Privacy Policy

1. Introduction

Welcome to Northbeam Technology Pvt Ltd. ("we", "our", "us"). We operate the website https://buzzlee.club (the "Service"). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Service, sign up for an account, or use any of our products — including Automation, Inbox, Content Studio, and Insights.

2. Definitions

• Service: Refers to the website and any related applications, features, or services provided by Buzzlee, including but not limited to comment automation workflows, direct message management, content publishing, and analytics dashboards.
• Personal Data: Any information relating to an identified or identifiable individual.
• Usage Data: Data collected automatically through the Service (e.g., cookies, server logs).
• User: An individual who visits or uses the Service, either as a guest or a registered account holder.
• Instagram Account: A Business or Creator Instagram account that a User connects to Buzzlee via Meta's Instagram API.
• Workflow: An automated rule configured by the User that triggers actions (such as sending a direct message) based on events on their Instagram account (such as receiving a comment).

3. Information We Collect

We collect two types of information:

3.1. Personal Data (Provided Directly by You)

Account Information: When you sign up or log in to Buzzlee, we may collect:

• Full name
• Email address
• Display name
• Password (hashed with bcrypt — we never store your password in plain text)
• Timezone and language preferences

3.2. Instagram Data (Collected via Meta APIs When You Connect Your Account)

When you connect your Instagram Business or Creator account to Buzzlee through Meta's Instagram Login OAuth flow, we request and collect data under the following permissions:

a) Basic Account Information (instagram_business_basic)

• Instagram user ID
• Instagram username (handle)
• Account type (Business or Creator)
• Follower count and media count
• Profile picture URL

b) Comment Data (instagram_business_manage_comments)

• Comments posted on your Instagram content, received via real-time webhooks
• Comment text, author username, author Instagram user ID
• Parent comment relationships (threaded comment structure)
• Associated media/post identifiers
• Comment timestamps

We collect this data to power your automation workflows — for example, detecting keyword matches in comments to trigger automated direct messages or replies.

c) Direct Message & Conversation Data (instagram_business_manage_messages)

• Incoming and outgoing direct messages on your Instagram account
• Message text, sender and recipient identifiers, timestamps
• Message delivery and read status
• Conversation metadata (participant usernames, names, profile pictures)
• Ice breaker questions and responses you configure
• Message templates you create within Buzzlee

We collect this data to enable your Inbox product — allowing you to view, manage, search, and respond to Instagram conversations directly within Buzzlee, as well as to send automated direct messages triggered by your workflows and DM sequences.

d) Content & Publishing Data (instagram_business_content_publish)

• Media you upload through Buzzlee's Content Studio (images, videos, carousels, reels, stories)
• Post captions, location tags, user tags, collaborator lists, alt text, cover images
• Scheduling metadata (scheduled publish time, status: draft, scheduled, publishing, published, failed)
• Published post permalink and Instagram media ID

We collect and process this data to enable you to create, draft, schedule, and publish Instagram content directly from Buzzlee.

e) Analytics & Insights Data (instagram_business_manage_insights)

• Account-level metrics: followers, reach, impressions, accounts engaged, total interactions, profile views, website clicks, follows and unfollows
• Engagement metrics: likes, comments, shares, saves, replies
• Audience demographics: age ranges, gender distribution, top countries, top cities — for both your followers and engaged audience
• Per-post/media metrics: reach, likes, comments, shares, saves, plays, average watch time, total watch time
• Calculated performance metrics: engagement rate, reach rate, virality rate, save rate, follower growth rate

We collect this data to power your Insights dashboard — providing you with historical analytics, audience breakdowns, content performance rankings, and trend comparisons across different time periods.

3.3. Usage Data (Collected Automatically)

• Cookies & Authentication Tokens: We use cookies solely for authentication (to keep you logged in). These cookies do NOT track you for advertising or third-party analytics.
• Server Logs: Whenever you visit our Service, our servers automatically record your pages viewed, referral source, and time/date stamps.

4. How We Use Your Information

• Provision of Services: To allow you to create and maintain your account, connect your Instagram profile, configure and run automation workflows, manage your inbox and conversations, publish and schedule content, and view analytics for your account and posts.
• Automation & Workflows: To evaluate incoming comments and messages against your configured workflow rules, trigger actions (such as sending direct messages, replying to comments, or liking comments), and log workflow activity for your review.
• Messaging: To send direct messages on your behalf — both automated messages triggered by workflows and DM sequences, and manual messages you compose through the Inbox — and to display your conversation history.
• Content Publishing: To create, schedule, and publish Instagram posts, reels, stories, and carousels on your behalf at the times you specify, and to track publishing status and outcomes.
• Analytics: To retrieve, calculate, store, and display Instagram account and content performance metrics, audience demographics, and historical trend data on your Insights dashboard.
• Customer Support: To respond to your inquiries, requests, and provide technical assistance.
• Billing & Payments: To process your in-app purchases (via Razorpay). We store only the minimum details required to validate and complete transactions (e.g., email, order ID); actual card details are managed by Razorpay.
• Security: To detect and prevent fraudulent activity, unauthorized access, and outages. This includes validating webhook signatures, encrypting access tokens, and enforcing creator data isolation.
• Legal Compliance: To comply with applicable laws (e.g., responding to lawful requests by public authorities, courts, or government agencies).

5. Automated Processing & Actions on Your Behalf

When you configure workflows, DM sequences, or schedule content on Buzzlee, our system performs automated actions on your Instagram account on your behalf. Specifically:

• Automated Direct Messages: When a comment on your post matches your workflow's keyword rules, Buzzlee automatically sends a direct message to the commenter using your Instagram account. You control the message content, keywords, and conditions.
• Automated Comment Replies & Likes: Based on your workflow configuration, Buzzlee may reply to or like comments on your posts automatically.
• DM Sequences: Buzzlee sends a series of direct messages to enrolled users over time, with configurable delays between each step, on your behalf.
• Scheduled Content Publishing: Buzzlee publishes your pre-created content (posts, reels, stories, carousels) at the date and time you specify.

All automated actions are initiated only based on rules and schedules you explicitly configure. You can pause, modify, or delete any automation at any time. Buzzlee logs all automated actions so you can review what was sent and when.

6. Disclosure of Your Information

• Service Providers: We may share your Personal Data with third parties who perform services on our behalf, such as payment processors (Razorpay), hosting providers, and infrastructure services (e.g., database hosting via Supabase, queue processing via Redis). These parties are contractually bound to keep your information confidential and use it only for the purposes we specify.
• Meta Platform: When you use Buzzlee's features, we interact with Meta's Instagram Graph API on your behalf. This means your content, messages, and other data are transmitted to and from Meta's servers in accordance with Meta's Platform Terms and Data Policy.
• Legal Requirements: We may disclose your information if required by law or in response to valid legal process (e.g., a court order, subpoena).
• Business Transfers: If Buzzlee merges with or is acquired by another company, your information may be transferred to the new entity, subject to this Privacy Policy.
• Aggregate & Anonymized Data: We may share aggregated, non-identifying information with partners or other third parties for research and analytics.

We do NOT sell your Personal Data or Instagram data to any third party.

7. Cookies and Similar Technologies

We use only essential cookies for authentication. You can disable cookies in your browser settings, but note that doing so may prevent you from logging in or accessing certain features.

8. Security of Your Data

We implement reasonable administrative, technical, and physical safeguards to protect your information, including:

• Encryption of Instagram access tokens using AES-256-CBC before storage
• Password hashing using bcrypt
• JWT-based authentication for all API endpoints
• Webhook signature validation using SHA-256 HMAC to verify authenticity of incoming Instagram events
• Creator data isolation — each user can only access their own data
• CSRF protection on OAuth flows using state tokens

However, no method of transmission or storage is 100% secure. Use strong passwords and notify us immediately if you suspect any unauthorized access.

9. Data Retention

We retain your Personal Data and Instagram data only as long as necessary to fulfill the purposes outlined in this Privacy Policy. Specifically:

• Account and profile data: Retained while your account is active.
• Instagram data (comments, messages, insights, content): Retained while your Instagram account is connected and your Buzzlee account is active, to provide analytics history and workflow logging.
• Workflow logs: Retained for the duration of your account for auditing and review purposes.
• Published content metadata: Retained while your account is active to display publishing history.

If you disconnect your Instagram account, we stop collecting new data from that account. Previously collected data remains available until you request deletion.

If you request account deletion, we will remove your data after a 30-day grace period (see Section 10 below). Backups and logs may persist in encrypted form for up to an additional 60 days for disaster recovery, but they will not be accessible for any analytics or business purposes beyond that.

10. Your Data Deletion Rights

You have the right to delete your account and all associated data. To initiate deletion, navigate to your profile settings and click "Delete My Data." After you confirm, we will:

1. Deactivate your account immediately (you won't be able to log in).
2. Pause all active workflows and scheduled posts.
3. Hold your data in a "deletion pending" state for 30 days (to allow you to change your mind).
4. After 30 days, permanently delete all your Personal Data, Instagram data, workflow configurations, message history, analytics records, and content metadata from our active systems.
5. Remove your Personal Data from our backups within 60 days from the deletion request.
6. Revoke any stored Instagram access tokens.

11. Instagram Platform Compliance

Our use of Instagram data is governed by Meta's Platform Terms and Instagram API Terms of Use. We:

• Only request permissions necessary for the features you use.
• Do not sell Instagram data to third parties.
• Do not use Instagram data for surveillance or to build independent user profiles beyond what is needed to provide our Service.
• Respect Instagram's rate limits and messaging window policies (e.g., the 24-hour messaging window for direct messages).
• Provide clear mechanisms for you to disconnect your Instagram account and delete associated data at any time.

12. Third-Party Links

Our Service may contain links to third-party websites (e.g., Razorpay payment pages, Meta documentation). We are not responsible for the privacy practices or content of those sites. We encourage you to review their privacy policies before providing any Personal Data.

13. Children's Privacy

Our Service is not intended for anyone under the age of 13. We do not knowingly collect Personal Data from children under 13. If you believe we have collected Personal Data of a child under 13, please contact us at team@buzzlee.club, and we will delete that information as soon as possible.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When changes are significant, we will post a prominent notice on our website or send you an email (if you have an active account). The "Last updated" date at the top will reflect the effective date of the update.

15. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

• Email: team@buzzlee.club
• Mailing Address: