Privacy Policy
Last updated: 20 July 2026
Shovvly is operated by Vexio j. s. a., registered in Slovakia under company number 54214530 (“we”, “us”). This policy explains what we collect when you connect an Instagram account to Shovvly, why we collect it, how long we keep it, and how you delete it.
1. Who this policy covers
It covers two groups: customers, who sign up and connect an Instagram professional account, and contacts, who are the Instagram users that comment on or message a customer’s account and whose messages pass through our service.
2. What we collect
| Data | Why |
|---|---|
| Customer name and email address | Account creation, login, billing and support |
| Instagram account ID, username and profile picture of the connected account | Identifying which account an automation belongs to |
| Instagram access token | Sending and receiving messages on the customer’s behalf |
| Contact Instagram-scoped ID and username | Threading a conversation to the right person |
| Message and comment content exchanged through the connected account | Triggering automations, showing the conversation in the inbox, and letting a human reply |
| Delivery logs (timestamps of messages we sent) | Enforcing Instagram’s rate limits and diagnosing failed sends |
We do notcollect Instagram passwords. Authentication happens on Instagram’s own login screen; we only ever receive an access token.
3. How we use it
Strictly to run the service the customer asked us to run: replying to comments and messages according to the automations they configured, displaying conversations in their inbox, and enforcing the platform limits Instagram requires us to respect.
We do not sell personal data. We do not share it with advertisers. We do not use message content to train machine-learning models.
4. Legal basis (GDPR)
- Contract — processing customer data is necessary to provide the service they signed up for.
- Legitimate interest — processing contact messages so a business can respond to people who chose to contact it.
- Legal obligation — retaining billing records where tax law requires it.
5. Who we share it with
Only processors necessary to operate the service, each bound by a data processing agreement:
- Supabase — database and authentication hosting (EU region)
- Vercel — application hosting
- Meta Platforms — the Instagram API itself, to deliver messages
6. How long we keep it
- Messages and contacts — retained while the Instagram account stays connected, then deleted within 30 days of disconnection.
- Delivery logs — 48 hours, then automatically pruned.
- Raw webhook payloads — 7 days, kept only so a failed delivery can be retried.
- Access tokens — deleted immediately on disconnection.
- Customer account records — deleted within 30 days of account closure, except billing records kept as tax law requires.
7. Your rights
Under GDPR you can request access to your data, correction, deletion, restriction of processing, portability, and you can object to processing. Email privacy@shovvly.com and we will respond within 30 days.
You may also lodge a complaint with your national data protection authority.
8. Deleting your data
Customers can disconnect an Instagram account at any time from the dashboard, which deletes the stored token, contacts and message history for that account.
Instagram users can also remove Shovvly from their account in Instagram’s own settings. Instagram then notifies us automatically and we delete the associated data. Either way, see our data deletion page for instructions and to check the status of a request.
9. Security
Data is encrypted in transit (TLS) and at rest. Access tokens are only ever readable by our server-side processes; database row-level security prevents any customer from reading another customer’s data. Webhook deliveries are cryptographically verified before we act on them.
10. Children
Shovvly is not directed at anyone under 18 and we do not knowingly collect their data.
11. Changes
We will update the date at the top of this page when this policy changes and email customers about anything material.
12. Contact
Vexio j. s. a.
[REGISTERED ADDRESS — fill in before launch]
Company number: 54214530
privacy@shovvly.com