Privacy Policy

OrganicChat is operated by an individual sole proprietor based in California, United States. This policy covers our website and app. It applies to our customers and their team members, and to people who interact with our customers’ Instagram accounts (for example by commenting on a post).

From customers and team members:

• Your email address, and your name if you add one.
• Workspace details, team members and invitations.
• The campaigns you create: keywords, messages, links and settings.
• Billing status and subscription details. Card details are collected and stored by Stripe, not by us.

From connected Instagram accounts (see section 4):

• The account’s ID, username, name, profile picture and follower count.
• An access token from Instagram, stored encrypted.
• Posts, reels, insights, comments and direct messages needed to run your campaigns and inbox.

About people who interact with a customer’s Instagram account:

• Their Instagram user ID and username, the comment or message text, and whether a reply was sent (our delivery logs).
• When they open a tracked link in a message: a one-way hash of their IP address (never the IP itself), their browser’s user agent, the referring page, and the time.

Automatically: basic technical and usage data such as pages visited and device type, collected through Vercel Analytics, plus server logs used for security and troubleshooting.

• To provide the service: sign you in, connect Instagram, match keywords, send messages and replies, show your inbox, stats and reports.
• To bill you and manage your subscription.
• To prevent duplicate or unwanted sends, stay within Instagram’s limits, and keep the service secure.
• To troubleshoot problems, support you, and improve OrganicChat.
• To email you about your account, billing, and important changes. We won’t send marketing emails without your consent.
• To meet legal obligations and enforce our Terms of Service.

OrganicChat uses Meta’s official Instagram APIs. We never ask for Instagram passwords, scrape Instagram, or use browser automation. We access an account only after its owner connects it, and only to perform the actions they set up. Data received from Instagram is used solely to provide OrganicChat to that customer. It is not sold, used for advertising, or used to build profiles of people across accounts.

Customers can disconnect Instagram at any time in Settings, or remove OrganicChat’s access from Instagram’s own settings. See Data Deletion.

We share data only with service providers that help us run OrganicChat, under agreements that limit their use of it:

• Vercel: website and app hosting, analytics.
• Neon: database.
• Redis: message queue and rate limiting.
• Resend: sign-in and account emails.
• Stripe: payments and billing.
• Meta (Instagram): to send and receive messages through its APIs.
• Our server host for the background worker that sends messages.

We may also disclose information if required by law, to protect rights and safety, or as part of a sale or transfer of the business, in which case this policy continues to apply. We do not sell or share personal information for cross-context behavioral advertising.

We use a necessary cookie to keep you signed in. The app also stores some data in your browser for the current tab session so pages load faster. We don’t use advertising cookies. Vercel Analytics measures usage without advertising cookies.

We keep account and campaign data while your account is active. When you disconnect an Instagram account, we delete its stored access token. When you ask us to delete your account, we delete or anonymize your data within 30 days, except where we must keep some records (such as billing records) for legal, tax, fraud-prevention or security reasons.

Instagram access tokens are encrypted at rest, connections are encrypted in transit, and access to production systems is restricted. No method of storage or transmission is completely secure, but we work to protect your data and will notify you of a breach affecting it as the law requires.

You can:

• update or delete campaigns and disconnect Instagram accounts in the app;
• ask for a copy of your personal information, or for it to be corrected or deleted;
• opt out of non-essential emails.

Email support@organicchat.io from the address on your account. We may need to verify your identity first. If you commented on or messaged one of our customers and want your data removed, contact that customer or us, and we will help.

If you live in California, you have the right to know what personal information we collect, use and disclose; to request access to or deletion or correction of it; to opt out of its sale or sharing (we don’t sell or share it); to limit use of sensitive personal information (we don’t use it for purposes that require this); and not to be discriminated against for exercising these rights. The categories we collect are described in section 2, the purposes in section 3, and the recipients in section 5. You or an authorized agent can make a request by emailing support@organicchat.io.

OrganicChat is not for anyone under 18, and we don’t knowingly collect personal information from children under 13. If you believe a child has given us information, contact us and we will delete it.

We may update this policy. We will change the date at the top, and if a change is significant we will tell you by email or in the app.

Privacy questions or requests: support@organicchat.io.