Privacy Policy

1. Who this policy covers

This policy applies to two groups: (a) our customers — the creators and businesses who sign up for a Nerugaa account and connect an Instagram account; and (b) end users— the people who comment on or message our customers’ Instagram accounts and may receive automated replies.

2. Information we collect

• Account information. When a customer signs up we collect their name, email address, and authentication credentials.
• Instagram data (via Meta).When a customer connects their Instagram Business or Creator account, we receive their Instagram account ID, username, and a long-lived access token. We receive the content of comments, mentions, and direct messages relevant to the automations the customer configures, along with the sender’s Instagram-scoped user ID.
• Automation configuration. The keywords, rules, and message templates customers create.
• Usage and diagnostic data. Logs, error reports, and basic analytics used to operate and improve the service.

3. How we use information

• To deliver the core service: matching incoming comments, mentions, and messages against the rules a customer has configured and sending the automated replies they have set up.
• To authenticate customers and secure their accounts.
• To operate, maintain, debug, and improve the service, and to provide customer support.
• To comply with legal obligations and enforce our Terms.

We do notsell personal information. We do not use Instagram data for advertising, and we do not build profiles of end users beyond what is needed to deliver the customer’s automations.

4. How we share information

We share information only as follows:

• Meta Platforms. We exchange data with Instagram and Meta APIs as required to deliver the service, in accordance with the Meta Platform Terms and Developer Policies.
• Service providers. We use vetted infrastructure providers for hosting, databases, background job processing, and email delivery. They process data only on our instructions.
• Legal. We may disclose information where required by law or to protect rights, safety, and the integrity of the service.

5. Data retention

We retain customer account data for as long as the account is active. We retain Instagram-derived data (such as conversation history and access tokens) only as long as needed to provide the service. Access tokens are encrypted at rest. When a customer disconnects an Instagram account or deletes their Nerugaa account, we delete or de-identify the associated Instagram data within 30 days, except where retention is required by law.

6. Data security

We encrypt access tokens at rest, transmit data over HTTPS, and restrict access to production systems. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information. Customers can disconnect an Instagram account or delete their Nerugaa account at any time. To make a data request, see our Data Deletion page or email support@nerugaa.com.

8. International users

We may process and store information in countries other than your own. Where required, we rely on appropriate safeguards for cross-border transfers. We aim to comply with applicable data protection laws including the GDPR, CCPA, and India’s DPDP Act.

9. Children

Nerugaa is not directed to individuals under the age of 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notifying customers.

11. Contact

Questions about this policy or your data? Email support@nerugaa.com.