email, password hash (we never store your password in plain text), Google user ID when signing in with Google, session data.
  • Connected Instagram account: Instagram account ID, username, profile picture URL and an encrypted access token. Your Instagram password never reaches us.
  • People who comment or send messages: Instagram user ID, username, the first 200 characters of the comment, message content when the assistant is enabled, and delivery status.
  • Tracked links: click time and a one-way hash of the browser string. IP addresses are not stored.
  • Server logs: technical logs for debugging. Tokens and message content are never written to the logs.

Why we process it

  • Providing the service: sending private messages to comments that match the Customer’s rules, replying to comments, showing statistics.
  • Preventing duplicate messages and complying with Meta’s messaging rules (24-hour window, one private reply per comment).
  • Security, abuse prevention and legal obligations.

Retention

Comment text is deleted after 30 days. Deduplication records are deleted within 7–30 days. Raw webhook events are kept for 14 days.

The Customer account and its settings are kept until the account is deleted. When an Instagram account is disconnected, the rules, deliveries and conversations of that account are deleted.

Sharing and transfers

We do not sell data or use it for advertising. To run the service, data is shared only as needed with these service providers: Meta Platforms (Instagram API), our hosting provider, our email delivery provider and, when the chat assistant is enabled, Anthropic (Claude API; only the relevant conversation and the Customer’s knowledge base are sent).

Some of these providers may be located outside Turkey; transfers are made in accordance with Article 9 of KVKK.

Your rights and deletion

To request access, correction or deletion of your data, write to info@sefayilmaz.dev. Customers can delete their own account in Settings in the dashboard.

Instagram users can remove the app’s access or send a data deletion request from Instagram settings; the related data is then deleted automatically and the status can be checked with the confirmation code at https://replyhook.app/data-deletion.

Security

Access tokens are encrypted with AES-256-GCM, connections are protected with HTTPS, and each customer’s data is separated by row-level isolation in the database.

Contact

[Company name] · [Registered address] · info@sefayilmaz.dev