Privacy policy

Replyloop is operated by Grrow With Creative, India. You can reach us at grrowwithcreative@gmail.com for any question about this policy or about data we hold on you.

When you sign up we store your email address and, if you sign up with a password, your name and phone number. If you enter a GSTIN we store it for invoicing. We store a record of your plan and your payments. We do not store card numbers — Razorpay handles payment details and we never see them.

When you open a page on this site we record your IP address, your approximate location (city and country, worked out from the IP address by our host, Vercel), your device type, browser and operating system, the page you opened, the site that linked you here, how long you stayed and how many links or buttons you clicked. If you are signed in, the visit is linked to your account. We use this to understand how the site is used and to stop abuse, such as blocking a network that is attacking sign-in. We do not use cookies for this and we do not share it with advertisers. Visit records are deleted after 90 days.

If you arrive through another customer's referral link, we set one cookie holding their referral code for 30 days, so they can be credited if you sign up. It is not used for anything else.

When you connect an Instagram account, Meta gives us an access token. We never see or receive your Instagram password. Using that token we access, and store, only the following:

• Your Instagram user ID, username and profile picture URL, to show you which account is connected.
• The ID, thumbnail and caption of your posts and reels, read from Instagram when you open the post picker so you can choose which one an automation runs on. We store only the IDs of the posts you pick.
• The text, author ID and author username of comments on your posts, so we can check them against your keywords.
• The text and sender ID of direct messages and story replies sent to you, for the same reason.
• A record of each DM we sent on your behalf: who it went to, which automation sent it, when, and whether it was delivered.
• Email addresses that people give in reply to your DM, only on automations where you have switched on email capture.
• Whether a person follows your account, and their name, asked from Instagram only after they tap the button or reply on an automation where you have switched on “Ask them to follow first”.
• Taps on the link buttons in your DMs: which automation, when, and the browser used. The person is recorded as a scrambled code, not by name or Instagram ID.
• Whether a DM we sent for you was read, from Instagram's read receipts, so you can see how many people opened it. We store the time it was read, nothing about what they did next.
• The full caption of your new posts, read (not stored) to look for a “comment this word” call to action, only if you switch on zero-setup automations. We keep the matched phrase.
• A voice note you record or upload for an automation. It is kept in private storage, sent only to people that automation messages, and deleted when you remove it or delete the automation.
• For a Launch Drop or Comment Goal, a list of who commented and when, so they can be sent your DM later.

Solely to run the automations you set up. We match comment text against your keywords, send the message you wrote, and show you how many were sent. We do not build advertising profiles, we do not sell or share this data with anyone, and we do not use it to train machine learning models.

Messages sent through Replyloop are sent automatically by software, not typed by a person at the time of sending. People receiving them are interacting with an automated system. We require every account owner to make this clear where it is not obvious, and we do not permit the service to be used to impersonate a human support agent.

Comment and message content is kept for 90 days, then deleted automatically; we keep it that long so you can see why an automation fired or did not. Delivery records, link-tap records, and the usernames of people who interacted with you, are kept for 12 months for billing and support. Captured email addresses are kept until you delete them or close your account. When you disconnect an Instagram account we delete its token immediately and its content within 30 days. Website visit records (IP address, pages viewed) are deleted after 90 days.

You can disconnect an Instagram account at any time from Settings, or revoke our access from inside Instagram itself. Deleting your Replyloop account from Settings erases everything we hold on you within 30 days, apart from payment invoices, which Razorpay keeps as Indian tax law requires. You can also email grrowwithcreative@gmail.com and ask us to do it.

Removing Replyloop from Instagram's Apps and websites settings deletes that account's data straight away. See data deletion for every route and to check a request.

We use a small number of processors: Supabase (database), Vercel (hosting), Razorpay (payments), Resend (transactional email), and Google (only if you choose to sign in with Google). Each only handles what it needs to. We do not transfer your data to any other party.

Instagram access tokens are encrypted before they are stored. All traffic runs over HTTPS. Webhook deliveries from Meta are verified against a signature before we act on them, so nobody can inject fake events into your account.

Send complaints about the service or this policy to grrowwithcreative@gmail.com.

If we change this policy in a way that affects what we collect or why, we will email you before it takes effect.