Privacy Policy

Who Is Responsible

i8chat is operated by Admov llc, which is the data controller for personal data processed through the service, including data received from Meta. Privacy enquiries can be sent to privacy@i8chat.com.

Data We Collect

We collect account email addresses for authentication, the name and profile photo Google shares when you sign in, workspace and billing metadata, the Instagram username you leave on our early-access list, email addresses you invite to your workspace, connected Instagram account identifiers, encrypted Instagram access tokens, campaign settings, webhook payloads, comments needed to process campaigns, delivery logs, and operational diagnostics.

We also receive the text of direct messages and story replies that people send to a connected account. We use it to match DM and story-reply campaigns. When a campaign matches, the message is kept in that campaign's delivery log; otherwise it exists only inside the raw webhook payload, which is deleted after 30 days.

For broadcasts we keep a contact list per connected account: each person's Instagram-scoped ID, username, when we first saw them, and when they last messaged and last commented. We also keep a broadcast recipient record of who each broadcast went to and when.

Our team may also keep internal support notes about your workspace; they are deleted when the workspace is deleted.

How We Use Data

We use this data to authenticate users, connect Instagram integrations, match comment keywords, send private replies through the official Meta APIs, prevent duplicate sends, troubleshoot failures, and protect the service.

Instagram And Meta Data

i8chat does not ask for Instagram passwords, scrape Instagram, or use browser automation. Instagram tokens are encrypted at rest and are used only to perform actions authorized by the connected business account.

The Inbox reads conversations from Instagram when you open them and does not save them. Every message sent to or from a connected account, including copies of the replies you send from the Inbox or from Instagram itself, also reaches us as a webhook payload from Meta, and those payloads are deleted after 30 days. Your browser tab keeps a temporary copy of what it has shown, which is cleared when you sign out or close the tab.

Tracked Links

Links we deliver on a customer's behalf pass through i8chat so the customer can see how their campaign performed. When someone opens one, we record the time, a hashed version of their IP address, the browser user agent, and the referring page. We do not store the raw IP address, and these identifiers are removed after 90 days while the click itself is kept as an anonymous total.

Subprocessors

The production service uses Vercel (application hosting), Railway (background worker, database and queue hosting), Google (sign-in), Resend (transactional email), and Stripe (payments). These providers process data only as needed to run the service. Content from the people who comment on or message a connected account (their messages, comments, usernames and IDs) is held only by Vercel and Railway. Emails we send you through Resend can include your own connected account's Instagram handle, campaign names, aggregate counts, and the reason Meta gave for messages that failed. Stripe receives only what it needs for billing.

Where Data Is Processed

Admov llc is based in the United States. i8chat's server functions run on Vercel in Frankfurt, Germany (pages are delivered through Vercel's global network), and the database, the message queue and the background worker that receives comments and sends messages run on Railway in Amsterdam, the Netherlands.

Our Website And Third Parties

The marketing pages serve their fonts and background video from i8chat.com itself. The sign-in pages load a graphics library (three.js) from cdnjs (Cloudflare). Every page of i8chat.com, including the marketing pages, uses Vercel Web Analytics, which counts page views and a few named button clicks (such as Start free) without cookies. It also counts each new sign-up, without your name or email address. Inside the dashboard, your posts' images and videos load directly from Instagram.

Cookies

i8chat sets only the cookies the service needs: a sign-in session cookie; security cookies that protect the step where you sign in with Google; i8_workspace, which remembers the workspace you last opened; and, for our own staff only, i8_view_as. We use no advertising cookies, and our analytics work without cookies. The marketing pages remember a Pause motion choice in your browser's local storage, not in a cookie.

Retention And Deletion

Workspace owners and admins can disconnect an account from Settings. That removes the account, deletes its stored access token, tells Meta to stop sending us events for it, and permanently deletes its campaigns, their delivery logs, its tracked links and their click counts, its contacts and broadcasts, and its follower history.

Raw webhook payloads received from Meta are deleted after 30 days. Operational diagnostics are deleted after 90 days. Tracked-link identifiers are removed after 90 days. Campaign and delivery logs are kept while the workspace is active, because they are the customer's own record of their campaigns, and are deleted when the connection or workspace is deleted. The contact list and broadcast recipient records are kept while the account is connected, and are deleted when it is disconnected, when Meta tells us the app was removed or data deletion was requested, or when the workspace is deleted.

Comments and messages also pass through our job queue (Redis, hosted on Railway) while they are processed. Those copies are deleted within 7 days of processing, and copies of jobs that failed within minutes.

If you remove i8chat from your Instagram or Facebook account, or submit a data deletion request through Meta, we act on it automatically. See the Data Deletion page linked from the footer.

Your Rights

You can ask for a copy of the personal data we hold about you, or ask us to correct or delete it, by emailing privacy@i8chat.com. Workspace owners and admins can also delete an account's data themselves from Settings, and the Data Deletion page lists every route, including one for people who were messaged by a business that uses i8chat.

Contact

For privacy questions, including access and deletion requests, contact Admov llc at privacy@i8chat.com.