Privacy Policy

1. Entity & Scope

This service is owned and operated by Hooksend Software, registered under Udyam (Ministry of MSME, Government of India).

This Privacy Policy applies to all users of the Hooksend website (https://hooksend.in) and web application who connect their Instagram Professional accounts to automate comment responses and direct messaging.

2. Information We Collect

We collect only the minimum necessary information required to operate our automation service:

• Account Information: Name, work email address, and encrypted credentials when you register for a Hooksend account.
• Instagram Professional Data (via Meta OAuth): Instagram User ID (IGSID/App-Scoped ID), Instagram Username, Business Account Name, profile picture URL, and follower count metrics.
• Meta Authorization Tokens: Long-lived access tokens granted by the account owner via Instagram Business Login.
• Webhook & Interaction Data:Incoming comment text, comment timestamps, media IDs, commenter usernames, and DM delivery status events pushed by Meta's webhook system.
• Campaign Configuration: Trigger keywords, auto-reply text variations, custom link payloads, and button templates configured by workspace members.

3. What We Strictly DO NOT Collect or Do

• We never ask for, receive, or store your Instagram account password.
• We never use unauthorized scraping, headless browsers, or private unofficial APIs.
• We never read, collect, or store private personal DMs unrelated to automated trigger keywords.
• We never sell, rent, or monetize any user or follower data to third parties, data brokers, or advertisers.

4. How We Use Information (Meta API Compliance)

All data processed by Hooksend is strictly used to fulfill the functions authorized by the user under Meta's Platform Terms and Developer Policies:

• Comment Detection: Receiving real-time webhook events when a follower comments on your connected post or reel.
• Automated DM Delivery: Sending a one-time private reply with the requested link or content to the commenter via the official Instagram Graph API.
• Public Reply: Posting an optional public confirmation comment under the matching comment.
• Deduplication & Rate Limiting: Enforcing strict sliding-window rate limiters to protect account reputation and comply with Meta API quotas.
• Analytics & Logs: Displaying delivery reports, click-through rates, and message timestamps to the workspace owner.

5. Data Security & Token Encryption

We implement rigorous technical safeguards to ensure customer data and Meta tokens remain secure:

• Encryption at Rest: All Meta User Access Tokens are encrypted using strong cryptographic encryption standards with unique initialization vectors before storage.
• Encryption in Transit: All communication between user browsers, our servers, and Meta Graph API endpoints is strictly enforced over TLS 1.3 / HTTPS.
• Webhook Verification: Every incoming Meta webhook payload is validated against Meta's SHA-256 HMAC signature (X-Hub-Signature-256) to prevent spoofing.

6. Data Retention & User Data Deletion

You have full control over your data at all times:

• Disconnecting Instagram: You can disconnect your Instagram account anytime from Settings > Connected Accounts. Disconnecting immediately revokes token usage and purges cached tokens.
• Automated Data Deletion Request: In compliance with Meta Platform Terms, you can submit an automated deletion request via our dedicated compliance endpoint at https://hooksend.in/data-deletion.
• Account Erasure: To request complete erasure of your workspace and all associated delivery logs, email us at support@hooksend.inwith the subject "Data Erasure Request". All records will be permanently deleted within 48 hours.

7. Third-Party Subprocessors

We utilize reputable infrastructure and service providers to host and maintain Hooksend:

• Meta Platforms, Inc.: For Instagram Business Login, Graph API, and Webhooks.
• Cloud Hosting & Infrastructure Services: Secure server hosting, encrypted database persistence, and isolated computing environments.

8. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or data processing practices, please contact: