Privacy Policy

Heyjaanu · Last updated 3 September 2026

Heyjaanu (“we”, “the service”) is a tool that lets an Instagram business or creator account reply automatically to comments on its own posts, by sending that commenter a private reply. This policy explains exactly what data the service handles, why, how long it is kept, and how to have it removed.

This policy describes what the software actually does. Where it names a retention period or a security measure, that value is the one configured in the running system, not an aspiration.

1. Who this policy covers

Two different groups of people, whose data is treated differently:

Operators — the business or person who connects their Instagram account and configures the automation.
Commenters — people who comment on an operator’s Instagram posts. They do not have an account with us and never interact with us directly.

2. What we collect from Instagram, and why

When an operator connects their Instagram professional account, Instagram grants us an access token scoped to that account. Using it, we receive or read:

Data	Why it is needed
The operator’s Instagram account ID, username and account type	To identify which account an automation belongs to and to stop an account replying to its own comments.
Comments on the operator’s own posts — the comment text, its ID, the post ID, and the commenter’s Instagram-scoped ID and username	This is the trigger. The text is matched against the keywords the operator configured; without it there is nothing to respond to.
Post (media) IDs, captions, permalinks and thumbnails	So the operator can choose which post an automation applies to.
The private reply we send, and whether Instagram accepted it	To avoid messaging the same person twice for the same comment, and to show the operator what was sent.

What we deliberately do not collect

We do not read direct messages. The service does not subscribe to Instagram’s messaging webhooks and holds no permission to read a conversation.
We do not collect follower lists, likes, insights, or any data about people who have not commented.
We do not build profiles of commenters across different operators. Each operator’s data is isolated at the database level.
We do not sell, rent or share personal data with advertisers, data brokers or any third party for their own purposes.

3. How a private reply happens

Instagram permits a business to send one private reply to a person who has commented on its post, within seven days of that comment. The service does exactly that and nothing more:

A person comments on the operator’s post.
If the comment matches a keyword the operator configured, the service sends that person one private reply.
Every automated message carries a disclosure identifying it as automated.

We never send unsolicited messages. The service has no ability to broadcast, to message a list, or to contact anyone who has not commented. There is no feature that does this and it is refused by design.

4. Opting out

A commenter who replies to one of our messages, or comments, with a plain refusal — “stop”, “unsubscribe”, “remove me”, “not interested” and similar — is added to an opt-out list and is never messaged again by that operator. This does not expire, and the record cannot be edited or deleted by the operator through the application.

You may also opt out at any time by emailing us at the address at the foot of this page with the Instagram handle you comment from.

5. How long data is kept

Data is deleted automatically on the schedule below. These are the service’s configured defaults; an operator may shorten them but the software refuses values below a stated floor, because some records are still needed for the service to work correctly.

What	Kept for
Raw comment data received from Instagram	90 days
Record of an automation run and the message sent	365 days
Comments a spam filter suppressed, where an operator enabled one	90 days
Outbound notification attempts to an operator’s own systems	90 days
Security events (failed sign-ins and similar)	180 days
Record of actions an operator took in the console	730 days
Expired or revoked operator sign-in sessions	30 days
Opt-out records	Kept indefinitely — see below

Opt-outs are deliberately never deleted. Erasing the record that somebody asked not to be contacted would allow them to be contacted again. It is the one piece of data whose retention protects the person it concerns.

6. How data is protected

Instagram access tokens are encrypted at rest with AES-256-GCM. The encryption key is held in the environment and never stored in the database.
Operator passwords are never stored. Only an Argon2id hash is kept, from which a password cannot be recovered — including by us.
Every operator’s data is isolated in the database itself using row-level security, so one operator’s queries cannot return another’s data even if application code were wrong.
Records of what was sent, of operator actions, and of opt-outs cannot be altered or deleted by the application — the database refuses those operations. An automated system that can quietly rewrite its own history cannot be audited.
Every webhook received from Meta is verified by cryptographic signature before it is accepted.

7. Your rights, and how to exercise them

Under India’s Digital Personal Data Protection Act 2023, and equivalent rights elsewhere, you may ask us to:

tell you what data we hold about you;
correct it;
delete it;
stop contacting you.

Email the address at the foot of this page from, or naming, the Instagram handle concerned. We respond within 30 days. Deletion is carried out at the database level and removes every record tied to you, with the single exception of an opt-out entry, which is kept precisely so that you are not contacted again.

See also our data deletion instructions.

8. Where data is processed

Data is processed on servers operated by the service and by its infrastructure providers. Where a provider is located outside India, transfers are made only to jurisdictions permitted under applicable law and only to the extent needed to run the service.

9. Children

The service is not directed at children and we do not knowingly process the data of anyone under 18. If you believe we hold such data, contact us and it will be deleted.

10. Changes to this policy

If this policy changes materially, the date at the top of this page changes with it. Operators are notified in the console.

11. Contact

Email: support@heyjaanu.com

Data protection queries, deletion requests and opt-out requests all go to this address.