Privacy Policy

Igglitch is responsible for the personal data described in this Policy. For customer-managed Instagram data, we process data on the creator or business customer's instructions while remaining responsible for our own account, security, billing, and compliance records.

Privacy requests: privacy@igglitch.com. For customer-managed Instagram data, Igglitch generally processes data on the creator or business customer's instructions; Igglitch is an independent controller for its account, security, billing, and legal compliance records.

We collect account details (name, email, profile image, authentication provider identifiers and tokens), session/security data (IP address, user agent, session identifiers and security events), and acceptance and cookie-consent records.

When you connect Instagram, we collect the permissions you grant, long-lived access tokens, professional-account identifiers, username, profile image, account type, follower/media counts, media metadata, captions, comments, mentions, analytics, scheduled posts, automation settings, approval history, and webhook events.

DM-related data can include participant identifiers/usernames, message text, timestamps, direction, conversation state, and proposed or sent automated replies. We also collect uploaded and generated media, AI prompts/results/reference images, voice-profile samples, support requests, Link-in-Bio page/link events, usage data, and, when enabled, subscription status. We do not receive payment-card details.

We use data to authenticate users; connect and operate Instagram features; schedule and publish content; generate or route drafts; run requested automations; show analytics; detect fraud, abuse, and security incidents; provide support; enforce our agreements; and meet legal obligations. We do not sell personal information or use it for cross-context behavioral advertising.

AI processing is feature-specific. If you enable a writing, voice, image, or video feature, relevant prompts, selected Instagram content, and reference media may be sent to the provider needed to perform that request. Igglitch does not train a shared model on customer content or DM data. We require a separate, explicit opt-in before any different training or product-improvement use.

We share data only with service providers acting for the stated purposes: Meta/Instagram for account connectivity and publishing; Google and Meta/Facebook for authentication; MongoDB Atlas for our database; Redis/BullMQ for queues; Resend for email; Dodo Payments for subscriptions; OpenRouter and the selected underlying model provider for text AI; fal.ai for image/video generation; Cloudflare R2 for uploaded and generated media storage; hosting providers; and PostHog only after analytics consent. Providers may process data outside your country. We use the transfer safeguards required for the relevant processing.

Third-party services are governed by their own terms and policies, including Meta Terms, Meta Privacy Policy, Google Privacy Policy, and the Google API Services User Data Policy.

Google sign-in is used only for authentication and does not request Gmail, Drive, or other Google-content permissions. Our use and transfer of Google API information is limited to the practices in this Policy and follows the Google API Services User Data Policy, including its Limited Use requirements.

We use official Meta APIs and only the permissions needed for enabled Instagram features. Disconnecting an Instagram account stops future access and disables related automations; it does not by itself delete retained data. Meta deauthorization and data-deletion callbacks are handled through the published deletion process.

We retain account and connected-feature data until you delete it or close your account, unless a longer period is necessary for security, legal obligations, disputes, or records we are permitted to retain. We remove queued actions and attributable stored files when Instagram data is deleted. Provider copies are subject to their applicable deletion processes and contractual terms.

You may request access, correction, export, deletion, restriction, or objection by emailing privacy@igglitch.com. You may also delete your Igglitch account from the product controls. We will verify requests and respond within the period required by applicable law. You may have the right to complain to your local data-protection authority.

The in-product export is limited to your AI Studio history, scheduling history, automation history, and analytics snapshots in a simple CSV. It does not include direct messages, training samples, system prompts, credentials, webhook payloads, internal security records, or other confidential service data. We retain and protect those records only as needed to operate, secure, support, and meet legal obligations.

After account deletion, we retain a restricted administrative audit for up to 30 days: the account email, connected Instagram usernames, aggregate product-use counts, and non-content media-generation metadata. This audit is access-restricted, automatically purged after 30 days, and never includes media files or URLs, captions, prompts, direct messages, credentials, or system prompts.

We use reasonable technical, organizational, and administrative safeguards. No online service can guarantee absolute security.

Essential storage supports sign-in, security, and preferences. We ask for consent before enabling non-essential product analytics. Marketing email is sent only where permitted and can be unsubscribed from at any time. Igglitch is not for people under 18.

We will post the effective date of changes. Where required, we will provide notice and obtain renewed consent before using data for a new purpose.