Privacy policy

linkpls sends Instagram DMs and public replies on behalf of the business and creator accounts that connect to it, using Meta’s official Instagram Graph API. This page explains what we store to do that, why, who else handles it, and how to have it deleted. Questions go to [email protected].

If you use linkpls for your account

• Your login: your email address and a hashed password, or — if you sign in with Google — the email address Google confirms, with the name and profile picture link on your Google account.
• Your sign-ins: when you last signed in, and for each browser that’s signed in, its IP address and browser type, so a session can be kept secure and signed out.
• Your Instagram connection: your Instagram account ID, username, profile picture link and follower count, and the access token Instagram issues. The token is encrypted at rest (AES-256-GCM) and is never shown back to anyone.
• What you set up: automations, keywords, message text, links, workspace settings and your posts’ captions and image links, which we keep so the post picker and statistics load quickly.
• Billing: your plan and subscription status. Payments are handled by Razorpay; we never see or store card details.

If you comment on, or message, an account that uses linkpls

• Your comment or message: the text, the time, your Instagram-scoped ID (an ID Instagram issues for that one business, not your account-wide ID) and your username.
• Your public profile details — name, profile picture and follower count — only once you have messaged the account, which is when Instagram makes them available.
• Anything you type in answer to a question in the conversation, such as an email address or phone number you choose to share.
• Whether you tapped a button in the DM, and a count of clicks on each link. We don’t record who clicked a link.
• That you replied STOP, so you are never messaged again by that account’s automations.

This information belongs to the account you interacted with, and is used only to run that account’s automations and show that account its conversations, leads and statistics.

If you ask for early access

We keep the email address, Instagram username and note you give us, only to send your invite and to understand who wants the product.

What we use it for

• Sending the replies and DMs an account has set up, once per person per automation, at a safe pace.
• Showing account owners their conversations, leads and results.
• Keeping the service secure, preventing abuse and fixing problems.
• Billing, and answering you when you write to us.

We don’t sell personal data, and we don’t use it for advertising.

Who else handles it

• Meta (Instagram) — every reply and DM is sent through Instagram’s API, which is also where comments and messages come from.
• OpenRouter and the AI model provider it routes to — only when an account owner uses an AI feature, and only the text needed for that request (for example a comment they want to answer, or a caption to suggest keywords from).
• Razorpay — subscription payments.
• Cloudflare and our hosting provider — they carry and store the site’s traffic and data on our behalf.
• Google — only if you choose to sign in with Google.

Cookies

We set a cookie to keep you signed in to the dashboard, and a short-lived one while you connect Instagram or sign in with Google, to protect that step. Your light or dark theme choice is remembered in your browser’s local storage. There are no analytics or advertising cookies.

How long we keep it

We keep an account’s data while it is connected. Removing linkpls from your Instagram settings, or asking us to delete your data, removes your account, its automations, conversations and leads. Operational logs are kept only as long as needed for security and debugging.

Deleting your data

See Data deletion for the two ways to do it — through Instagram, or by emailing [email protected]. If you messaged an account that uses linkpls, you can ask that account, or write to us directly.

Security

Access tokens are encrypted at rest, all traffic is served over HTTPS, and access to production data is limited to the people who run the service.

Children

linkpls is not meant for anyone under 13, and Instagram itself requires users to be at least 13.

Changes

If this policy changes, we’ll update this page and the date at the top.