CommentSetu
Start free

Privacy Policy

Last updated: July 1, 2026

This Privacy Policy explains how CommentSetu ("we," "us," "our," or the "Service"), operated by Comment Setu ("Company"), collects, uses, discloses, and protects information when you use our website at commentsetu.com and our Instagram automation platform (collectively, the "Service").

By using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

1. Who We Are

CommentSetu is a software platform that helps Instagram creators and businesses automate replies to comments and Direct Messages ("DMs") on their own Instagram Professional (Business or Creator) accounts. We are not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. "Instagram" is a trademark of Meta Platforms, Inc.

Contact for privacy matters: hello@commentsetu.com Registered address: 252/191 Rakabganj Kadeem, Lucknow, Uttar Pradesh, India

2. Information We Collect

2.1 Information you provide directly

  • Name, email address, and phone number when you create an account
  • Billing details processed through our payment provider (Razorpay) — we do not store full card numbers ourselves
  • Support messages, feedback, and correspondence you send us

2.2 Information from your connected Instagram account (via Meta's Instagram Graph API)

When you connect your Instagram Professional account through Meta's official OAuth flow, and only after you grant explicit permission, we may access:

  • Your Instagram profile information (username, account ID, profile picture, account type)
  • Comments made on your posts, and the public profile information of commenters, to the extent needed to detect trigger keywords and route automated replies
  • Direct Message threads initiated between your followers and your account, solely to deliver the automated messages you configure
  • Media metadata (post/Reel IDs and captions) needed to let you scope an automation to a specific post
  • Webhook event data Meta sends us in real time (new comments, new messages) so we can trigger your automations

We only request the specific Instagram permissions (scopes) required for the features you use, such as instagram_basic, instagram_manage_comments, and instagram_manage_messages. You can review and revoke these permissions at any time from your Instagram or Facebook account settings.

2.3 Information collected automatically

  • Log data (IP address, browser type, device information, pages visited, timestamps)
  • Cookies and similar technologies used to keep you logged in and understand product usage (see Section 8)
  • Click data from short links generated by the Service, to provide you with delivery and engagement analytics

3. How We Use Information

We use the information described above to:

  • Provide, operate, and maintain the Service, including sending automated comment replies and DMs on your behalf, exactly as you configure them
  • Authenticate your account and maintain your session
  • Process subscription payments and send billing communications
  • Monitor and enforce rate limits and Meta's messaging-window rules (see Section 9) to help protect your Instagram account from restrictions
  • Respond to support requests and communicate service updates
  • Improve and troubleshoot the Service, including diagnosing bugs and webhook delivery issues
  • Detect, prevent, and address fraud, abuse, or violations of our Terms and Conditions or Meta's Platform Policies

We do not sell your personal data, and we do not use data obtained through the Instagram API for advertising purposes. Data obtained via the Instagram Graph API is used solely to provide the automation features you have configured within the Service, consistent with Meta's Platform Terms and Developer Policies.

4. How We Share Information

We share information only in the following circumstances:

  • Meta Platforms, Inc. — to send and receive messages, comments, and webhook events on your behalf, as required for the Service to function.
  • Service providers — hosting infrastructure, database providers, and our payment processor (Razorpay), each bound by confidentiality and data-processing obligations.
  • Legal requirements — if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of the Company, our users, or the public.
  • Business transfers — if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy or a policy providing at least equivalent protection.

We do not share Instagram user data with third parties for their independent marketing purposes.

5. Data Retention

We retain personal data and Instagram-derived data for as long as your account is active, or as needed to provide the Service. If you disconnect your Instagram account or delete your CommentSetu account:

  • We delete or anonymize your comment/DM event logs and access tokens within 30 days.
  • Billing records may be retained longer where required for tax, accounting, or legal compliance.
  • You may request earlier deletion at any time (see Section 7).

If an Instagram user requests deletion of their data collected via our automations, we honor that request through the process described in Section 14, Data Deletion Instructions, as required by Meta's Platform Policy.

6. Data Security

We use industry-standard safeguards — including encrypted connections (HTTPS/TLS), access-token encryption at rest, and restricted internal access — to protect information from unauthorized access, alteration, or disclosure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have rights to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your data
  • Withdraw consent for Instagram permissions at any time via Instagram/Facebook settings, or by disconnecting your account in-app
  • Port your data to another provider
  • Object to or restrict certain processing

For users in India: these rights are provided consistent with the Digital Personal Data Protection Act, 2023 (DPDPA). You may raise a grievance with our Grievance Officer at hello@commentsetu.com, and we will respond within the timelines prescribed by law.

To exercise any of these rights, email hello@commentsetu.com. We will respond within 30 days.

8. Cookies

We use essential cookies to keep you logged in and remember basic preferences, and limited analytics cookies to understand product usage and improve the Service. You can control cookies through your browser settings; disabling essential cookies may prevent the Service from functioning correctly.

9. Meta Platform Compliance

Our use of Instagram data is governed by Meta's Platform Terms and Developer Policies. In particular:

  • We only act on Instagram data following user-initiated triggers (a comment, a Story reply, or a DM you send to a connected account) — we do not send unsolicited, cold outreach messages.
  • We respect Meta's messaging-window and rate-limit rules when delivering automated messages.
  • You, as the connected account holder, remain responsible for ensuring your own use of automation complies with Instagram's Community Guidelines and Meta's policies for your specific use case.

10. International Data Transfers

Our servers and service providers may be located outside your country of residence, including in India, and other countries where our infrastructure providers operate. By using the Service, you consent to the transfer of your information to these locations, which may have different data protection laws than your jurisdiction.

11. Children's Privacy

The Service is not directed at, and may not be used by, anyone under the age of 18 (or the age of majority in their jurisdiction), consistent with Instagram's own eligibility requirements for Professional accounts. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated "Last updated" date, and for material changes, we will provide additional notice (such as an email or in-app notification).

14. Data Deletion Instructions

If you are an Instagram user who has interacted with a CommentSetu-powered automation (for example, by commenting on a post or receiving a DM from a connected account), or if you are a CommentSetu account holder, you can request deletion of your data at any time.

How to request deletion

Email us at hello@commentsetu.com with the subject line "Data Deletion Request," including:

  • Your Instagram username (or the connected account's username, if you're the business owner)
  • A brief description of what data you'd like deleted (e.g., "all comment/DM interaction data," "my full account and all associated data")

What happens next

  1. We will acknowledge your request within 5 business days.
  2. We will verify the request is legitimate (to prevent someone else from requesting deletion of your data).
  3. We will delete or anonymize the relevant data — including comment/DM event logs, stored access tokens, and any personal data tied to your Instagram account — within 30 days of verification.
  4. We will confirm by email once deletion is complete.

What gets deleted

  • Comment and DM event logs associated with your Instagram account
  • Any cached profile information (username, account ID) tied to those events
  • Stored OAuth access tokens, if you're disconnecting a connected account entirely

What may be retained

  • Billing records, where retention is required for tax, accounting, or legal compliance
  • Aggregated, de-identified analytics that no longer identify any individual

For CommentSetu account holders specifically

You can also disconnect your Instagram account and delete your CommentSetu account directly from Account Settings within the app, which triggers the same deletion process automatically without needing to email us.

15. Contact Us

Questions about this Privacy Policy or our data practices:

Email: hello@commentsetu.com Grievance Officer: Swastik Kumar Shukla, hello@commentsetu.com Address: 252/191 Rakabganj Kadeem, Lucknow, Uttar Pradesh, India

This template covers standard clauses required for SaaS products using the Meta/Instagram API and operating in India. It should be reviewed by a lawyer before publishing, particularly the DPDPA and grievance-officer sections, which have specific compliance requirements based on your data volumes and business structure.