Privacy policy

Who we are

Hey SutraDhar (“SutraDhar”, “we”) is a deal manager for creators. It is in private testing: only invited testers can use it, and nothing is open to the public yet. It is run by [OPERATOR: legal entity or founder name]. For anything about your data, write to [CONTACT EMAIL].

What SutraDhar does

SutraDhar connects your Instagram professional account (Creator or Business) using Meta’s official Instagram Login. It then reads new DMs that arrive after you connect, to find brand offers, and keeps those for you. This is a private test: the testers check whether it keeps the right messages.

SutraDhar is read-only. It never sends messages, replies, reacts, posts, comments or likes as you, and reading a DM through Instagram’s API does not mark it as read in your Instagram inbox.

What we collect when you connect

• From Instagram: your Instagram account IDs (Instagram gives each app more than one), username, name, profile picture link and account type.
• The permissions you gave (instagram_business_basic and instagram_business_manage_messages) and the access token Instagram issues for them. The token lasts about 60 days; SutraDhar renews it before it runs out while you stay connected.
• When you connected, and when the token runs out.
• A sign-in record for each device you use, so you stay logged in. We keep only a scrambled (hashed) copy of the sign-in cookie, never the cookie itself.

We never see or store your Instagram password. You type it only on Instagram’s own page.

How your DMs are read

• New messages only. SutraDhar reads DMs that arrive after reading starts for your account: the first time SutraDhar looks at your account after you connect. Older conversations are never read.
• SutraDhar checks for new DMs about every 15 minutes between 9:30 am and 12:15 am India time, when you open your SutraDhar page, and when you tap “Check now”. It asks Instagram for them; nothing is sent to anyone.
• Every DM goes through the same filter. Who follows whom is never used to skip or keep a message: the content decides. The filter runs on our server, in memory, with fixed rules in English and Hinglish. It is not an AI model, and no message is sent to an AI provider or any other company.
• The filter labels each message as a brand offer, not a brand offer, or unsure, and notes which of its fixed rules matched (for example “collab” or “an amount”). Those rule names never contain words from your message.
• Your own sent messages, reactions, read receipts and story mentions are ignored: they are not passed to the filter. Only a count goes up.

What is saved, and what never is

• Brand offers are saved, encrypted: the message text, the sender’s handle and Instagram ID, the message and conversation IDs, the time, and which rules matched. You see them on your Deals page, and you can mark each one correct or “not a deal”.
• “Not a deal”: when you mark a saved message that way, its text and sender are deleted at once. We keep only your answer, which rules matched and the filter version, to measure accuracy.
• Messages that are not brand offers are never saved and never written to any log. Only a count goes up, such as “12 checked today”.
• Unsure messages: the text is not saved. We keep only the message ID, the conversation ID, the sender’s handle, the time and which rules matched, and ask you: “Possible brand offer from @handle. Keep it?” If you keep it, SutraDhar fetches that one message from Instagram again and saves it as a brand offer. If you drop it, or don’t answer within 7 days, it is deleted.
• To avoid reading a message twice, we keep its ID (never its text) for 30 days.
• If a sender unsends or edits a message we saved, our copy is deleted or updated to match the next time SutraDhar checks.
• Missed deals: if you paste in a brand offer SutraDhar missed, it is saved, encrypted, like the others, and counts as a miss in your report.

What we never do

• Sell your data, or share it for advertising.
• Send, reply to, react to or mark as read any message, or post anything as you.
• Use analytics, tracking pixels or third-party scripts.
• Put message text, tokens or passwords in our logs, error reports or web addresses.
• Send your messages to an AI provider. If AI is ever added, it would only see messages already identified as brand offers, and this policy would change first.

Cookies

We use two cookies, both needed for sign-in. Neither is used for tracking.

• sd_session keeps you signed in for up to 30 days, or until you log out.
• A sign-in check cookie that lasts 10 minutes and protects the Instagram connection step from forgery.

How your data is protected

• Everything travels over HTTPS, and the app’s connection to its database is encrypted too.
• Instagram access tokens are encrypted at rest (AES-256-GCM).
• Saved brand offers are encrypted at rest (AES-256-GCM, with their own key).
• The app and database are hosted by [HOSTING PROVIDER AND REGION].

How long we keep it

• Your connection details and access token: while you stay connected. Disconnecting deletes them from our database straight away. If Instagram tells us the access token no longer works, we delete the token at once.
• Saved brand offers and missed deals you pasted: until you mark them “not a deal”, the sender unsends them, or you disconnect.
• Unsure message IDs: until you answer, 7 days at most.
• Message IDs kept to avoid reading a message twice: 30 days.
• Daily counts (numbers only): until you disconnect.
• Sign-in records: deleted when you log out or disconnect. Otherwise a sign-in stops working after 30 days, and its record is deleted the next time anyone signs in to SutraDhar.
• If Meta sends us a deletion request for you: only its confirmation code and its dates, so the status page can answer. Nothing that identifies you is kept with it.
• Backups kept by our hosting provider: deleted data can stay in them, still encrypted where it was encrypted, for [BACKUP RETENTION, IF ANY] before they expire.

Deleting your data and your rights

You can delete everything at any time by disconnecting Instagram in SutraDhar, or by writing to us. Disconnecting deletes your access token, connection details, every saved brand offer, the unsure list, the message IDs and your counts. Removing SutraDhar in Instagram’s settings also deletes your data once Instagram notifies us; we haven’t yet confirmed during testing that these notifications arrive, so disconnect in SutraDhar to be sure. See how to delete your data.

You can also ask us what data we hold about you, or ask us to correct it, by writing to [CONTACT EMAIL]. We aim to meet India’s Digital Personal Data Protection Act, 2023. SutraDhar is meant for creators aged 18 and over.

Changes to this policy

If we change what we collect or read, we will update this page and its date, and tell connected testers before the change takes effect.