Convoly connects to your Instagram professional account and automates replies to the people who message you. That means we handle two very different kinds of data — yours, and that of the people who contact you — and we treat them differently. This page explains both.
1. Who we are
Convoly, an M361 product, is provided by Indrajeet’s iQuanta Edu Services Private Limited, a company registered in India (“we”, “us”), and offers Instagram direct-message automation at www.convoly.in. We are the party responsible for the data described on this page. We are not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc.
Questions about this policy or your data: privacy@convoly.in.
2. Two roles, and why the difference matters
For the account you create with us — your email address and name — we are the controller: we decide what to collect and why.
For the data about people who message your Instagram account, we are a processor acting on your instructions. You are the controller of those conversations. You decide which automations run, what they say, and what is stored against a contact. If someone asks you to delete their data, you can do that yourself in the dashboard, and we will assist on request.
3. What we collect
Your Convoly account
- Email address, and display name if you provide one.
- Authentication records held by our identity provider — password hashes are stored by Supabase Auth and are never visible to us.
Your connected Instagram account
- Your Instagram professional account ID, username, display name, profile picture, account type and follower count, as returned by the Instagram API.
- The list of your own posts and reels, read when you choose which post an automation or comment view applies to.
- A long-lived access token issued by Meta, together with the permissions you granted and the token’s expiry. The token is encrypted before it is written to our database.
People who contact you
When someone messages your account, replies to your story, or comments on your posts, Meta sends us that event. We store:
- Their Instagram-scoped ID (an identifier unique to your account — it is not their real Instagram username or a global identifier), and their display name and profile picture where Meta provides them.
- The content and timestamps of messages exchanged with your account, in both directions.
- The time of their most recent inbound message. This one field governs whether you are permitted to reply at all, so it is central to the service.
- Tags and custom fields your automations set — for example an email address a flow asked for.
- A delivery log for every outbound message: what was sent, whether it succeeded, and why it was refused if it was.
Technical data
- Standard server and platform logs generated by our hosting providers, including IP address and request metadata.
- Raw webhook payloads from Meta, retained briefly so that duplicate deliveries do not send someone the same message twice.
Cookies and site analytics
- Cookies we set ourselves are functional: they keep you signed in, remember which Instagram account you have selected, and protect the Instagram connection step against forgery.
- Our website and dashboard load Google Tag Manager, which we use for site analytics. Google may set its own cookies and receive your IP address, browser details and the pages you visit, under Google’s privacy policy.
We do not use cookies for advertising, and we do not send your conversations, contacts or Instagram data to Google or any analytics provider.
4. Why we collect it
| Purpose | Data used |
|---|---|
| Signing you in and securing your account | Email, authentication records |
| Sending and receiving messages on your behalf | Instagram token, contact identifiers, message content |
| Deciding whether a message may lawfully be sent | Time of last inbound message, opt-out status |
| Showing you your inbox, contacts and automation history | Messages, contacts, delivery logs |
| Preventing duplicate sends | Webhook event identifiers |
| Diagnosing faults and keeping the service running | Server logs, delivery logs |
Where the GDPR or similar law applies, we rely on performance of our contract with you for operating the service, and on legitimate interests for security, fault diagnosis and abuse prevention. For end-user data we act on your instructions as processor.
We do not sell personal data, and we do not use the contents of your conversations to train machine-learning models.
5. Who else touches the data
We use a small number of providers, each with a specific job. They process data only on our instructions, and only as far as that job needs:
| Provider | What it handles | Where |
|---|---|---|
| Meta Platforms | The Instagram messaging API itself | Per Meta’s policies |
| Supabase | Primary database and authentication | Seoul, South Korea |
| Vercel | Hosting for the web application | Seoul, South Korea |
| Railway | Background worker and job queue, which carry messages waiting to be sent | Amsterdam, Netherlands |
| Cloudflare R2 | Files you upload for automations and Link in bio, and copies of Instagram profile pictures | Asia-Pacific; delivered through Cloudflare’s global network |
| Google (Tag Manager) | Website analytics only: no Instagram data | Per Google’s policies |
Supabase, Vercel, Railway and Cloudflare are companies based in the United States and may access the data they host from there, for example to operate and support their services. We may also disclose data where we are legally required to, or to establish or defend legal claims.
6. Where it is stored, and transfers
Our database and application are hosted in South Korea, our background worker in the Netherlands, and stored files in the Asia-Pacific region. If you or your contacts are elsewhere, your data is transferred to and processed in those places, and may also be accessed from the United States, where our providers are based. Where the law requires a transfer safeguard, we rely on our providers’ standard contractual clauses.
7. How long we keep it
- Raw webhook payloads — pruned on a rolling basis, currently after seven days. They exist only to stop duplicate sends.
- Contacts, messages and delivery logs — kept while your account is active, because you need them to answer “why did this person get this message”. Delivery logs are also what allows you to answer that question if Meta asks during app review.
- Your account and Instagram token — kept until you disconnect the account or delete your Convoly account.
When you delete your account we remove your data within 30 days, except where we must retain something to meet a legal obligation. Disconnecting an Instagram account deletes the stored access token immediately.
8. How we protect it
- Instagram access tokens are encrypted at rest with AES-256-GCM. An altered or truncated value fails to decrypt rather than degrading quietly.
- All database tables have row-level security enabled, and the database is not exposed to the public internet through our provider’s REST interface.
- Traffic is encrypted in transit with TLS.
- Passwords are handled by our identity provider and are never stored by us in any form.
No system is perfectly secure. If a breach affects your personal data and the law requires it, we will notify you and the relevant regulator without undue delay.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or restrict our use of your personal data, and to object to processing. Write to privacy@convoly.in and we will respond within the period the applicable law allows.
If you are one of the people who messaged a business using Convoly, that business controls your conversation data. Contact them first; if you cannot reach them, write to us and we will help identify the right party and act on their instructions. See our Data Deletion instructions.
If you are in the EU or UK you may complain to your local supervisory authority. If you are in India you may contact the Data Protection Board.
10. Children
Convoly is a business tool and is not directed at children. We do not knowingly collect data from anyone under 13, or under the minimum age in your country. If you believe a child’s data has reached us, tell us and we will delete it.
11. Changes
We will update this page when our practices change and revise the date at the top. If a change materially affects your rights, we will tell you in the product or by email before it takes effect.
Questions about this document? Email privacy@convoly.in. See also our Privacy Policy, Terms of Service and Data Deletion instructions.