This policy explains how POROTTA ("POROTTA", "we", "us") collects, uses, stores and deletes information in connection with the POROTTA application (the "App"), a tool that replies to comments and sends direct messages on Instagram business accounts that have explicitly connected themselves to it.

POROTTA is a proprietorship registered in India under Udyam Registration Number UDYAM-KL-04-0089053, with its registered office at Ktp House, Kt pakkar haji nagar, kakkad, edechovva, Arayalthara, Kannur, Kerala 670005, India.

It applies to the App and to porotta.app.

1. Who this policy covers

Two groups are described here, and they are treated differently:

• Account owners — someone who connects their own Instagram professional account to the App to automate replies on it.
• Commenters and message senders — Instagram users who comment on, or message, a connected account. They do not sign up for the App, and we only process what Instagram sends us about that interaction.

2. What we collect

2.1 From account owners, at connection

Connection runs through Meta's official OAuth flow. We never see or store an Instagram password. We receive and store:

• The Instagram professional account username and Instagram user ID
• The linked Facebook Page ID
• An access token issued by Meta, used to act on the account's behalf
• The permissions granted, and the date access expires

2.2 From Instagram, about interactions

When someone interacts with a connected account, Meta sends the App a webhook. We process and may store:

• The text of a public comment
• The commenter's Instagram username and Instagram-scoped user ID
• The comment ID and the ID of the post, Reel or media it was left on
• The content of direct messages sent to, or by, the connected account through the App
• A timestamped record of what the App did in response, and whether it succeeded, was skipped, or was blocked

2.3 Permissions we request

The App requests only what it needs to function:

• instagram_business_basic — identify the connected account and confirm the connection is valid
• instagram_manage_comments — read comments on the connected account and post replies
• instagram_manage_messages — send and receive direct messages on the connected account

We do not request advertising data, follower lists, insights, or access to any account other than the one the owner explicitly connects.

2.4 The website

porotta.app may set standard cookies and collect ordinary server log data such as IP address, browser type and pages visited, for security and basic analytics. We do not use the website to build advertising profiles.

3. Why we use it

• To match an incoming comment against the rules the account owner configured
• To send the reply or direct message the account owner configured
• To show the account owner an activity log, so they can see and correct their own automations
• To prevent duplicate replies to the same comment
• To diagnose errors and keep the service secure and reliable

4. Who we share it with

• Meta Platforms — necessarily, since replies and messages are delivered through the Instagram Graph API. Meta's handling is governed by the Meta Privacy Policy.
• Infrastructure providers — the hosting and networking services that run the App, acting on our instructions.
• Where legally required — under valid legal process, or where disclosure is necessary to investigate fraud, abuse or a security incident.

5. How long we keep it

• Access tokens and account details — until the owner disconnects the account, or the token expires and is not renewed.
• Comment and message records, activity logs — while the automation is active, then deleted on disconnection or on request.
• Server and error logs — a short operational period, then discarded.

Disconnecting an Instagram account removes our ability to act on it and revokes the stored token.

6. How it is protected

Access tokens and application secrets are held in server-side configuration and are never exposed to the browser. Traffic between the App and Meta runs over HTTPS. Incoming webhooks are verified with an HMAC-SHA256 signature and rejected outright if the signature is missing or invalid, so the App will not act on a forged request. Administrative access is password protected.

No system is perfectly secure, and we cannot guarantee absolute security — but we do not retain more data than the App needs to function.

7. Your rights, and how to delete your data

You may request access to, correction of, or deletion of the personal data we hold about you. You may also object to processing or withdraw consent at any time.

7.1 If you are an account owner

1. Disconnect from Instagram directly. In your Instagram or Facebook settings open Business Integrations (Settings → Apps and Websites → Business Integrations), find POROTTA and select Remove. This immediately revokes our access.
2. Email us at the address below. We will delete the connected account record, its stored token, and its associated comment, message and activity logs.

7.2 If you are a commenter or message sender

If you commented on, or messaged, an account that uses the App and want that record deleted, email us with your Instagram username and, if you have it, a link to the post or comment. You do not need an account with us to make this request.

7.3 Response time

We confirm and action a verified deletion request within 30 days, and sooner where we reasonably can. We may ask for information sufficient to confirm the request genuinely comes from you or from the account owner.

8. Children

The App is intended for business use and is not directed at children under 13, or the minimum age required by local law. We do not knowingly collect personal data from children. If you believe a child's data has reached us, contact us and we will delete it.

9. International transfers

We operate from India. Information processed by the App, and by Meta, may be transferred to and stored on servers outside your country. Where that happens we rely on appropriate safeguards and process no more than is needed to deliver the service.

10. Changes to this policy

We may update this policy as the App changes. The date at the top always reflects the current version. Material changes affecting how we use personal data will appear here before taking effect.

11. Contact us

For any privacy question, or to make an access or deletion request:

If you are in a region with a data protection authority and believe we have not resolved your concern, you have the right to complain to that authority.