Privacy Policy

1. Introduction & Data Controller

InfluDM is a product of Binjaratech IT Solutions Private Limited ("Binjaratech", "Company", "we", "us", or "our"), a company registered in India with its registered office at:

E, NetGuru Building, 2/4, GP Block, Sector V,
Bidhannagar, Kolkata, West Bengal – 700091, India
Email: info@binjaratech.com

This Privacy Policy explains how we collect, use, store, share, and protect information when you use the InfluDM web application and any related services (the "Service"). It also explains your rights and how to exercise them.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect the following categories of data:

3. Instagram & Meta Data — Specific Disclosures

InfluDM uses Meta's Instagram API with Instagram Business Login. When you connect your Instagram account, we request the following permissions and use them as described:

What we do NOT do with Instagram data:

• We do not sell, share, or transfer any Instagram user data to advertisers or data brokers.
• We do not use Instagram data for any purpose other than delivering the Service to you.
• We do not use the data to build advertising profiles.
• We do not access private messages beyond what is required to match your configured automation keywords and send your configured replies.
• We do not retain message content beyond 90 days, after which execution log entries containing message text are purged.

Data received via Webhooks: When a user comments on your post or sends you a DM, Meta sends a webhook notification to InfluDM. This notification contains the sender's Instagram user ID and the message/comment text. We process this data immediately to determine whether a flow should be triggered. The raw payload is stored temporarily (up to 90 days) in execution logs to allow you to audit and debug your flows.

4. How We Use Your Information

We use the collected information for the following purposes:

• Service delivery: Processing webhook events, matching keywords, sending automated replies, and recording flow executions;
• Account management: Authenticating you, maintaining your session, and personalising your dashboard;
• Contact management: Building your Contacts list with enriched profile data for users who interact with your flows;
• Service improvement: Analysing aggregate, anonymised usage patterns to improve features and performance (no personally identifiable information is used for analytics without your consent);
• Communications: Sending transactional emails (e.g. account verification, password reset, policy updates);
• Legal compliance: Complying with applicable laws, responding to legal requests, and enforcing our Terms & Conditions;
• Security: Detecting and preventing fraud, abuse, and unauthorised access.

We do not use your data for targeted advertising or sell it to third parties for marketing purposes.

5. Legal Basis for Processing (GDPR & Applicable Law)

For users in the European Economic Area or other jurisdictions requiring a legal basis, we process your data under the following grounds:

• Contract performance: Processing necessary to deliver the Service you signed up for;
• Legitimate interests: Security monitoring, fraud prevention, and service improvement;
• Legal obligation: Compliance with applicable laws and regulatory requirements;
• Consent: Where we ask for your explicit consent (e.g. optional analytics cookies).

6. Data Sharing & Third Parties

We do not sell your personal data. We share it only in these limited circumstances:

• Meta Platforms, Inc.: API calls and webhook subscriptions are processed via Meta's infrastructure. Meta's use of data is governed by their own Privacy Policy;
• Cloud infrastructure providers: Our hosting and database providers process data on our behalf under data processing agreements;
• Email service providers: Used solely to deliver transactional emails;
• Legal authorities: Where required by a valid court order, law, or regulation, we may disclose information to law enforcement or government bodies.

All sub-processors are contractually bound to protect your data and may only use it for the specific purpose for which it was shared.

7. Data Retention

• Account & profile data: Retained for as long as your account is active. Deleted within 30 days of account deletion.
• Instagram access tokens: Stored for the duration of their validity (up to 60 days) and deleted immediately upon disconnection or account deletion.
• Flow execution logs and message content: Retained for 90 days, then automatically purged.
• Contact records: Retained while your account is active. Deleted on account closure.
• Server logs (IP, access logs): Retained for up to 30 days for security and debugging purposes.

8. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit: All data transmitted between your browser, our servers, and Meta's APIs uses TLS 1.2 or higher;
• Encryption at rest: Instagram access tokens and sensitive fields are encrypted in our database;
• Access control: Production database access is restricted to authorised personnel only;
• Webhook signature verification: All incoming Meta webhook requests are verified using HMAC-SHA256 before processing;
• Regular security reviews: We periodically review our infrastructure and code for vulnerabilities.

Despite these measures, no system is completely secure. In the event of a data breach that affects your rights, we will notify you and applicable authorities in accordance with applicable law.

9. Cookies & Tracking

We use only essential cookies required for the Service to function (e.g. authentication session tokens). We do not currently use advertising cookies, tracking pixels, or third-party analytics scripts. If this changes in the future, we will update this policy and provide appropriate consent mechanisms.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you;
• Right to rectification: Request correction of inaccurate data (e.g. update your name via Settings);
• Right to erasure: Request deletion of your account and all associated data via Settings → General → Delete account, or by emailing us;
• Right to data portability: Request your data in a structured, machine-readable format;
• Right to restrict processing: Request that we limit processing of your data in certain circumstances;
• Right to object: Object to processing based on our legitimate interests;
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time (this will not affect prior processing).

To exercise any of these rights, contact us at info@binjaratech.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

Instagram data deletion: Disconnecting your Instagram account via Settings will revoke InfluDM's access on Meta's platform and delete your stored tokens immediately. To request deletion of all interaction data, please submit a written request to the above email address.

11. Data Deletion Requests (Meta Platform Requirement)

In compliance with Meta's Platform Terms, we provide a mechanism for Instagram users (including those who are not InfluDM account holders but whose data may have been received via webhook) to request data deletion.

If you are an Instagram user whose message or comment was processed by InfluDM on behalf of a business and you wish to have your data deleted, please email info@binjaratech.com with the subject line "Data Deletion Request – Instagram" and include your Instagram username. We will process and confirm your deletion request within 30 days.

12. Children's Privacy

InfluDM is not directed at or intended for use by children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete it promptly. If you believe we may have inadvertently collected such data, please contact us at info@binjaratech.com.

13. International Data Transfers

Our servers are located in India. If you access the Service from outside India, your data may be transferred to and processed in India, where data protection laws may differ from those in your country. By using the Service, you consent to such transfers. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Send registered users an email notification at least 7 days before the change takes effect;
• Display a prominent notice within the application.

Your continued use of the Service after the effective date of any change constitutes your acceptance of the updated Privacy Policy.

15. Contact Us & Grievance Officer

For any privacy-related questions, requests, or complaints, please contact:

Grievance Officer / Data Protection Contact
Binjaratech IT Solutions Private Limited
E, NetGuru Building, 2/4, GP Block, Sector V,
Bidhannagar, Kolkata, West Bengal – 700091, India
Email: info@binjaratech.com

In accordance with the Information Technology (Amendment) Act, 2008 and the DPDP Act, 2023, we will acknowledge and resolve privacy-related grievances within 30 days of receipt.