GDPR Privacy Notice

Regulation (EU) 2016/679 · Last updated: 2 October 2026

This notice is for people in the European Economic Area, the United Kingdom and Switzerland whose personal data is processed through Yaziio, for example when they comment on or send a message to an Instagram account that uses Yaziio.

Data controller: Tolga Vuranel ("Yaziio", "we"). Contact: [email protected].

In development: What works today is only the public webhook receiver for Meta notifications and this site. The other processing described here (sending replies, AI processing, a management dashboard, automatic deletion, etc.) is planned and will apply once the service goes live.

1. Data we will process (once the service is live)

Instagram-scoped user ID and username; comment and message content, timestamps and interactions (such as button taps); replies sent by Yaziio; conversation state and tags; and, for account owners, the connected account's ID and an access token (to be stored encrypted). Today, only the notifications Meta sends to our webhook are received and stored as raw event records.

2. Purposes and legal bases (Art. 6), once the service is live

Replying to your comment or message and routing it to the right answer — performance of a request you made / steps prior to entering a contract (Art. 6(1)(b)) and our legitimate interest in running a responsive service (Art. 6(1)(f)),
Security, abuse prevention and debugging — legitimate interests (Art. 6(1)(f)),
Anonymous content-idea analysis (themes only, no personal data) — legitimate interests (Art. 6(1)(f)),
Legal obligations — Art. 6(1)(c).

Where consent is needed, we ask for it and you can withdraw it at any time.

3. Recipients and international transfers

Once the service is live: Meta Platforms (Instagram) to send and receive messages (today we only receive notifications from Meta); Anthropic (AI model provider, United States) to generate replies and classify messages (planned; no data is sent to Anthropic today); and infrastructure providers needed to operate the service. Transfers outside the EEA/UK rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy mechanism, where required.

4. Retention

Conversation and comment content: default target of 180 days, then deleted or anonymized. Automatic deletion/anonymization will be added when the application goes live; today there is no automatic deletion and deletion requests are handled by email. Access tokens: until the connection is removed.

5. Automated processing

Once reply generation is live, replies may be drafted by an AI model. We do not take decisions that produce legal or similarly significant effects solely by automated means. You can ask for a human at any time, and conversations that cannot be answered reliably are handed to a human. See the AI Disclosure.

6. Your rights (Arts. 15–22)

You have the right of access, rectification, erasure, restriction, data portability and objection, and the right not to be subject to solely automated decisions with significant effects. To exercise them, write to [email protected] with your Instagram username; we respond within one month. You may also lodge a complaint with your local supervisory authority. See Data Deletion.

7. EU/UK representative and DPO

We are not required to appoint a Data Protection Officer. Questions may be sent to the contact address above.