Privacy Policy

Inboto is operated by EnduraMatrix Private Limited ("we", "us", "our"). This Privacy Policy explains how we collect, use, store, and protect your information when you use Inboto at https://inboto.app.

Account information such as your name, email address, and password (stored as a bcrypt hash, never in plain text) when you create an Inboto account.

Instagram account data needed to power automations, including username, Instagram User ID, and access token. Access tokens are encrypted with AES-256-GCM before being stored.

Automation configuration you create — keywords, message templates, trigger types, and post targeting.

DM metadata — recipient Instagram ID, timestamp, automation ID, and delivery status. We do not store the content of comments or DMs.

Contact data — Instagram usernames of people who interact with your automations.

Usage data — DM counts per billing period, used to enforce plan limits.

Payment data — handled entirely by Stripe (global) or Razorpay (India). We never store card numbers or payment credentials.

Technical data — IP address, browser type, and device type for security and fraud prevention.

We access your Instagram account through the Instagram Graph API using permissions you explicitly grant during the OAuth connection process.

instagram_business_basic — to retrieve your username and profile information for display in your Inboto dashboard.

instagram_business_manage_comments — to receive incoming comment events via webhook and check whether they match your configured automation keywords.

instagram_business_manage_messages — to send a private reply on your behalf using the message content you have pre-configured.

We do not read, store, or process Instagram data beyond what is strictly necessary to operate the features you have enabled. We never sell your Instagram data or use it for advertising.

All Instagram access tokens are encrypted using AES-256-GCM before being stored in our database.

Our database enforces Row Level Security — each user can only access their own data.

All data is transmitted over HTTPS.

We do not store the content of Instagram comments or direct messages — only metadata required to operate automations.

We do not sell your data. We share data only with the service providers needed to operate Inboto.

Supabase for database and authentication. Vercel for application hosting. Upstash for job queue processing. Stripe and Razorpay for payments. Resend for transactional email. Meta Platforms for the Instagram Graph API.

Your data is retained for as long as your account is active.

DM logs (metadata only) are retained for 90 days and then automatically deleted.

When you delete your account, all your data is purged within 30 days.

When you disconnect an Instagram account, its access token is immediately deleted from our database.

You may access the data we hold about you from your account settings.

You may correct inaccurate personal data.

You may request deletion of your personal data.

You may withdraw consent for data processing at any time by disconnecting integrations or deleting your account.

You may export your data as JSON or CSV.

To exercise any of these rights, contact us at support@inboto.app.

If you no longer wish to receive automated messages from an account that uses Inboto, you can block or mute that account on Instagram, or contact us at support@inboto.app and we will help suppress your Instagram ID from that account’s automations.

We use only essential cookies required for authentication (session cookie) and security (CSRF token). We do not use advertising or tracking cookies.

Inboto is not directed at children under 18. We do not knowingly collect data from minors.

We will notify you of material changes by email or in-app notification before they take effect. Continued use after the effective date constitutes acceptance.

EnduraMatrix Private Limited

support@inboto.app