Privacy Policy

Last updated: [[EFFECTIVE_DATE]]

Draft for legal review. Highlighted items are filled in before this policy takes effect.

1. Who we are

Engagement AI: Social Manager ("Engagement AI", "we") is a mobile app for businesses that answer their customers on Instagram. It is provided by [[COMPANY_LEGAL_NAME]], [[COMPANY_ADDRESS]], registered under [[COMPANY_REGISTRATION]]. Our representative in the European Union is [[EU_REPRESENTATIVE]]. You can reach us at support@engagementai.net.

This policy covers the Engagement AI apps for iOS and Android and this website. We are the data controller for the account data of our users. For the messages and comments of a business's customers, the business is the controller and we process that data on its behalf, under our Data Processing Agreement ([[DPA_URL]]).

2. What we collect

Your account

Your email address, your name if you give it, the identifiers of the sign-in method you use (an email code, Sign in with Apple or Google), your language and time zone. If you sign in with Apple we also keep a token that lets us revoke that sign-in when you delete your account.

Your workspace

The business name, country and currency, the people you invite and their roles, and your settings.

Instagram accounts you connect

When you connect an Instagram professional account with Instagram Login, you choose to give us access through these permissions, and we read only what each feature needs:

• Profile (instagram_business_basic): username, profile picture, account type, follower and media counts.
• Messages (instagram_business_manage_messages): the messages your customers send to your account and your replies, their attachments, and the sender's Instagram-scoped identifier and username.
• Comments (instagram_business_manage_comments): comments on your posts and your replies to them.
• Publishing (instagram_business_content_publish): the posts you choose to publish from the app.
• Insights (instagram_business_manage_insights): your account's and your posts' metrics, such as reach, views and interactions.

We keep the access token Instagram gives us, encrypted, until you disconnect the account.

What you add

Products, prices, FAQs, policies and documents you add to your knowledge base; drafts, automations and templates you create.

Your device

A push notification token, an installation identifier, the platform and the app version.

Purchases

Subscriptions and packs are bought through the App Store or Google Play. Apple or Google handles the payment; we receive the transaction records (identifiers, product, dates and status), never your card details.

Optional diagnostics and analytics

Only if you allow it in the app: crash reports (Firebase Crashlytics), with message text, emails, phone numbers and handles removed, and app usage events (Google Analytics 4), which never contain message content or your customers' identities. You can change this at any time in the app. We do not track you across other companies' apps or websites.

This website

Firebase Hosting records visitors' IP addresses to serve and protect these pages.

3. How we use it

• To provide the service: the shared inbox, replies, comments, automations, AI suggestions and replies, insights, reports and publishing.
• To keep it secure, prevent abuse and fix problems.
• To verify purchases and apply your plan.
• To answer your support requests, and to meet our legal obligations.

We do not sell personal data, use Instagram data for advertising, or build profiles of Instagram users. Data from an Instagram account is used only to provide features to the workspace that connected it. The app sends messages only to people who messaged or commented on your account first.

4. AI features

To draft replies, detect a message's language and intent, and summarise conversations, we send excerpts of the conversation and the relevant parts of your knowledge base to our AI model providers ([[LLM_PROVIDERS]]), using their EU endpoints. Phone numbers and email addresses are masked first. The providers may not keep this data or use it to train their models. When AI replies automatically, the conversation carries a notice that replies are AI-generated; this cannot be switched off. You can turn the AI features off.

5. Legal bases

Under the GDPR and Turkey's Personal Data Protection Law No. 6698 (KVKK), we process your data to perform our contract with you; for our legitimate interests in security and in improving the service; with your consent, for optional diagnostics and analytics, which you can withdraw at any time; and to comply with the law.

6. Where your data is stored

Our servers and databases are in Google Cloud in Frankfurt, Germany (europe-west3). Some services we rely on work outside the EU: Firebase Authentication processes sign-in data in the United States, and Firebase Cloud Messaging, Crashlytics, App Check, Remote Config, Installations, Hosting and Google Analytics run globally. Transfers outside the EU rely on the providers' standard contractual clauses. Transfers of data of people in Turkey rely on the standard contracts under Article 9 of the KVKK, notified to the Personal Data Protection Authority.

7. Who processes data for us

Apple and Google process your purchases as independent controllers under their own terms. Meta provides the Instagram platform you connect. We disclose data to authorities only when the law requires it.

8. How long we keep it

• Instagram access tokens: until you disconnect the account, then deleted at once.
• Messages, comments and attachments: while the account is connected and 30 days after it is disconnected; deleted at once when you delete the workspace or ask Instagram to delete your data.
• Your knowledge base and content: until you delete them or the workspace.
• AI suggestions and decisions: 180 days. Automation history: 90 days.
• Your account: deleted when you delete it; the last records go after 30 days.
• Server logs: 14 days. Traces: 30 days. Security and audit records: 1 year.
• Optional analytics: 2 months. Optional crash reports: 90 days.
• Purchase records: [[STORE_RECORDS_YEARS]] years, as tax and commercial law require.

9. Deleting your data

• Delete your account in the app, or follow the steps on Delete your account.
• Delete Instagram data by disconnecting the account in the app or removing Engagement AI in Instagram: see Instagram data deletion.
• A workspace owner can delete the whole workspace from its settings.

10. Your rights

You can ask to access, correct, delete, restrict or export your data, object to processing and withdraw consent. Under Article 11 of the KVKK you can also learn whether and why your data is processed and to whom it is transferred, object to a result produced solely by automated processing, and claim compensation for unlawful processing. Write to support@engagementai.net; we answer within 30 days. You can also complain to your data protection authority, such as the Turkish Personal Data Protection Authority or the authority in your EU country.

11. If you message a business that uses Engagement AI

The business decides how your messages and comments are used and is responsible for them. Contact the business first; if you cannot reach it, write to us and we will help.

12. Security

Data is encrypted in transit, Instagram tokens are encrypted at rest, each workspace's data is isolated from every other's, and access by our staff is limited and logged.

13. Children

Engagement AI is for businesses. You must be at least 18 years old to use it.

14. Changes

We tell you in the app or by email before a material change takes effect. The date at the top shows the latest version.