This Privacy Policy explains how ReplyJet ("ReplyJet", "we", "us", "our"), operated by the registered Serbian sole proprietorship VUK LAKETIĆ PR VL MEDIA, Belgrade, Serbia, and available at replyjet.io, collects, uses, stores and shares personal data when you use our website and the ReplyJet application (together, the "Service"). ReplyJet is a software-as-a-service tool that helps businesses automatically reply to Instagram direct messages and comments using artificial intelligence.
By creating an account or connecting an Instagram account to the Service you agree to the practices described here. If you do not agree, please do not use the Service.
1. Who we are and how to contact us
VUK LAKETIĆ PR VL MEDIA (trading as ReplyJet), Belgrade, Serbia, is the data controller for personal data processed through the Service. You can reach us at info@vlmedia.rs. For requests relating to data access, correction or deletion, see Section 9 and our Data Deletion Instructions.
2. Data we collect
2.1 Account data you give us
- Email address and password (passwords are hashed by our authentication provider, Supabase, and are never visible to us).
- Optional name and business type.
- Your notification and bot preferences and the reply templates you create.
2.2 Instagram data (via the Meta / Instagram Platform)
When you connect an Instagram professional account through Instagram Login, and only with your explicit authorization, we receive:
- Basic profile data (permission
instagram_business_basic): your Instagram user ID, username, account name, account type and profile picture URL. - Direct messages (permission
instagram_business_manage_messages): the text of messages sent to your account, the Instagram-scoped ID and, where available, the username of the sender, timestamps, and the replies we send on your behalf. During onboarding we may read your recent conversations once to suggest reply templates. - Comments (permission
instagram_business_manage_comments): the text of comments on your posts, the commenter's ID and username, the media ID, and the replies we send. - An access token that allows the Service to act on your behalf. Tokens are stored encrypted at rest and are never shared.
2.3 Data generated by the Service
- Intent classification results (category, confidence score, short reasoning) for each incoming message.
- A log of automatic replies (recipient, template used, time, delivery status) and monthly usage counters.
- Raw webhook deliveries from Meta, kept for debugging and abuse prevention.
2.4 Technical data
- Server logs (IP address, browser type, request time) kept for security and reliability.
- Strictly necessary cookies used to keep you signed in. We do not use advertising cookies.
3. How we use data
- To provide the core Service: receive messages and comments, detect their intent, and send the reply you configured.
- To show you an inbox of messages the bot did not answer, statistics and a log of sent replies.
- To suggest reply templates during onboarding based on the questions your customers actually ask.
- To notify you by email about unanswered messages, usage limits and connection problems, according to your settings.
- To secure the Service, prevent abuse, and comply with legal obligations and Meta Platform Terms.
We do not sell personal data, do not use Instagram data for advertising, do not build profiles of your customers, and do not use message content to train our own or third-party machine learning models.
4. Automated processing and AI
Incoming message and comment text is sent to OpenAI (GPT-4o-mini) solely to classify the sender's intent and, when you request it, to generate template suggestions. Under our agreement with OpenAI, data sent via the API is not used to train OpenAI models. Replies sent by the Service are the templates you wrote or approved; the AI does not compose free-form replies to your customers. If the AI is not confident (below the configured threshold) or detects a complaint, no automatic reply is sent and the message is routed to you.
5. Legal bases (GDPR / Serbian Personal Data Protection Act)
- Contract — processing needed to provide the Service you signed up for.
- Consent — connecting your Instagram account and granting the permissions listed above; you can withdraw it at any time.
- Legitimate interests — security, abuse prevention, service improvement, provided these do not override your rights.
- Legal obligation — record keeping required by law.
Where you use the Service to process messages from your own customers, you are the controller of that data and ReplyJet acts as your processor under these terms. You are responsible for informing your customers that automated replies may be used.
6. Sharing and sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Meta Platforms (Instagram Graph API) | Receiving and sending messages/comments | USA / EU |
| Supabase | Authentication and database hosting | EU (Frankfurt) or USA, per project region |
| OpenAI | Intent classification and template suggestions | USA |
| Railway / Vercel | Application hosting | EU / USA |
| Resend | Transactional email | USA |
We share data with these providers only to the extent needed to run the Service, under data-processing agreements. We may also disclose data if required by law or to protect our rights, and in connection with a merger or acquisition (you will be notified).
7. International transfers
Some providers are located outside Serbia and the EEA. Transfers are protected by Standard Contractual Clauses or equivalent safeguards.
8. Retention
- Account data: for as long as your account exists.
- Instagram access tokens: until you disconnect the account, revoke access on Instagram, or delete your account — then deleted immediately.
- Messages, comments, classification results and reply logs: 12 months, then deleted or anonymised, unless you delete them earlier.
- Raw webhook logs: 30 days.
- Server logs: 90 days.
When you delete your account, all of the above is permanently erased within 30 days (backups within 90 days).
9. Your rights
You may request access, correction, deletion, restriction, portability of your data, and object to processing based on legitimate interests. You can also withdraw consent by disconnecting your Instagram account (Settings → Instagram connection → Disconnect) or by removing ReplyJet from your Instagram account's connected apps. To exercise any right, email info@vlmedia.rs or follow the Data Deletion Instructions. We respond within 30 days. You may lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection or your local supervisory authority.
10. Security
We use TLS for all traffic, encrypted storage, row-level access control in the database, signed webhook verification, and least-privilege access for staff. No system is perfectly secure; if a breach affecting you occurs we will notify you and the authorities as required by law.
11. Children
The Service is intended for businesses and is not directed at persons under 18. We do not knowingly collect data from minors.
12. Meta Platform compliance
Our use of Instagram data complies with the Meta Platform Terms and Developer Policies. Data received from Instagram is used only to provide the features described here, is not sold, and is deleted when you disconnect or when Meta instructs us to. Meta may also send us a data-deletion request on your behalf; we honour it automatically.
13. Changes
We may update this policy. Material changes will be announced by email or in the app at least 14 days before they take effect. The "Last updated" date shows the current version.