Privacy Policy

• Account information. When you sign in with Google, we receive your name, email address and profile photo.
• Instagram connection. When you connect an Instagram account, we receive your Instagram user ID, username, linked Facebook Page ID and an access token. Tokens are encrypted at rest (AES-256-GCM) and never shown in the app.
• Comments processed. To run your automations we process comment text, commenter usernames and IDs, timestamps and the media the comment was left on. We only process comments on accounts you connected.
• Billing information. Subscriptions are processed by Razorpay. We store your plan, subscription status and Razorpay subscription ID. We never see or store your card or bank details.
• Usage data. Basic operational logs (such as automation runs and error traces) used to keep the service reliable.

We use this data solely to provide the service you asked for: connecting your Instagram accounts, watching for the comment keywords you configure, sending the direct messages you wrote, enforcing your plan limits, billing your subscription, preventing abuse, and supporting you when you contact us.

We do not sell your data. We share it only with the processors needed to run the service:

• Meta (Instagram Graph API) — to read comments and send direct messages on your behalf.
• Razorpay — to process subscription payments.
• Our hosting and database providers — to run the application.

We disclose data to authorities only when required by law.

• Instagram access tokens are deleted when you disconnect the account.
• Automation run logs are kept for 12 months, then deleted.
• Billing records are kept as long as tax and company law require, then deleted.
• Deleting your workspace deletes your automations, connections and logs with it.

You can access, correct or delete your personal data at any time: disconnect accounts and delete workspaces from the dashboard, or write to us at support@webital.cloud. We respond to requests within 30 days. If you remove the app through your Facebook settings, Meta notifies us and we delete your data automatically — see our data deletion page.

Access tokens are encrypted at rest, all traffic uses HTTPS, and internal tooling requires authentication. No system is perfectly secure, but we apply industry-standard measures to protect your data.

CommentDM is for users aged 18 and over. We do not knowingly collect data from children.

If this policy changes materially, we will notify you by email. Questions? Contact us at support@webital.cloud.

This policy is governed by the laws of India. Disputes are subject to the courts of Kolkata, West Bengal.