Privacy Policy

This Privacy Policy describes how our Instagram AI Agent service operating at solarischat.com ("Service", "we", "us", or "our") collects, uses, and protects your information when you use our application to manage Instagram direct messages through automated AI responses, product cards and orders in the chat, a static welcome message, and comment-triggered direct messages.

By using our Service, you agree to the collection and use of information in accordance with this policy. We are committed to protecting your privacy and complying with all applicable data protection laws, including Meta's Platform Terms and Developer Policies.

Information We Collect

1.1 Your Account

• Email address, name, and password (stored only as a hash), or the profile you share when signing in with Google or GitHub
• Business details you enter: company name, business type, description, location, contacts (website, phone, messengers), and services with prices
• Your phone number, if you provide it
• Your product catalogue: names, descriptions, prices, stock, categories, tags, and product photos
• Settings you configure: AI personality, welcome message, comment auto-replies (keywords, DM texts, public reply texts), ice breakers, and the chat menu

1.2 Instagram Account Information

When you connect your Instagram professional account through Instagram's official login, we receive:

• Your Instagram username and account ID, and an access token (stored encrypted)
• The permissions you grant: messages, comments, basic profile, content, and insights
• Your recent posts, reels, and active stories — captions, links, thumbnails, and publication dates — so that we can show which products appear in them

1.3 Messages from Your Customers

Through Instagram's official webhooks, we receive and temporarily store direct messages sent to your account:

• Message text, the sender's Instagram-scoped ID and username, and timestamps
• Photos and voice messages customers send, which we download only to describe or transcribe them for the AI
• Posts and stories customers share or reply to
• Button taps (ice breakers, menu items, product cards, quick replies)
• Messages you or your team send from Instagram or from SolarisChat, so the conversation history is complete

1.4 Leads and Orders

• Leads: when the AI hands a conversation to you, we save the customer's Instagram username and ID, the reason, and their last message
• Orders: when a customer places an order in the chat, we save the product, quantity, and price, and the name, phone number, and address the customer provides

1.5 Comment Data

If you enable comment auto-replies, we receive comments on your posts and reels — the comment text, the commenter's ID and username, and the post ID — to check them against your rules, send the configured DM, and, if you set one, a public reply. To send each person a rule's DM only once per post, we remember for up to 30 days that a DM was sent to that commenter on that post.

1.6 Billing Information

• Card payments are handled by Paddle.com Market Limited, our Merchant of Record. Paddle collects your card and billing details; we receive only Paddle's customer and subscription IDs, your plan, and payment status. We never see or store card numbers.
• Bank transfers (online banking, Kaspi, MBank): we keep a record of the payment — payer name, amount, date, and bank — to activate your plan and for accounting.

1.7 Usage and Technical Data

• Counters of messages, conversations, and products used against your plan limits
• Technical logs for troubleshooting and security (no access tokens, passwords, or payment data)
• Cookies needed for sign-in and preferences (see Section 8)

How We Use Your Information

We use the information above only to provide and protect the Service:

• AI replies: to understand customer messages — including describing photos and transcribing voice messages — and to answer them using your products and business details
• Interactive messages: to send product cards, quick replies, ice breakers, and the chat menu, and to show "seen" and typing indicators
• Orders and leads: to collect order details in the chat and to show you leads and orders so you can follow up
• Welcome message: to send your fixed greeting to new conversations, without any AI
• Comment automation: to send the DM and optional public reply you configured when a comment matches your rules
• Posts and products: to suggest which products appear in your posts and stories by matching captions to product names
• Billing: to manage your subscription, limits, and payments
• Support, security, and legal compliance: to help you, prevent abuse, and meet our legal obligations and Meta's Platform Terms

We do not sell your data or your customers' data, and we do not use it for advertising.

Data Security and Encryption

• Encryption in Transit: all traffic — between your browser, our servers, Instagram, Paddle, and our AI provider — uses HTTPS/TLS
• Passwords: stored only as PBKDF2-SHA256 hashes
• Webhook Verification: events from Instagram and Paddle are accepted only with a valid signature
• Access Controls: only authorized systems and staff can access production data, and only to operate and support the Service
• Infrastructure: the Service runs on reputable cloud providers; product and profile images are stored on Cloudinary

Data Retention and Automatic Deletion

• Photos and voice messages are downloaded only for processing and are not stored; their description or transcript is part of the message and is deleted with it
• Comment data is used for rule matching and not stored; the record that a commenter already received a DM is kept for up to 30 days
• Leads and orders are kept until you delete them or your account, because you need them to follow up with customers
• Conversation records (customer ID and username, AI on/off) are kept while your account is active
• Post and story information is refreshed from Instagram and kept while your account is active
• Your account, business details, catalogue, and settings are kept until you delete them or your account
• Billing records are kept as long as accounting and tax laws require

Data Sharing and Third Parties

We do not sell, trade, or rent personal information. We share data only with the service providers we need to run the Service, and only what they need:

5.1 Service Providers

• OpenRouter (openrouter.ai/privacy), which routes requests to AI model providers such as OpenAI and Google: when AI replies are on, we send it the customer's message, recent conversation history, relevant product and business details, and any photo or voice message, to generate the reply. When only the welcome message is used, no message content is sent to an AI provider.
• Paddle (paddle.com/legal/privacy): card payments, invoices, and taxes, as our Merchant of Record
• Banks (online banking, Kaspi, MBank): when you choose to pay by bank transfer, the payment is processed by your bank and ours
• Cloudinary: storage of product and profile images
• Cloud hosting providers: our servers, database, and queues
• Email provider: sending account and billing emails
• Google and GitHub: only if you choose to sign in with them
• Cloudflare Turnstile: bot protection on sign-up

These providers may use the data only to provide their service to us.

5.2 Meta/Instagram

We use Instagram's official APIs, in line with Meta's Platform Terms and Developer Policies. Messages, comments, replies, ice breakers, and the chat menu are sent and received through Instagram's systems as you authorize.

5.3 Your Customers' Data

For messages, leads, and orders from your customers, you decide how the Service is used, and we process this data on your behalf. You are responsible for informing your customers, where the law requires it, that you use automated replies.

5.4 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of our Service, users, or others.

Your Rights and Choices

You have the following rights regarding your data:

6.1 Access and Portability

You have the right to request access to the personal information we hold about you and to receive a copy of your data in a portable format.

6.2 Data Deletion

You can request immediate deletion of your data at any time by any of the following methods:

• Contacting us through our support channels
• Sending a written request to our designated contact email
• Revoking access to our application directly through your Instagram account settings — this will automatically trigger deletion of all your associated data from our systems

Upon receiving your deletion request, we will permanently delete all your personal data within 30 days, except where we are legally required to retain certain information.

6.3 Account Termination

You can terminate your account and disconnect our Service from your Instagram account at any time. This will:

• Immediately revoke all access permissions to your Instagram account
• Stop all AI agent, static reply, and Comment DM activities
• Initiate the deletion process for all stored data, including your configured reply texts and signal words (completed within 30 days)
• Remove the connection between your Instagram account and our Service

6.4 Modify or Correct Information

You can update your account information, AI agent settings, static reply text, signal words, and Comment DM text at any time through your account dashboard.

6.5 Opt-Out

You can disable the AI agent, static reply mode, or Comment DM functionality independently at any time while maintaining your account, preventing further processing of new messages or comments under the respective feature.

Meta Platform Compliance

Our Service is built in full compliance with Meta's Platform Terms, Developer Policies, and Instagram API requirements:

• Authorized Access: We access Instagram data only through official APIs and with your explicit permission
• Data Usage Restrictions: We use Instagram message and comment data solely for providing our automated response service as described in this policy
• Webhook Security: All webhook data from Instagram is securely received, processed, and stored according to Meta's security requirements
• Comment DM Compliance: Comment-triggered DMs are sent only in response to organic public comments that match rules you configure, at most once per person per post, and only through Instagram's official Messaging API, in compliance with Meta's policies on automated messaging
• User Control: You maintain full control over the connection and can revoke access at any time through Instagram's settings
• Policy Updates: We stay current with Meta's policy changes and update our practices accordingly

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and improve our Service. These include:

• Essential Cookies: Required for authentication and basic Service functionality
• Performance Cookies: Help us understand how users interact with our Service
• Preference Cookies: Remember your settings and customization choices

You can control cookies through your browser settings, though disabling certain cookies may limit Service functionality.

Children's Privacy

Our Service is intended for Instagram business account owners who are at least 18 years old. We do not knowingly collect or solicit personal information from individuals under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately, and we will take steps to delete such information.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from those in your jurisdiction. We ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable law, including:

• Standard contractual clauses approved by relevant authorities, where required
• Choosing service providers that meet equivalent data protection standards

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify you of any material changes by one of:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice within the Service

Your continued use of the Service after such modifications constitutes your acknowledgment and acceptance of the updated Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all legitimate requests within 30 days or as required by applicable law.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), our legal basis for collecting and using your personal information depends on the data concerned and the context in which we collect it:

• Contract Performance: Processing is necessary to provide the AI agent service, static reply service, and Comment DM service you requested
• Legitimate Interests: We have a legitimate interest in improving our Service, preventing fraud, and ensuring security
• Consent: You have given explicit consent for specific processing activities (such as connecting your Instagram account and enabling individual features)
• Legal Obligation: Processing is necessary to comply with legal requirements

You have the right to withdraw consent at any time where we rely on consent as the legal basis for processing.

California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our business purpose for collecting it, and the categories of third parties we share it with.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out: We do not sell personal information. You therefore have no need to opt out of a sale, but you may contact us to confirm this at any time.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your rights, contact us at info@solarischat.com. We will respond within 45 days as required by law. You may designate an authorized agent to make a request on your behalf by providing written authorization.

Acceptance of This Policy

By using our Service, connecting your Instagram business account, or accessing our platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this policy, please do not use our Service.

This privacy policy is effective as of the date stated above and applies to all users of our Instagram AI Agent service. © 2026 SolarisChat. All rights reserved.