Privacy Policy

Effective: 15 May 2026

Reachlee provides Instagram DM automation built on Meta's official Instagram Graph API. This Privacy Policy explains what we collect when you use Reachlee, how we use it, who we share it with, and the controls you have over your data.

1. Information We Collect

We collect only the information needed to operate the service:

• Account information — name and email address you provide when you sign up (via Google OAuth).
• Instagram account information — handle, profile details, and the access token Meta issues when you connect your Instagram Business or Creator account. The access token is stored encrypted and is never logged in plaintext.
• Contacts and messages— Instagram users who interact with your account through automations you set up, along with the messages exchanged. We receive these via Meta's Instagram webhooks.
• Automation configuration and run logs — the triggers, keywords, and DM templates you create, plus a record of when each automation fired.
• Usage and device data — IP address, browser type, and pages visited. Collected via Google Analytics (anonymized) and our server logs.
• Billing information — handled by our payment processor, Dodo Payments. We do not store your full card details.

2. How We Use Your Information

• To run the automations you have configured.
• To bill your subscription via Dodo Payments (Pro plans only).
• To detect and prevent abuse and keep the platform compliant with Meta's terms.
• To respond to your support requests.
• To send product updates and important account notices to your email.

We do not sell or rent your data. We do notuse your data or your contacts' messages to train AI models.

3. Who We Share Data With

We share data only with the processors necessary to run Reachlee:

• Meta (Instagram)— every API call to read comments, send DMs, and receive webhooks is made directly to Meta's Instagram Graph API on your behalf.
• Dodo Payments — for subscription processing on Pro plans.
• Amazon Web Services (AWS) — our hosting infrastructure (compute, database, file storage).
• Google Analytics — for aggregate, anonymized traffic analytics on the marketing site.

We may disclose information when required by law, valid legal process, or to protect the rights and safety of users.

4. Data Retention

• Account information: kept while your account is active.
• Instagram access tokens: kept until you disconnect the Instagram account, delete your Reachlee account, or revoke our app from your Instagram settings.
• Contacts, messages, and automation run logs: kept while your account is active. Deleted within 30 days of account closure.
• Server access logs: retained for 90 days.

5. Your Rights

• Access and export — request a copy of your data by emailing us.
• Correction — update profile details from Settings, or email us.
• Deletion — see our Data Deletion page for full instructions.

6. Security

• All traffic is served over HTTPS/TLS.
• Instagram access tokens are encrypted at rest. They are never written to logs.
• Webhook payloads are HMAC-verified against Meta's app secret before any processing.
• Database and file storage live in Amazon Web Services data centers.

No system is perfectly secure. We follow industry best practices but cannot guarantee absolute security.

7. International Transfers

Your data is processed and stored on AWS infrastructure, which may operate data centers outside your country of residence. By using Reachlee you consent to this transfer.

8. Children's Privacy

Reachlee is not directed to anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has signed up, please contact us so we can remove their account.

9. Cookies

The Reachlee app uses HttpOnly authentication cookies to keep you signed in. The marketing site uses Google Analytics cookies for aggregate traffic statistics. We do not use third-party advertising cookies.

10. Links to Other Websites

Reachlee may link to third-party websites (for example, Instagram). We are not responsible for the privacy practices of those sites.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app at least 14 days before they take effect.

12. Contact

For privacy questions or to exercise any of the rights above, email tusharkapil@reachlee.co.