Privacy Policy

Data We Collect

We collect account email addresses for authentication, workspace metadata, connected Instagram account identifiers and usernames, encrypted Instagram access tokens, campaign settings, webhook payloads, the comments needed to run a campaign, the messages we send and their delivery status, link click events, and operational diagnostics.

How We Use Data

We use this data to authenticate users, connect Instagram accounts, match comment keywords, send public replies and private replies through the official Meta APIs, check an optional follow requirement before delivering a link, prevent duplicate and unwanted sends, troubleshoot failures, and protect the service.

Instagram And Meta Data

Viralmaxxing does not ask for Instagram passwords, scrape Instagram, or use browser automation. Instagram access tokens are encrypted at rest with AES-256-GCM and are used only to perform actions authorized by the connected professional account.

We act only on the account a user explicitly connects. We read that account's own profile and its own posts and reels, receive comments on its own media, and send messages only to people who contacted that account first by commenting on its content or messaging it. We do not read or act on any other account's content.

Insights Data

For accounts that grant it, we read Instagram insights for the connected account's own media — reach, views, saves, shares and total interactions — together with the account's follower count and daily follower change. This powers the Overview screen, which shows the account owner how their own posts performed so they can decide which post to attach an automation to.

Because Instagram retains only about thirty days of account insights, we store one follower total per connected account per day so the owner can see a longer trend. Insights data is shown only to the workspace that connected the account. It is never shown to other users, never used for advertising, never combined across unrelated accounts, and never sold.

Data We Never Sell

We do not sell personal data, and we do not share it with third parties for their own advertising or marketing. Data is shared only with the service providers listed below, only as needed to operate the service.

Subprocessors

The service uses hosting, database, queue, authentication and observability providers, currently Vercel, Neon (PostgreSQL), Railway (Redis and background workers), and Google for sign-in. These providers process data only as needed to run the service.

Retention And Deletion

Account owners can disconnect Instagram from Settings at any time, which deletes the stored access token and stops all campaigns for that account. For deletion of workspace, campaign and log data, follow the Data Deletion page linked from the footer. We retain data only as long as needed to run the service or as required for legal, fraud prevention or security reasons.

Contact

For privacy questions or data deletion requests, contact [email protected].