Engagent ("the app") is operated by Ideal Intelligence, Muscat, Oman. This policy explains what data we process when you connect your Instagram professional account, and how to delete it.
Data we collect
App account — a Firebase account identifier created for you when you sign in. Instagram is the only sign-in method; we do not ask for an email address or a password.
Instagram connection — your Instagram professional account ID, username, and account type, plus an access token granted through Meta's official login (stored server-side, never on your device or shared).
Posts & metrics — media captions, thumbnails, and performance metrics (reach, likes, comments, saves, shares) fetched from the Instagram API.
Comments — comment text, commenter usernames and timestamps on your posts, plus the categories, sentiment and reply drafts our system generates for them.
Direct messages — when you grant messaging access, the text, sender ID and timestamp of Instagram direct messages sent to your account, plus any reply the agent drafts or sends. We only read conversations in your account's inbox; we never read messages in any account you do not connect.
Business Brain — the business facts you enter (location, hours, prices, FAQ, brand voice) used to ground AI replies.
Activity log — a record of actions taken in your account (analyzed, replied, hidden, deleted, escalated, messaged) for your own audit trail.
How we use it
To categorize comments, generate insight reports, and draft or send replies you configure — the core service.
To read direct messages sent to your account and draft or send a reply on your behalf. Messaging is reactive only: the agent replies inside Instagram's 24-hour messaging window to people who messaged you first, and to someone who commented on your post (a one-time private reply). It never starts a conversation, never sends marketing or promotional messages, and never messages anyone who has not contacted you.
Comment text (including the commenter's Instagram username), direct-message text and your Business Brain content are sent to a large-language-model provider to generate classifications, drafts and reports. We use Alibaba Cloud's Qwen API (DashScope International) as the primary provider and Anthropic's Claude API as a fallback. Both are used under business/API terms under which the provider does not train its models on this data. We send only the text needed for the task; we do not send your access token.
Data is stored in Google Firebase (Firestore / Cloud Functions, us-central1).
We use Firebase Analytics and Crashlytics for app stability and aggregate usage. We do not sell your data or use it for advertising.
Data retention & deletion
Data is retained while your account is connected.
In-app deletion: Settings → Delete Account permanently removes your connection, posts, comments, direct messages, Business Brain, activity log and tokens.
Meta data-deletion callback: removing the app from your Instagram settings triggers Meta's data-deletion request, which we honor automatically. Status of a deletion request can be checked at deletion-status using the confirmation code returned to Meta.
We share data only with the processors that make the service work:
Google LLC — Firebase Authentication, Firestore, Cloud Functions, Crashlytics and Analytics (data stored in the United States, region us-central1). Hosts everything above.
Alibaba Cloud (Qwen / DashScope International) — AI processing of comment text, direct-message text and Business Brain content.
Anthropic PBC — the same AI processing, used as a fallback when the primary provider is unavailable.
RevenueCat, Inc. — subscription and purchase status. RevenueCat receives an account identifier derived from your Instagram account ID, and no comment or message content.
Meta Platforms — the Instagram API itself, the source of the data.
No other third parties. We do not sell your data. We may disclose data if legally required — see Government and legal requests.
Security
Access tokens are stored server-side and never exposed to other users; all traffic is encrypted in transit (HTTPS); Firestore security rules restrict every user's data to their own account.
Government and legal requests
If a public authority asks us for user data, we review each request for legal validity before responding, we disclose only the minimum data the request actually requires, we challenge requests we consider unlawful or overbroad, and we keep a written record of every request and our response. We will notify the affected account holder unless we are legally prohibited from doing so. As of the effective date above we have never received such a request.
Children
The service targets business use and is not directed at children under 13 (or the equivalent minimum age in your jurisdiction).
Changes
We will post updates to this page and update the effective date above.