1. What we collect
- Your account. Your Google name, email and profile picture, and the workspace you create.
- Connected accounts. The account or Page name and ID, follower and post counts (used to check trial eligibility), and the access we need to read and send messages.
- Your audience’s activity. Comments, direct messages, Story replies and mentions on your connected accounts, with the sender’s public handle and ID, the post they relate to and the time. We call this message text.
- Videos. The video or post you connect to a flow. We download it briefly to read it.
- Usage and billing. Executions, charges, your Credits balance and top-ups. Our payment partner collects payment details, and we never see your card number.
- Technical data. Device and browser details and error reports, without message text.
2. How we use it
We use it to run your flows, send the replies you choose, show you results, bill your Credits, keep the service safe, prevent trial abuse and answer support requests. We do not sell your data or your audience’s data, and we do not use message text to train AI models.
3. AI processing
When a flow uses AI, we send the minimum needed: the audience’s message, what we learned about the video and your reply rules. The AI provider processes it under zero data retention, which means it does not keep it or train on it. Free model options only use providers that neither keep nor train on the data.
Private messages are never used to write public replies. Text in messages is treated as data, never as instructions.
4. Who we share it with
We share data only with service providers that help us run Auto Reply, under contracts that limit how they use it: hosting and database, AI processing, payments, email, error monitoring and our connection provider, which links your Instagram account or Facebook Page. We share data with authorities when the law requires it. We send the current list of these providers to anyone who asks.
5. How long we keep data
7 days on free accounts, 30 days on paid accounts
90 days
While an active flow uses it. You can view, correct and delete it
Deleted right after reading, and within 24 hours if reading failed
Until you delete them, or 12 months after the person’s last interaction
While the opt-out is in effect
Kept after a workspace is deleted
As the law and accounting require
Copies held by Instagram, Facebook or our connection provider are outside our delete controls.
6. Records that stay after deletion
We also keep your Credits balance on record when you delete your account, so you can get it back by signing in with the same Google account. Financial, audit and affiliate records stay for as long as the law and accounting require.
7. Staff access to messages
By default our team sees de-identified statistics and execution summaries. To read message text for a conversation or an execution, we need your permission in a support ticket. It covers only what you pick, expires after 72 hours, and every view is logged.
We may look without your permission only to investigate abuse or to meet a legal requirement. We tell you afterwards, unless the law forbids it. No one can read stored access keys.
8. Your choices
- View, correct and delete what we know about a video.
- Delete a person’s audience record, or opt a person out on their behalf. Only they can opt back in.
- Remove a connected account. Its audience records are deleted with it.
- Delete your workspace or your account. Before you confirm, we show what is deleted and what we keep.
- Emails about a stopped service, a connection to repair, payments and running out of Credits or allowance cannot be turned off. Daily summaries can. Marketing emails need your separate consent.
Depending on where you live, for example in the EU, the UK or California, you may also have the right to access a copy of your personal data, to have it corrected or deleted, to object to or restrict how we use it, to take it with you, and to complain to your local data protection authority. We do not sell personal data or share it for targeted advertising. To use any of these rights, email us from the address you sign in with. We reply within 30 days and will not treat you differently for asking.
9. Children
Auto Reply is not for children under 16. We do not knowingly collect their data. If you think a child’s data has reached us, contact us and we will delete it.
10. International transfers
We and our service providers may process your data in the United States and other countries. When data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the European Commission’s standard contractual clauses.
11. Changes and contact
We email you before material changes take effect. Questions or requests: admin@esuit.dev, 1111B S Governors Ave #25881, Dover, DE 19904, United States.