Privacy Policy

1. Introduction & Overview

Gravliq Labs (“we,” “our,” or “us”) operates Gravliq Studio, an Instagram automation and unified customer messaging platform available at studio.gravliq.com. We are deeply committed to safeguarding your privacy, ensuring multi-tenant data isolation, and strictly complying with the Meta Platform Terms, Developer Policies, the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

This Privacy Policy describes what information we collect when you use our website, dashboard, and integration services, how we process and store that data, and your rights regarding your personal information.

2. Information We Collect

We collect information in the following categories:

• Account & Profile Information: When you register for Gravliq Studio, we collect your name, email address, hashed passwords (using bcrypt with work factor 12), and company or workspace details.
• Connected Instagram Account Data: When you link your Instagram professional or business account through Instagram Login (the Instagram API with Instagram Login), we receive your Instagram account ID, username, and access token expiration data. A Facebook Page is not required.
• Engagement & Messaging Activity: To deliver keyword automation and unified inbox features, we receive real-time webhook events from the Instagram Platform containing comment IDs, public comment text, customer sender IDs (IGSID), customer usernames, and direct message text initiated by the customer.
• Payment & Billing Data: Payments are processed by our payment providers (Razorpay for payments in INR and, where offered, Stripe for payments in USD). We do not store full card numbers, UPI IDs, or banking credentials on our servers; we store the provider's customer, subscription and payment reference IDs, your plan, and billing dates.
• Transactional Email: We use your email address to send account emails such as password reset links.

3. How We Use Instagram Platform Permissions

Gravliq Studio only requests the minimum Instagram API permissions necessary to operate our core services. We never use Meta API data for advertising, surveillance, data brokering, or selling to third parties:

• instagram_business_basic: Used solely to verify your Instagram professional account identity, display your handle in your workspace, and retrieve basic profile information.
• instagram_business_manage_comments: Used to receive incoming comments on your posts, match them against the keyword rules you create, and post the public replies you define.
• instagram_business_manage_messages: Used to send the private replies and direct messages you configure in response to a customer's comment or message, and to let your team answer customer messages from the unified inbox, strictly adhering to Meta's messaging windows.

4. Security, Encryption & Data Storage

Security is built into Gravliq Studio's architecture from the ground up:

• AES-256-GCM Token Encryption: All Meta OAuth access tokens are encrypted at rest using AES-256-GCM with unique cryptographic initialization vectors (IVs) and authentication tags before database persistence.
• HMAC-SHA256 Webhook Verification: Every inbound webhook notification from Meta is verified using HMAC-SHA256 cryptographic signatures against our application secret before processing.
• Multi-Tenant Isolation: Data between workspaces is strictly separated with database relational foreign keys and role-based access control (RBAC).
• Rolling Activity Stream: The activity feed of comment and message events is limited to the 50 most recent events per workspace and is erased when you disconnect your Instagram account or request data deletion.

5. Compliance with Meta Messaging Policies

Gravliq Studio strictly enforces Meta's standard messaging guidelines:

• 24-Hour Messaging Window: Direct messages can only be sent within 24 hours of an incoming user interaction. Gravliq Studio programmatically blocks outbound direct messages outside this window to ensure zero policy violations.
• No Unsolicited Commercial Messaging: We do not support cold direct messaging or scraping customer lists. Messages are only sent in response to user-initiated actions.

6. User Data Deletion Instructions

In accordance with Meta Platform Terms and global privacy laws, users have the right to request deletion of all data associated with their account and connected Instagram profile:

1. In-App Disconnection: Navigate to your Gravliq Studio Workspace Dashboard → Instagram Connection → click Disconnect account. This immediately discards your stored encrypted access token, and Gravliq Studio stops processing events from that account.
2. Instagram App Settings: In Instagram, open Settings → Apps and websites → find Gravliq Studio → click Remove. Instagram then notifies Gravliq Studio, which disconnects the account, discards the stored token and erases the cached activity for that account.
3. Workspace & Account Purge: Workspace Owners can delete their entire workspace and associated rules/logs under Workspace Settings → Danger Zone → Delete Workspace.
4. Manual Deletion Request: You can submit a full data deletion request by visiting our Data Deletion Status Page or emailing privacy@gravliq.com with your account email. All user records, tokens, logs, and activity streams will be completely erased from our databases and backups within 30 days.

7. Service Providers

We share personal data only with providers that help us run Gravliq Studio, and only as needed to provide the service: cloud hosting and managed database and cache services (Google Cloud and our database providers), transactional email (Resend), and payment processing (Razorpay and, where offered, Stripe). We do not sell personal data.

8. Contact Us & Data Protection Officer

If you have any questions about this Privacy Policy, your personal data, or Meta Platform compliance, please contact our Data Protection team: