At a glance
- ReplyWave connects to one Instagram professional account per customer to detect comment keywords and send automated private replies.
- We store the connected account's profile info, an encrypted access token, and records of comments that triggered a reply — never your Instagram password.
- We do not sell personal data, and we do not read or store direct messages beyond the automated reply itself.
- You can disconnect your account and request deletion of your data at any time (see Your rights).
01 What ReplyWave is
ReplyWave is a service that helps Instagram creators and small businesses automate replies to comments on their own posts. When someone comments a keyword you've configured (for example, "price"), ReplyWave sends that commenter a private reply on your behalf, via Instagram's own messaging system.
This policy describes what information ReplyWave collects when you connect your Instagram professional account, and when someone comments on your posts, and how that information is used, stored, and protected.
02 Data we collect
| Data | Source | Why we collect it |
|---|---|---|
| Instagram user ID and username | Instagram Login, when you connect your account | Identify your account and display it in your dashboard |
| Encrypted access token | Instagram Login | Authenticate API calls made on your behalf, such as sending a private reply |
| Automation settings (post ID, keyword, reply message) | Entered by you | Determine when and what to send |
| Comment ID, comment text, and commenter's Instagram-scoped ID | Instagram webhook, when someone comments on your post | Match the comment against your keyword and send the reply exactly once |
| Delivery status of each automated reply | Instagram Graph API response | Show you accurate stats (triggered, sent, failed) |
We never receive or store your Instagram password. Login happens entirely through Instagram's own authorization screen.
03 How we use it
- To detect when a comment on your post matches an automation you configured.
- To send the private reply you wrote, through Instagram's official messaging API.
- To enforce Instagram's own platform rules on our side — for example, sending at most one automated reply per user in a rolling 24-hour period, and never replying to a comment older than 7 days.
- To show you dashboard statistics about your automations.
We do not use your data for advertising, and we do not sell or rent personal data to third parties.
04 Meta & Instagram platform
ReplyWave operates entirely through Meta's official Instagram Platform APIs. Connecting your account, reading comments, and sending replies are all actions performed via Instagram's Graph API, under the permissions you explicitly grant during login (instagram_business_basic, instagram_business_manage_comments, instagram_business_manage_messages). Meta's own Privacy Policy governs how Meta itself handles data on its platform.
05 Storage & security
Access tokens are encrypted at rest (AES-256-GCM) before being stored in our database, and are only decrypted in memory at the moment an API call is made. Our infrastructure runs over encrypted connections (HTTPS/TLS), and access to production data is limited to the people operating the service.
06 Retention & deletion
We retain your connected account's data for as long as your account stays connected, plus a limited period afterward for support and abuse-prevention purposes. Comment and reply records are kept to power your dashboard statistics.
If you disconnect your Instagram account or request deletion (see Contact), we delete your stored access token immediately and delete the remaining account data within 30 days.
07 Your rights & choices
- Disconnect anytime — revoke ReplyWave's access from Instagram's own Settings → Apps and websites, or from your ReplyWave dashboard.
- Request a copy of the data we hold about your account.
- Request deletion of your account and associated data.
To exercise any of these, contact us using the details below.
08 Children's privacy
ReplyWave is intended for business and creator accounts and is not directed at children. We do not knowingly collect data from anyone under the minimum age required to hold an Instagram professional account.
09 Changes to this policy
If we make material changes to this policy, we'll update the effective date above and, where appropriate, notify connected accounts directly.
10 Contact
Questions about this policy or your data can be sent to aristorajr@gmail.com.