Privacy Policy

1. What we collect

When you connect your Instagram account to Allerac, we collect and store:

• Your Instagram user ID and username
• An encrypted access token to interact with the Instagram API on your behalf
• Instagram Direct Messages sent to your connected account (processed in real time to generate AI replies; not stored permanently)

We also collect basic account information (email, hashed password) when you create an Allerac account. If you ask our public chat team to contact you, we collect your name, email, optional company, reviewed need summary and, only if you opt in, the chat transcript you submit.

2. How we use your data

• Instagram DM automation: Messages are passed to an AI language model to generate replies. Messages are not logged or retained after processing.
• Authentication: Your Instagram access token is stored encrypted at rest and used solely to call the Instagram API on your behalf.
• Public chat and contact requests: Chat messages are processed to provide the conversation and generate a draft summary. Contact information and the reviewed summary are used only to respond to your request. The full transcript is emailed to our team only when you explicitly choose to include it.
• We do not sell, share, or use your data for advertising.

3. Legal basis for processing

• Contract (Art. 6(1)(b)): Processing your Instagram access token and account information is necessary to provide the Allerac service you have requested.
• Consent (Art. 6(1)(a)): When you connect your Instagram account, you explicitly authorise Allerac to access and interact with your account on your behalf.
• Legitimate interests (Art. 6(1)(f)): We may process data to maintain the security of our service and prevent fraud, where this does not override your fundamental rights and freedoms.

4. Third-party services

• Instagram / Meta: We access Instagram data via the Instagram Graph API under Meta's platform policies. Permissions used: instagram_basic (read profile information), instagram_manage_messages (receive and reply to Direct Messages via webhook), and instagram_content_publish (publish posts on your behalf).
• AI providers: Messages may be sent to GitHub Models (OpenAI) or processed locally via Ollama, depending on your configuration.
• Resend and Cloudflare: Resend delivers confirmed contact-request emails. Cloudflare hosts the site, applies rate limits and uses Turnstile to prevent abuse.
• International transfers: Some AI providers (such as GitHub Models / OpenAI) may process data on servers outside the European Economic Area (EEA). Where this occurs, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the appropriate safeguard.

5. Data retention

Instagram access tokens are retained until you disconnect your account or request deletion. Public chat conversations may be retained to operate the conversation and protect the service. Confirmed contact requests and any transcript you choose to include are retained only as long as needed to respond and manage the resulting business relationship. You may request deletion at any time.

6. Your rights

• Access & rectification: You have the right to access and correct any personal data we hold about you.
• Erasure: You can request deletion of your data at any time. See the Data Deletion section below.
• Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to processing based on legitimate interests.
• Complaints: You have the right to lodge a complaint with a supervisory authority. In Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es.
• You can disconnect your Instagram account at any time from the Allerac settings panel. For all other requests, contact privacy@allerac.ai.

privacy@allerac.ai
Subject: Data Deletion Request
Include your Allerac account email and/or Instagram username.