Legal
Privacy Policy
This policy explains what personal data AutoEngage collects, why we collect it, and how we protect it. We are committed to transparency and to complying with Indian data protection law.
01. Overview
AutoEngage ("we", "us", "our") is an Instagram automation platform operated by Thanush Gowda P, an individual proprietor based in India. Our registered contact address for data-related matters is support.autoengage@gmail.com.
By creating an account or using any feature of AutoEngage, you agree to the collection and use of your information as described in this Privacy Policy. This policy is governed by the Information Technology Act, 2000 (IT Act) and the Digital Personal Data Protection Act, 2023 (DPDP Act).
02. Data We Collect
We collect only the data necessary to provide our automation services:
Meta Platform Permission Scopes & Justification
To operate Instagram automations via official Meta Graph APIs, AutoEngage requests the following granular permissions during the Facebook OAuth connection flow. Here is why they are required and how they are used:
| Permission Scope | Data Accessed | Justification / How We Use It |
|---|---|---|
| instagram_basic | Instagram username, profile info, media list, and permalinks. | To identify connected professional profiles and let you select specific posts to attach keyword triggers. |
| instagram_manage_messages | Direct message text, postback payloads, and sender scoped IDs. | To receive webhook events for new DMs, parse triggers/payloads (including Follow-Gate checks), and deliver automatic responses in the DM window. |
| instagram_manage_comments | Public comment content, commenter scoped IDs, and comment permalinks. | To receive real-time webhook updates when a user comments on your media, detect matching keywords, and reply to comments. |
| pages_show_list | List of Facebook Pages managed by the logged-in user. | To let you choose which Facebook Page is linked to your target Instagram Professional Account during the onboarding wizard. |
| pages_read_engagement | Page parameters, access tokens, and connection statuses. | To verify the linked page configuration and metadata before establishing real-time data sync. |
| pages_manage_metadata | None (subscription action only). | To register AutoEngage webhook listeners on your Facebook page so comments and DMs can be routed to your workspace instantly. |
Instagram username, profile info, media list, and permalinks.
To identify connected professional profiles and let you select specific posts to attach keyword triggers.
Direct message text, postback payloads, and sender scoped IDs.
To receive webhook events for new DMs, parse triggers/payloads (including Follow-Gate checks), and deliver automatic responses in the DM window.
Public comment content, commenter scoped IDs, and comment permalinks.
To receive real-time webhook updates when a user comments on your media, detect matching keywords, and reply to comments.
List of Facebook Pages managed by the logged-in user.
To let you choose which Facebook Page is linked to your target Instagram Professional Account during the onboarding wizard.
Page parameters, access tokens, and connection statuses.
To verify the linked page configuration and metadata before establishing real-time data sync.
None (subscription action only).
To register AutoEngage webhook listeners on your Facebook page so comments and DMs can be routed to your workspace instantly.
03. How We Use Your Data
- ✓Provide, operate, and maintain the AutoEngage platform and all automation features.
- ✓Authenticate your account and connect to your Instagram profile via the Meta Graph API.
- ✓Execute the DM reply, comment-reply, keyword-trigger, and broadcast automations you configure.
- ✓Process subscription payments and send billing receipts through Razorpay.
- ✓Send transactional emails — account activation, password reset, subscription confirmation, and service notices.
- ✓Detect abuse, investigate security incidents, and enforce our Terms of Service.
- ✓Improve our product through aggregated, anonymised usage analytics.
- ✓Comply with applicable Indian law and lawful government requests.
Follow-Gate Feature
When the Follow-Gate feature is enabled on an automation, our system makes a real-time API call to the Instagram Graph API to check whether a commenter is following the connected account. This relationship check is performed in real-time and the result (following / not following) is not stored in our databases. No follower relationship data is persisted.
Refer & Earn Wallet Feature
When you participate in our Refer & Earn program, we track ledger transactions (commissions, withdrawals, peer transfers, and purchases) linked to your profile ID to calculate and maintain your active wallet balance. To prevent system abuse (such as self-referrals or creating multiple accounts using the same credit card/UPI ID), we hash and securely check your payment metadata fingerprint.
We do not sell, rent, or trade your personal data to any third party for marketing purposes.
04. Data Storage & Security
Your data is stored in Supabase (PostgreSQL), with infrastructure hosted in the European Union (eu-west region) and, in some configurations, the United States. Supabase is SOC 2 Type II certified.
Instagram OAuth access tokens are stored encrypted at rest using AES-256 encryption. All data in transit between your browser, our servers, and third-party APIs is protected by TLS 1.2 or higher.
Our web application is hosted on Vercel, which employs industry-standard infrastructure security controls. Vercel does not process or store your personal data beyond request routing.
We retain your account data for as long as your account is active. If you delete your account, we purge your personal data within 30 days except where retention is required by law (e.g., payment records under the IT Act may be kept for up to 5 years).
05. Third-Party Services
We work with the following sub-processors and third-party services. Each is bound by its own data protection commitments:
Meta / Instagram
Instagram API access — DMs, comments, and account data. Governed by Meta's Data Policy.
Razorpay
Payment processing for Indian subscriptions. Razorpay is PCI DSS compliant and an RBI-authorised payment aggregator.
Supabase
Database and authentication infrastructure. SOC 2 Type II certified.
Vercel
Web application hosting and edge functions. GDPR compliant.
We do not share your data with any other third parties except when required by a court order or statutory authority under Indian law.
06. Your Rights
Under the DPDP Act 2023 and the IT Act 2000, you have the following rights as a data principal:
To exercise any of these rights, email us at support.autoengage@gmail.com with the subject line "Data Rights Request". We will verify your identity before processing the request.
08. Children's Privacy
AutoEngage is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact support.autoengage@gmail.com and we will delete that data promptly.
09. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or business practices. When we make material changes, we will notify you by email (to the address on your account) at least 14 days before the change takes effect, and update the "Last updated" date at the top of this page.
Your continued use of AutoEngage after any change constitutes acceptance of the updated policy.
10. Contact Us
For privacy questions, data rights requests, or grievances, please reach out:
AutoEngage Data Controller
Name: Thanush Gowda P
Email: support.autoengage@gmail.com
Country: India
We aim to respond to all data-related enquiries within 7 business days.