GDPR Privacy Notice

Regulation (EU) 2016/679 · Last updated: 2 October 2026

This notice is for people in the European Economic Area, the United Kingdom and Switzerland whose personal data is processed through Yaziio, for example when they comment on or send a message to an Instagram account that uses Yaziio.

Data controller: Tolga Vuranel ("Yaziio", "we"). Contact: [email protected].

1. Data we process

Instagram-scoped user ID and username; comment and message content, timestamps and interactions (such as button taps); replies sent by Yaziio; conversation state and tags; and, for account owners, the connected account's ID and an encrypted access token.

2. Purposes and legal bases (Art. 6)

• Replying to your comment or message and routing it to the right answer — performance of a request you made / steps prior to entering a contract (Art. 6(1)(b)) and our legitimate interest in running a responsive service (Art. 6(1)(f)),
• Security, abuse prevention and debugging — legitimate interests (Art. 6(1)(f)),
• Anonymous content-idea analysis (themes only, no personal data) — legitimate interests (Art. 6(1)(f)),
• Legal obligations — Art. 6(1)(c).

Where consent is needed, we ask for it and you can withdraw it at any time.

3. Recipients and international transfers

Meta Platforms (Instagram) to send and receive messages; Anthropic (AI model provider, United States) to generate replies and classify messages; and infrastructure providers needed to operate the service. Transfers outside the EEA/UK rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy mechanism, where required.

4. Retention

Conversation and comment content: 180 days by default, then deleted or anonymized. Access tokens: until the connection is removed.

5. Automated processing

Replies may be drafted by an AI model. We do not take decisions that produce legal or similarly significant effects solely by automated means. You can ask for a human at any time, and conversations that cannot be answered reliably are handed to a human. See the AI Disclosure.

6. Your rights (Arts. 15–22)

You have the right of access, rectification, erasure, restriction, data portability and objection, and the right not to be subject to solely automated decisions with significant effects. To exercise them, write to [email protected] with your Instagram username; we respond within one month. You may also lodge a complaint with your local supervisory authority. See Data Deletion.

7. EU/UK representative and DPO

We are not required to appoint a Data Protection Officer. Questions may be sent to the contact address above.