Privacy Policy

1. Who we are

Snug AI is an Instagram message operations tool operated by Oprova AI Co., Ltd. (13 Seohyeon-ro 180beon-gil, Bundang-gu, Seongnam 13590, South Korea). It lets a business read and reply to the direct messages sent to its own Instagram professional account from a single shared inbox. This policy explains what data we handle and how you can have it deleted.

For questions about this policy, contact mason@oprova.ai.

2. Data we collect

We collect only what the product needs in order to work.

• Operator account data. The email address used to sign in to the Snug AI dashboard.
• Connected Instagram account data. When a business connects its Instagram professional account, we receive and store its Instagram user id, username, display name, account type, and profile picture URL, plus the access token issued by Meta.
• Message data. For conversations with the connected account we store the message text, direction (received or sent), timestamps, the Instagram message id, and the raw webhook payload delivered by Meta.
• Message participant data. For each person messaging the business we store their Instagram user id and, when Meta provides it, their username, display name, and profile picture URL.

We do not collect payment details, government identifiers, precise location, or any special-category personal data. We do not use tracking cookies or third-party advertising or analytics trackers.

3. Permissions we request and why

• instagram_business_basic — to identify the Instagram professional account that has been connected and show it in the dashboard.
• instagram_business_manage_messages — to receive direct messages sent to the connected account and to send the operator's replies back to the person who messaged. Replies written more than 24 hours after the customer's message are sent with Meta's human_agent tag, which applies because a person, not an automated system, writes them.

These permissions are used solely to deliver the inbox features described above. We never use them to access accounts other than the ones a business has explicitly connected.

4. How we use the data

Data is used to display the business's Instagram conversations in the dashboard, to deliver replies written by the business's operators, and to keep the connection to Meta working. We do not sell personal data, we do not share it with advertisers or data brokers, and we do not use message content to train machine learning models.

5. Sharing and processors

Data is shared only with Meta Platforms, Inc. in the course of calling the Instagram Graph API on the business's behalf, and with the infrastructure providers that host the service. Providers process data solely on our instructions. We may disclose data if legally required to do so.

6. Storage, retention, and security

Data is stored in a PostgreSQL database. Instagram access tokens are encrypted at rest with AES-256-GCM before being written to the database, and all traffic to our API is served over HTTPS. Incoming webhooks from Meta are verified against the app secret signature before they are processed.

Message and conversation data is retained while the Instagram account remains connected. When an account is disconnected, or when a deletion request is received, the associated Instagram account, conversations, and messages are removed as described in the next section.

7. Your rights and deleting your data

You can request access to, correction of, or deletion of your data at any time. Full instructions, including the automated Meta data deletion flow, are on our data deletion page. You may also email mason@oprova.ai.

8. Children

Snug AI is a business tool and is not directed at children. We do not knowingly collect data from anyone under 14.

9. Changes to this policy

If we change this policy we will update the date at the top of this page. Where the change is significant we will notify connected businesses by email.