GramFlowSign in

Last updated August 21, 2026

Privacy Policy

GramFlow operates a Meta Graph API-compliant Instagram Comment-to-DM, Story Mention, and Keyword Automation platform. This policy explains how we collect, process, store, and protect your information.

1. Overview

GramFlow ("we", "our", or "us") provides an Instagram automation platform allowing creators, brands, and businesses to automate private messaging responses, public comment replies, and tracked links when users comment on connected Instagram posts or reels, mention accounts in stories, or send direct messages. We are committed to protecting your privacy and ensuring full transparency regarding data collection and usage in accordance with Meta Developer Policies.

2. Information We Collect

Account & Registration Data: When you register for GramFlow, we collect your name, email address, password hash (encrypted via PBKDF2/SHA-512), and workspace metadata.

Instagram & Meta Integration Data: When you connect your Instagram Professional account (Creator or Business) via Meta OAuth login, we receive your Instagram Account ID, Username, Profile Picture URL, and linked Facebook Page ID.

Encrypted Access Tokens: We store long-lived Graph API access tokens provided by Meta strictly in encrypted form using AES-256-GCM encryption. We never have access to or store your Instagram password.

Campaigns & Webhook Events: To execute automation rules, we store campaign settings (keywords, response messages, tracked URLs), incoming comment webhooks (comment ID, commenter username, comment text), delivery status logs (DM sent/failed), and operational diagnostics.

Analytics & Click Tracking Data: When users click short links (`/r/` slug) generated by GramFlow, we record anonymized click events including anonymized IP hash, User-Agent, Referrer, and timestamp for conversion reporting.

3. How We Use Information

We use collected information solely for operating, maintaining, and providing the GramFlow service, including:

  • Authenticating user sessions and providing workspace access control.
  • Processing real-time webhooks sent by Meta to match comment keywords against customer campaign triggers.
  • Sending authorized private DMs and public comment replies through official Meta Graph API v25.0 endpoints.
  • Preventing duplicate message sends, enforcing Meta rate limits, and handling API errors gracefully.
  • Generating campaign analytics metrics (automations triggered, DMs delivered, short link click-through rates).

4. Meta Graph API & Data Protection Compliance

GramFlow strictly complies with Meta Developer Policies and Instagram Platform Guidelines:

  • We do not scrape Instagram, request user passwords, or use unauthorized browser automation tools.
  • We do not sell, rent, trade, or transfer Meta user data or Instagram content to any third parties, ad networks, or data brokers.
  • All access tokens are encrypted at rest using AES-256-GCM and stored securely in PostgreSQL databases with restricted access.
  • GramFlow executes automation actions only when triggered by explicit user events (e.g., commenting on a post or mentioning a handle).

5. Data Sharing & Subprocessors

We utilize trusted third-party cloud infrastructure providers strictly to host and run the GramFlow service:

  • Vercel: Application hosting and global CDN serverless edge functions.
  • Neon PostgreSQL: Encrypted relational database storage for accounts and logs.
  • Upstash / Redis: Background job queue processing for message orchestration.
  • Resend: Email API for login verification and transactional account emails.

6. Data Retention & Deletion Rights

You maintain full control over your Instagram connection and workspace data:

  • Disconnect Instagram: You can disconnect your Instagram account at any time from your Workspace Settings page. Disconnecting immediately revokes token access and halts all active automation campaigns.
  • Data Deletion Request: To request permanent deletion of your account, workspace, Instagram tokens, campaign logs, and analytics history, please visit our dedicated Data Deletion Guide or contact us at support@gramflow.in.

7. Security Standards

We implement robust technical and organizational security measures, including HTTPS TLS encryption for all data in transit, AES-256-GCM encryption for tokens at rest, SHA-256 webhook HMAC signature verification, and workspace-level tenant isolation to prevent unauthorized access.

8. Updates to This Policy

We may update this Privacy Policy periodically to reflect platform enhancements, feature releases, or changes in legal and regulatory requirements. Material changes will be published directly on this page with an updated "Last updated" date.

9. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:

Email: support@gramflow.in

Website: https://gramflow.in

Data Deletion: https://gramflow.in/data-deletion