1. What this is about
Sellers on Kwudo can connect their Instagram professional account and choose a keyword. When someone comments that keyword on one of their posts, Kwudo answers the comment and sends the commenter one private message with the link the seller chose. Messages sent this way end with “Automated via Kwudo · Privacy”, which links to this page.
2. Who is responsible
For commenters' data, the seller who runs the automation is the controller. Kwudo processes that data on the seller's behalf, only to send what the seller set up.
The seller is the Instagram account that sent you the message. The privacy link at the end of that message opens this page with the seller's name and contact details at the top, and a form to write to them.
For the data of sellers who connect Instagram, the controller is the provider, as named with full address in our Impressum.
3. If you commented on a seller's post
When someone comments on a connected post, Meta, which runs Instagram, sends Kwudo the comment text, the comment's id, and the commenter's Instagram id and username.
- If the comment does not contain the seller's keyword, Kwudo stores neither the comment nor anything about who wrote it.
- If it does, Kwudo keeps which keyword matched and when the comment was made and handled. It never keeps your username or the comment text.
- The comment's id is kept only until the reply and the message have been sent.
- Kwudo keeps a keyed hash of the comment's id, so the same comment is not answered twice. If a private message was sent, it also keeps a pseudonymous keyed hash of your Instagram id, so you get only one message for that post. Both are erased after 30 days; after that, or once you delete them, a repeat is possible.
- For each reply and message, Kwudo records whether it was a public reply or a private message, whether it was sent, and Meta's error code if it failed.
- The seller sees counts, such as how many comments matched and how many messages were sent, never who commented. The counts stay after the rest is erased.
Legal basis: the seller's legitimate interest in answering a comment that asked for their link (Art. 6(1)(f) GDPR).
To erase at once the comment's id and the hash of your Instagram id, open the privacy link at the end of the message you received. It opens this page with a delete button and works without an account. What stays (which keyword matched, the times, and whether the reply and message were sent) keeps the seller's counts right. The hash of the comment's id stays until its 30 days are up, so a late copy of the comment from Meta is not answered again.
If you write to the seller with the form at the top of this page, Kwudo emails your message to them, with your email address so they can reply. Kwudo keeps no copy. Our email provider, Resend, keeps the message and its delivery records for 30 days, on servers in the United States. Legal basis: the seller's legitimate interest in answering people who write to them (Art. 6(1)(f) GDPR).
4. If you are a seller who connects Instagram
When you connect, Kwudo stores your Instagram account id and username, the id Meta assigns you for Kwudo, the permissions you granted, when access expires, the connection's status and the access token. Only the access token is stored encrypted. Kwudo also stores what you set up: the post link, keywords and the texts of the reply and the message.
Kwudo uses this only to run your automations and show you their counts. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
If you disconnect in Kwudo, or remove Kwudo in Instagram under Settings, Apps and websites, your automations stop and Kwudo deletes at once the access token, your username, the permissions and when access expires. It keeps your Instagram account id, the id Meta assigns you for Kwudo and what you set up, so you can reconnect without starting again and a later deletion request from Meta still finds your account. These stay until your Kwudo account is deleted.
If you ask Meta to have Kwudo delete your data, Kwudo also deletes those Instagram account identifiers and erases the records of the comments your automations answered; their counts stay, with nothing that identifies anyone. What you set up stays until you delete it, and your Kwudo account is deleted only if you ask for that separately. How to do either, or to have the identifiers deleted sooner, is on the data deletion page.
5. Who else handles the data
- Meta Platforms Ireland runs Instagram and delivers the comments, replies and messages. What Instagram itself does with them is covered by Meta's privacy policy.
- Google Cloud hosts Kwudo's database and its backups in the Netherlands (region europe-west4). Backups are deleted after 30 days.
- Resend delivers the messages you write to a seller from this page. It keeps each message and its delivery records for 30 days, on servers in the United States.
Some of these providers are based in, or use companies in, countries outside the EU, including the United States. Where data leaves the EU, the transfer relies on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified companies, or on the Commission's standard contractual clauses (Art. 45 and 46 GDPR).
6. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), and to object to processing based on legitimate interests (Art. 21). If you are a seller, for personal data you provided to Kwudo and that we process automatically under our contract with you, you may also have the right to receive it in a portable format (Art. 20).
If you commented, the seller is responsible for your data, so you can make these requests to them. You can also contact us. We will help the seller handle your request. The seller must respond within the period required by the GDPR, normally one month. Sellers can contact us directly. The delete button needs nobody's help.
You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the infringement happened (Art. 77 GDPR).
7. Changes to this notice
We update this notice when what we do with this data changes. The date at the top shows the current version. Our general privacy policy covers the rest of kwudo.com.