Privacy Policy

Coldopen helps creators and small brands manage their own Instagram professional accounts: reading direct messages and comments, drafting replies with AI, and sending replies the account owner allows. This page explains what we store and why.

Coldopen is a product of ALTURA Society LLC. ALTURA Society LLC is the data controller for the personal data described on this page.

What we store

• Profile basics: your Instagram account ID, username, and profile picture link.
• Access tokens: the token Instagram gives us when you connect. It is readable only by our server, never by a browser or phone.
• Messages: direct messages sent to and from your connected account, with the sender's Instagram ID and username.
• Comments: comments on your own posts, with the commenter's Instagram ID and username.
• Your account: the email you sign in with, your brand settings, and the drafts you create.

Why

• To show you your Instagram inbox and comments in one place.
• To draft replies in your brand's voice for you to review. Auto-send is coming soon. Sensitive messages (complaints, billing, money, legal, health, spam) are always held for you.
• To send the single private reply someone asked for when they comment a keyword you published.
• To show you reply rates and other stats about your own account.

How long

• Messages and comments are kept while your account is connected, so your inbox history works.
• When you disconnect in Settings or remove Coldopen in Instagram, your token is deleted right away.
• When you or Meta request deletion, your account record, token, messages, and comments are deleted immediately. Backups roll off within 30 days.

Who we share it with

We do not sell your data or show ads. Only these service providers process data on our behalf:

• Supabase: database and hosting, via Lovable Cloud.
• Lovable: app hosting.
• OpenAI: drafting replies.

Requests from public authorities

ALTURA Society LLC reviews every request for user data from a public authority to confirm it is legal before responding. We disclose only the minimum data necessary. We document every request, our response and the reasoning behind it.

Security

Data is encrypted at rest and in transit. Every row is scoped to the account owner, and tokens are never exposed to the browser.

Your choices

You can disconnect at any time. To delete your data, follow the steps on our data deletion page.

Contact

Contact Coldopen at support@usecoldopen.com.