Privacy Policy

Last updated: 2 October 2026

Yaziio is an AI-assisted messaging and sales application that aims to reply to comments and direct messages received by Instagram professional accounts, and it is under development. This policy explains what data we will process once the service goes live and why, and what rights you have. See also our GDPR Privacy Notice and the KVKK Notice.

Data controller: Tolga Vuranel ("Yaziio", "we"). Contact: [email protected].

In development: What works today is only the public webhook receiver for Meta notifications and this site. The other processing described here (sending replies, AI processing, a management dashboard, automatic deletion, etc.) is planned and will apply once the service goes live.

1. What data we will process

Today the only data processed is the notifications Meta sends to our webhook address (a raw event record that, depending on the notification type, may contain a user ID or comment/message text). Once the service goes live, the following data will be processed.

Account owner (the person using Yaziio):

The connected Instagram professional account's ID, username and profile information,
The access token issued by Instagram (will be stored encrypted; we never ask for or see your Instagram password),
Rules, message templates and settings you configure.

People who comment on or message the account:

Instagram-scoped user ID (IGSID) and username,
Comment and message text, timestamps, and interactions such as button taps,
Replies sent by Yaziio, conversation state and tags added by the account owner.

We do not aim to collect sensitive data. If someone shares such information in a message, it is stored only as part of the conversation.

2. Why we plan to use it

The following purposes will apply once the service goes live; today only incoming notifications are stored.

To reply to comments and messages on behalf of the account owner,
To classify incoming messages (training, events, support, sales, etc.) and route them to the right reply,
To show conversation history to the account owner and hand conversations over to a human when needed,
To give the account owner content ideas as general themes that contain no personal information,
Security, abuse prevention and debugging.

We do not use data to build advertising profiles and we do not sell it.

3. AI processing (planned)

Once reply generation goes live, some messages will be sent to Anthropic's AI model (Claude) to draft a reply and to determine the topic of a message. Today no message is sent to an AI model. See the AI Disclosure page.

4. Who we will share data with

Meta Platforms (Instagram): to receive notifications of comments and messages (today) and to send replies (planned),
Anthropic (planned): for AI reply generation and classification, once the service goes live,
Infrastructure providers: network and hosting services used to operate Yaziio securely.

Your data is not sold. It is not shared with other third parties unless legally required.

5. Retention

Our default target is 180 days: conversation and comment content will be deleted or irreversibly anonymized after 180 days. Automatic deletion/anonymization will be added when the application goes live; today there is no automatic deletion and deletion requests are handled by email. The access token will be kept until the account connection is removed. You may ask us to delete data earlier.

6. Security

Working today: notifications from Meta are verified with X-Hub-Signature-256 signature validation (requests with an invalid signature are rejected); the site is served over HTTPS with security headers. Planned: access tokens will be stored encrypted; a management dashboard is planned and will not be exposed to the public internet, only reachable from authorised devices.

7. Your rights and deletion requests

You have the right to access, correct, delete your data, to object to processing, and to know who it was shared with. To request deletion, follow the steps on the Data Deletion page or write to [email protected]. Once account connection goes live, you will also be able to remove Yaziio's access to your Instagram account at any time under Settings > Apps and websites.

8. Children

The service is not directed to anyone under 13. If we learn that we hold data of a child under this age, we delete it.

9. Changes

We may update this policy. Material changes will be announced on this page and the date above will change.