Privacy Policy
OyeReply (the "Service") is provided by Hotreloads Digital Private Limited ("we", "us", "our"), a company incorporated in India. This Privacy Policy explains what information we collect, how we use it, and your rights.
1. Information we collect
- Account information. When you sign up, we collect your email address, name, password (stored as an Argon2id hash), and the name of your workspace.
-
Instagram and Meta data. When you connect a Facebook
Page and Instagram Business Account, we receive (via the Meta Graph
API and Webhooks): the IG account ID and username, basic profile
fields, the IDs and content of direct messages and comments sent to
and from your account, and the IDs of users who message or comment on
your account. We request these permissions:
instagram_basic,instagram_manage_messages,pages_messaging,pages_show_list,business_management, and (for comment-to-DM features)instagram_manage_comments. - Usage data. We log API requests, errors, performance metrics, and product analytics events to operate and improve the service. We use Sentry, Grafana Cloud, and similar tools.
- Billing data. If you subscribe to a paid plan, Stripe processes your payment. Stripe is the data controller for your card details; we only receive a subscription identifier and last-4 digits.
2. How we use information
- To provide and operate the OyeReply service, including sending, receiving, and routing Instagram messages and comments on your behalf via Meta's APIs.
- To authenticate users and protect accounts.
- To provide customer support and respond to inquiries.
- To detect, prevent, and respond to fraud and abuse.
- To comply with legal obligations.
3. Sharing
We share data only with subprocessors that help us operate the service:
- Meta Platforms (Instagram, Facebook) — to send and receive your messages and comments.
- Amazon Web Services — hosting and storage.
- Neon — managed Postgres database.
- Upstash — Redis cache and queueing.
- Resend — transactional email.
- Stripe — payment processing (paid plans only).
- Sentry, Grafana Cloud — error and performance monitoring.
We do not sell personal information. We do not use your message content to train any AI model.
4. Data retention
We retain account and message data for as long as your account is active. If you delete your account, or disconnect your Instagram account, we delete the associated Instagram message data within 30 days, except where retention is required by law.
5. Your rights
Depending on your location, you may have rights to access, correct, delete, or export your personal data, or to object to or restrict certain processing. To exercise these rights, email hello@hotreloads.com.
6. Security
We use TLS in transit, encryption at rest, application-level tenant isolation, and least-privilege access for staff. No system is perfectly secure; if we discover a breach affecting you, we will notify you without undue delay.
7. International transfers
We are based in India and process data primarily in the United States (where our infrastructure providers operate). If you access OyeReply from outside these jurisdictions, your information will be transferred to, stored, and processed there.
8. Children
OyeReply is not directed to children under 13 (or 16 in some jurisdictions). We do not knowingly collect personal information from children.
9. Changes
We may update this policy from time to time. Material changes will be notified by email or a prominent notice in the product.
10. Contact
Questions? Email hello@hotreloads.com.