Privacy Policy

Who Runs AutoReplies

The hosted service at reply.originalcopy.studio is run by Original Copy Studio Pte Ltd, a company registered in Singapore ("we", "us"). We follow Singapore's Personal Data Protection Act 2012 (PDPA). Our Data Protection Officer is Dominic Ho.

If You Comment On A Connected Post

When you comment on a post or reel from an Instagram account that uses AutoReplies, Meta sends us the comment. We store your Instagram user ID and username, the comment text and its ID, the keyword it matched, and whether the private reply (and any public reply) was delivered. If the account only sends to followers, we ask Meta whether you follow it.

If the private reply contains a tracked link and you open it, we record the click with a one-way hash of your IP address (never the address itself), your browser type and the referring page.

We use this only to send the reply you asked for, avoid sending it twice and fix delivery problems. We don't sell it and we don't use it to advertise to you.

If You Sign In To AutoReplies

We store your email address (to send sign-in links), your workspace and team memberships, the Instagram professional account you connect (its ID, username, name and access token), your campaign settings, keywords, messages and tracked links, and daily follower counts for the connected account.

Instagram And Meta Data

AutoReplies connects through Instagram Login and Meta's official Graph API. It never asks for Instagram passwords, doesn't scrape Instagram and doesn't use browser automation. Access tokens are encrypted at rest and used only for actions the connected business account has authorised.

Service Providers

These companies process data for us, only as needed to run the service:

• Netlify: hosts the app and runs its scheduled jobs (United States)
• Supabase: the database that stores the data above (South Korea)
• Resend: sends sign-in emails (United States)
• Meta: the Instagram API (United States and other countries)

AutoReplies has no analytics or advertising trackers. It only sets the cookies needed to keep you signed in.

How Long We Keep It

Comment, delivery and click records stay while the connected account is active, so we can prevent duplicate messages and investigate problems. Finished queue jobs are deleted automatically. Disconnecting Instagram deletes the stored connection and access token along with that account's campaigns, comment and delivery logs, tracked links and click records. Raw Meta webhook records and diagnostic logs are kept until we delete them on request. You can ask us to delete any of this at any time, as described on the Data Deletion page.

Your Rights

You can ask what data we hold about you, ask us to correct it or ask us to delete it. Email hello@originalcopy.studio with "Privacy" in the subject line and we will reply within 30 days.

Contact

Original Copy Studio Pte Ltd, Singapore. Data Protection Officer: Dominic Ho, hello@originalcopy.studio. The studio's full privacy policy is at originalcopy.studio/privacy.html.