Privacy Policy
Last updated: March 28, 2026
Scope of this policy: This Privacy Policy applies exclusively to Allerac Cloud services. If you are using Allerac One (self-hosted), this policy does not apply to you — your data never leaves your own machine. Allerac collects no telemetry, sends no data, and has no visibility into self-hosted installations.
Allerac ("we", "us", "our") is a private-first AI assistant platform. This policy explains what data we collect, how we use it, and how you can request its deletion.
1. What we collect
When you connect your Instagram account to Allerac, we collect and store:
- Your Instagram user ID and username
- An encrypted access token to interact with the Instagram API on your behalf
- Instagram Direct Messages sent to your connected account (processed in real time to generate AI replies; not stored permanently)
We also collect basic account information (email, hashed password) when you create an Allerac account.
2. How we use your data
- Instagram DM automation: Messages are passed to an AI language model to generate replies. Messages are not logged or retained after processing.
- Authentication: Your Instagram access token is stored encrypted at rest and used solely to call the Instagram API on your behalf.
- We do not sell, share, or use your data for advertising.
3. Legal basis for processing
- Contract (Art. 6(1)(b)): Processing your Instagram access token and account information is necessary to provide the Allerac service you have requested.
- Consent (Art. 6(1)(a)): When you connect your Instagram account, you explicitly authorise Allerac to access and interact with your account on your behalf.
- Legitimate interests (Art. 6(1)(f)): We may process data to maintain the security of our service and prevent fraud, where this does not override your fundamental rights and freedoms.
4. Third-party services
- Instagram / Meta: We access Instagram data via the Instagram Graph API under Meta's platform policies. Permissions used: instagram_basic (read profile information), instagram_manage_messages (receive and reply to Direct Messages via webhook), and instagram_content_publish (publish posts on your behalf).
- AI providers: Messages may be sent to GitHub Models (OpenAI) or processed locally via Ollama, depending on your configuration.
- International transfers: Some AI providers (such as GitHub Models / OpenAI) may process data on servers outside the European Economic Area (EEA). Where this occurs, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the appropriate safeguard.
5. Data retention
Instagram access tokens are retained until you disconnect your account or request deletion. Conversation messages are not stored — they are processed in memory and discarded.
6. Your rights
- Access & rectification: You have the right to access and correct any personal data we hold about you.
- Erasure: You can request deletion of your data at any time. See the Data Deletion section below.
- Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
- Right to object: You have the right to object to processing based on legitimate interests.
- Complaints: You have the right to lodge a complaint with a supervisory authority. In Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es.
- You can disconnect your Instagram account at any time from the Allerac settings panel. For all other requests, contact privacy@allerac.ai.
Data Deletion
To request complete deletion of your Allerac account and all associated data (including your Instagram credentials), send an email to:
privacy@allerac.ai
Subject: Data Deletion Request
Include your Allerac account email and/or Instagram username.
We will process your request within 30 days and confirm deletion by email.
7. Contact
For any privacy-related questions: privacy@allerac.ai