Woltx Automation: Privacy Policy

What we collect

• Account data: your email address, workspace name, team members and their roles, and sign-in security settings.
• Instagram account data: the connected account's id and username, and an access token, stored encrypted (AES-256-GCM).
• Commenter data, on your behalf: Instagram username and id, the comment text and time, and whether the reply and DM were sent.
• Billing data: plan, status and invoices from Stripe. Card details stay with Stripe.
• Operational data: logs and error reports, kept for up to 30 days.

Why we use it

To run the service you asked for (contract), keep it secure and working (legitimate interests), bill you (contract), and meet legal duties. We don't sell personal data or use it for advertising.

Who processes it

• Supabase (database and sign-in), data stored in Tokyo, Japan
• Vercel (hosting and serverless functions), Tokyo region
• Meta Platforms (Instagram API: comments, replies and messages)
• Stripe (payments and invoices; we never see full card numbers)
• Resend (account and alert emails)

International transfers

Data is stored in Japan and may be accessed from the UAE. Where the law requires, transfers rely on the providers' standard contractual clauses.

How long we keep it

Workspace data is kept while your workspace exists. You can set entries to be deleted after a number of days. Deleting a workspace deletes its data. Backups roll off within 30 days.

Your rights

You can access, correct, export or delete your data, object to some uses, and complain to your data protection authority. Commenters can ask for deletion through our data deletion page or by removing the app in Instagram, which triggers Meta's deletion callback.

Security

Encryption in transit and at rest, encrypted Instagram tokens, role-based access, optional two-factor sign-in, and an activity log.

Contact

Privacy questions: saeed@woltx.ae.