Privacy policy

Who is responsible

• For the people who sign up and connect an Instagram account ("account owners"), Kreatek SARL is the controller of their account data.
• For the people who comment on or message those accounts ("contacts"), the account owner decides what the automation does, and we process contact data on the account owner's behalf.

What we collect

• Connected account: Instagram account ID, username, profile picture, account type, and an access token that Instagram issues (stored encrypted).
• The account's own posts and reels (IDs, captions, thumbnails), so you can choose where an automation runs.
• Comments on those posts: comment text, the commenter's Instagram-scoped ID and username.
• Direct messages between the account and contacts, including button taps, and messages the account sends.
• Email addresses that contacts choose to share, with the consent text they were shown and the time.
• Clicks on links we send: the time, and the browser's user agent to filter out link-preview bots.
• Account owners and teammates: email address, password (stored hashed), workspace and role.
• Server logs and error reports, with tokens, emails and message text removed.

We don't use cookies for tracking or advertising, and the site loads no third-party analytics. The only cookie is the site's session cookie, which keeps you logged in.

Why we use it, and on what basis

• To run the automations an account owner sets up: a public reply to a comment, a private reply, the follow-up messages the contact asks for by tapping or replying, and the link. Basis: our contract with the account owner, and the account owner's legitimate interest in answering people who engaged with them.
• To keep a contact's email when they type it in answer to the request. Basis: consent, which they can withdraw at any time.
• To keep the service secure and working (rate limits, error logs, abuse prevention). Basis: legitimate interest.
• To send account owners service emails (invites, password resets, alerts that need action). Basis: contract.

We only message a person who commented or messaged first, inside the window Instagram allows, and the first message says it's automated. Replying "stop" ends automated messages to that person.

How we use Instagram data

We use data from Instagram (Meta Platform Data) only to provide the features the account owner turned on. We don't sell it, don't use it for advertising or profiling, don't share it with data brokers, and don't use it to train AI models. We access only the accounts their owners connect.

Who processes it

Transfers to the United States happen under each provider's data processing agreement and the EU standard contractual clauses.

How long we keep it

Your rights (EU and UK)

You can ask for access to your data, correction, deletion, a portable copy, or object to processing. Email apps@fittdesign.com. If you're a contact of a business that uses Fitt Reply, you can also ask that business directly; account owners can export or delete a contact's data from Contacts. We answer within one month. You can also complain to your data protection authority.

To delete everything for a connected Instagram account, see Data deletion.

Contact

Kreatek SARL, Beirut, Lebanon, +961-1-426-489, apps@fittdesign.com.