Privacy Policy

Speddle (“Speddle,” “we,” “us”) operates the Speddle website and app. We help you connect an Instagram Business or Creator account, watch comments on your content, send private replies you configure, and capture those people as leads.

Questions: privacy@speddle.com.

• Customers: people who create a Speddle account and connect Instagram.
• End users: people who comment on or message a connected Instagram account. We process their public comment and Instagram identity so we can reply and, if you turn lead capture on, save them as a lead in your workspace.

Account information. Email address, password (stored hashed by our auth provider), name and avatar if you sign in with Google, and workspace details you enter during onboarding.

Instagram account information (only after you connect Instagram): Instagram user ID, username, display name, profile picture URL, granted permissions, token expiry, and an encrypted access token so we can act on your behalf.

Instagram activity we process to run your flows: comment ID, comment text, commenter Instagram user ID and username, related media ID, and the private reply we send (including delivery success or failure).

Leads and inbox records created from that activity: commenter identity, first/last interaction times, lead status you set, and a timeline of comment → trigger → message sent or failed.

Automation configuration you create: flow name, keywords, match type, message templates, and optional links.

Technical data: cookies needed to keep you signed in, a selected-account cookie in the dashboard, IP address, browser type, and server logs used for security and debugging.

When you connect Instagram we request only the permissions needed to provide the product:

• instagram_business_basic — Read your Instagram Business or Creator profile so we can connect the right account.
• instagram_business_manage_comments — Read comments on your media so we can match keywords and start a conversation.
• instagram_business_manage_messages — Send a private reply or DM on your behalf when a comment matches a flow you configured.

We do not request access to your Instagram password, friends list, or permission to post on your feed.

• Create and authenticate your Speddle account.
• Connect, keep, and refresh your Instagram Business or Creator account.
• Match comments against the keywords in your active flows.
• Send the private reply or DM you configured.
• Capture and show leads, inbox activity, and basic analytics in your workspace.
• Secure the service, prevent abuse, and debug failures.
• Respond to support, privacy, and deletion requests.

We use Instagram / Meta platform data only to provide these features to the customer who connected the account. We do not sell personal data. We do not use Instagram platform data to build independent advertising profiles, and we do not train public AI models on your DMs or comments.

We share data only as needed to run the product:

• Meta / Instagram: to complete login, read comments you authorized, and send private replies.
• Infrastructure providers: currently Supabase (database, authentication, file/session storage) and our app host. They process data on our instructions.
• Google: if you choose “Continue with Google,” Google provides your email and basic profile to sign you in.
• Your workspace members: owners, admins, and members of your Speddle workspace can see connected account metadata, flows, leads, and inbox events for that workspace.
• Legal and safety: if required by law, to protect rights and safety, or in connection with a merger or sale of the business (with notice where required).

We do not sell, rent, or share Instagram platform data with third parties for their own marketing.

We use essential cookies to keep you logged in (via our auth provider) and to remember which Instagram account is selected in the dashboard. We do not currently use advertising cookies or cross-site trackers.

• Account and workspace data: kept while your account is open.
• Instagram access tokens: kept encrypted while the account stays connected; removed when you disconnect, delete the workspace, or we receive a valid Meta data-deletion request.
• Comments, events, and leads: kept while the connected account and workspace exist, so you can see history and follow up.
• Server logs: typically kept for a short period unless needed for security or dispute resolution.

When you delete a workspace, we delete its Instagram connections, flows, events, and leads. Residual encrypted backups are purged on a rolling backup cycle.

You can delete data in any of these ways:

• In Speddle: Settings → Instagram to disconnect an account, or Settings → Workspace to delete the workspace (this removes connected Instagram data for that workspace).
• Email privacy@speddle.com from the address on your account. Tell us whether you want the Instagram connection removed, specific leads removed, or the entire Speddle account deleted.
• Instagram / Facebook users can also use Meta’s Apps and Websites controls. We honor those requests through our data deletion process.

We aim to complete deletion requests within 30 days. If you commented on a creator’s post and want that lead record removed, email us with your Instagram username and, if you know it, the creator’s username.

Full instructions: Data deletion. How we handle Instagram platform data: Data Policy.

Instagram access tokens are encrypted at rest before storage and are not exposed to the browser. Access to customer workspaces is restricted by account authentication and row-level security in our database. No method of transmission or storage is 100% secure.

Speddle is for businesses and creators. It is not directed at children under 13 (or the minimum age in your country), and we do not knowingly collect personal data from children.

We may process data in the country where our infrastructure is hosted and where our team operates. If you access Speddle from another country, you understand that your information may be transferred to those locations with appropriate safeguards.

Depending on where you live, you may have rights to access, correct, export, or delete personal data, or to object to certain processing. Email privacy@speddle.com to exercise those rights. You may also have the right to lodge a complaint with a data protection authority.

We may update this policy as the product changes. The effective date at the top will change when we do. Material changes will be posted on this page.

Privacy: privacy@speddle.com
Support: hello@speddle.com