Privacy policy.

This policy covers the Meta apps and integrations built and operated by Kuisytihar Digital Hub (SSM registration 202403000557, JM0997416-U), a sole proprietorship in Kedah, Malaysia. It applies to apps that connect to Instagram and Threads through the official Meta APIs.

It was last updated on 13 October 2026. A dated note is added below whenever the policy changes.

Who this policy covers

Two groups of people interact with our Meta apps:

• Account holders — the business or individual who authorises our app to act on their Instagram or Threads account. The app is currently used to manage accounts operated by Kuisytihar Digital Hub and its clients.
• People who interact with those accounts — anyone who comments on a post, mentions the account, or sends a message that our app processes so the account holder can reply.

What data we collect

We collect only what the Meta APIs deliver to us and what is needed to operate the integration:

• Account credentials and identifiers — the Instagram or Threads account ID, username, and the access token Meta issues when an account holder authorises the app. Tokens are stored encrypted and are used only to perform actions the account holder has authorised.
• Content delivered by Meta webhooks — the text of a comment or mention, the comment ID, the ID of the post it belongs to, and the commenter's public username and account ID.
• Processing records — what our system decided to do with a comment (whether it was answered, skipped, or flagged), the reply text, timestamps, and error details when something fails.
• Configuration — the campaigns and keywords an account holder sets up, and the reply templates they choose.

We do not collect passwords, we do not ask for login credentials for any platform, and we do not scrape Instagram or Threads. We do not collect payment card details, and we do not run advertising or behavioural tracking pixels on this website.

How we use the data

• To authenticate an account holder and connect their Instagram or Threads account.
• To receive comments and mentions through Meta's webhooks and decide whether a reply is appropriate.
• To send a reply through the official Meta API when one is warranted, and to avoid sending the same reply twice.
• To show the account holder what was sent, and to diagnose failures.

We do not sell data. We do not use it to build advertising audiences, and we do not use it to train machine learning models.

Automated processing and human review

Replies drafted by our system are reviewed and approved by a person before they are published, unless the account holder has explicitly enabled automatic sending for their own account. Decisions are made from the comment text and the configuration the account holder set. No automated decision made by our system affects anyone's access to a service, credit, employment, or any similar right.

Who we share data with

Data is shared only with the service providers required to run the integration:

• Meta Platforms, Inc. — the Instagram and Threads APIs are the source of the data and the destination of any reply we send.
• Hosting and infrastructure providers — the servers and databases that run the app, located in the European Union and Singapore.
• Model inference providers — where a reply is drafted by a language model, the comment text and the account holder's configuration are sent to the inference provider that returns the draft. No account holder credentials are sent.

We disclose data to anyone else only where the law requires it, or where it is necessary to protect the rights and safety of a person.

How long we keep it

• Access tokens — kept while the account holder keeps the integration connected, and deleted when they disconnect it.
• Comment and reply records — kept for up to 12 months so an account holder can review what was sent and so duplicate replies are prevented, then deleted.
• Webhook payloads — kept briefly for diagnostics, and removed on the same schedule as the processing records.

How to disconnect and how to request deletion

You have two ways to remove your data:

• Disconnect from Meta. Open your Instagram or Threads settings, find the apps connected to your account, and remove our app. Meta revokes the access token immediately. You can also use Facebook's apps and websites settings.
• Ask us to delete your data. Email akmal@kuisytihar.com with the subject Data deletion request and the Instagram or Threads username involved. We will confirm within 7 days and complete the deletion within 30 days.

When we delete data we remove the stored access token, the comment and reply records, and any webhook payloads tied to that account. Deletion is permanent. We will tell you if any specific item cannot be deleted and why.

Security

Access tokens are encrypted at rest. Access to the production systems is limited to the operator of Kuisytihar Digital Hub. Traffic to and from Meta is over HTTPS. Webhook payloads are verified with an HMAC signature before they are processed, so a payload that does not come from Meta is rejected.

No system is perfectly secure. If we become aware of a breach that affects your data, we will notify affected account holders and the relevant authorities as required by law.

Children

Our apps are business tools. They are not directed at children, and we do not knowingly collect data from anyone under 13, or under the minimum age required by the platform in their country.

Changes to this policy

When this policy changes, the new version is published at this URL with a new date, and a dated entry is added to the changelog. Continuing to use an app after a change means you accept the updated policy.

Contact

Questions about this policy, or about how your data is handled, go to: