Privacy Policy

Effective date: November 1, 2026

This policy explains what data Reelply uses, why, how long it is kept, and how you can delete it. We wrote it to be short and honest. If anything is unclear, email pedro@actusapp.io.

Who we are (data controller)

Reelply (reelply.actusapp.io) is operated by ACTUS INOVA SIMPLES (I.S.), CNPJ 69.596.650/0001-48, R Otilia Soares de Mello 1111, Casa 40, Ribeirão Preto, SP 14028-506, Brazil. We are the controller of the personal data described here. Our contact for privacy and data protection matters, including the person in charge of data protection (Encarregado / DPO) under Brazil's LGPD, is pedro@actusapp.io.

What Reelply does

Reelply lets a business connect its Instagram professional account through Instagram Business Login. Once connected, the app shows the account's profile, posts and comments, and lets the business reply to a comment publicly or send one private reply (a direct message) to the person who commented.

What data we use

• From Instagram, with your permission: your Instagram account ID, username and profile information, an access token, your posts, and the comments on them (including commenters' usernames and comment text). We request only these permissions: instagram_business_basic, instagram_business_manage_comments and instagram_business_manage_messages.
• What you send: the public replies and private replies you write in Reelply, which we pass to Instagram for delivery.
• Technical data: our hosting provider's request logs, which may include your IP address and browser details.

Why we use it, and the legal basis

• To provide the service you asked for: show your account, posts and comments, and send the replies you write. Legal basis: performance of a contract with you (LGPD art. 7, V).
• To keep the service secure and working (request logs). Legal basis: our legitimate interest (LGPD art. 7, IX).
• Commenters' data (username and comment text) is shown to you only so you can answer people who chose to comment on your posts. Legal basis: the connected business's legitimate interest in replying to its own comments (LGPD art. 7, IX).

Where it is stored and for how long

• No database. In this version, Reelply keeps no server-side database of users, tokens, posts or comments.
• Your access token, Instagram user ID and username are kept only in an encrypted, httpOnly cookie in your own browser. The cookie expires when the token expires (at most 60 days) or as soon as you click Disconnect.
• Profile, posts and comments are fetched live from Instagram each time you open the app and are not stored by us.
• Hosting request logs may hold IP addresses for a short period, as set by our hosting provider.

Who we share it with

We do not sell your data, use it for advertising, or share it with anyone except the two providers needed to run the app: Meta Platforms, whose Instagram API processes your requests, and Vercel Inc., which hosts Reelply. Vercel may process data outside Brazil, including in the United States, under its own data protection terms. We may also disclose data if the law requires it.

Your rights

Under the LGPD (and similar laws elsewhere) you can ask us to confirm whether we process your data, access it, correct it, delete it, port it, learn who we share it with, and withdraw consent. You can also complain to Brazil's data protection authority (ANPD). To use any of these rights, email pedro@actusapp.io. We reply within 15 days.

How to delete your data

Click Disconnect in Reelply, remove Reelply under Instagram → Settings → Apps and websites, or email us. Full steps are on the Data deletion page.

Children

Reelply is a tool for businesses and is not meant for anyone under 18.

Changes to this policy

If a future version of Reelply stores data on our servers (for example, to save reply templates or history), we will update this policy before that change goes live and show the new effective date here. For significant changes we will also tell you in the app.