Privacy Policy

Who We Are

Quotsta is operated by Quotsta. For any question about this policy or your data, contact [email protected].

Data We Collect

When you create an account and use Quotsta, we collect:

• Your email address, used to sign in via magic link.
• Workspace and billing metadata.
• Your connected Instagram professional account identifier and an encrypted Instagram access token, obtained through Instagram Login.
• Campaign settings you configure: the selected reel (referenced by its Instagram media ID, plus a cached thumbnail/caption for display in your dashboard), the trigger type (comment or share to DM), your custom automated reply message, and up to three randomized reply comments.
• Comment and DM webhook payloads from Meta needed to detect triggers and send replies.
• DM Log entries for each triggered send: the commenter's Instagram username, the triggering comment text, the campaign, the connected Instagram account, delivery status, and the time it was sent.
• Operational and error diagnostics needed to keep the service reliable.

How We Use Data

We use this data to authenticate you, connect your Instagram account, match comments and shares against your campaign triggers, send private replies through the official Meta APIs, show you the DM Log, enforce plan limits, process billing, prevent duplicate sends, troubleshoot failures, and protect the service from abuse.

Instagram And Meta Data

Quotsta does not ask for your Instagram password, does not scrape Instagram, and does not use browser automation. We connect exclusively through Instagram Login and the official Meta APIs. Instagram access tokens are encrypted at rest and are used only to perform the actions you've authorized: reading comments and share-to-DM events on your connected reels, and sending the private replies your campaigns are configured to send.

Subprocessors

The production service may use hosting, database, Redis queue, email, billing, and observability providers such as Vercel, Railway, PostgreSQL, Redis, Resend, and Stripe. These providers process data only as needed to run the service.

Retention And Deletion

Disconnecting Instagram from Settings immediately and permanently deletes the stored Instagram connection, that workspace's campaigns, comment/DM webhook data, and DM Log entries from our database — this happens synchronously, not on a delay. Campaigns also stop sending replies the moment you disconnect.

Account, workspace, billing, and operational diagnostic data not tied to a disconnect action is retained until you delete your account, unless we're required to keep it longer for legal, billing, fraud-prevention, or security reasons. See the Data Deletion page for how to request full account deletion.

Children

Quotsta is not directed at children and is not intended for use by anyone under the minimum age required to hold an Instagram account under Meta's own terms. We do not knowingly collect data from children.

Contact

For privacy questions or requests, contact [email protected].