Privacy Policy
Last updated: October 24, 2026
1. Information We Collect
When you create a Pikvato account, we collect your name, email address, and password (stored as a secure hash). When you connect an Instagram professional account, we receive its account IDs, username, and display name, plus an OAuth access token that we store encrypted. While the account is connected, Instagram sends us webhook events for it: comments on your posts, direct messages and story replies sent to you, and taps on reply buttons. Each event includes the sender's Instagram-scoped ID and the text. We also store the automation rules and reply text you write, and a record of each reply Pikvato sends. Other social networks are not connected today; this policy will be updated before any of them is.
2. How We Use Information & Google API Limited Use
We process your connected account data solely to evaluate the keyword automation rules you configure in your workspace, and send authorized replies within each platform's policy windows (such as Meta's 24-hour messaging window and 7-day private reply window). We never sell your data or use it to train third-party AI models. Pikvato's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. Token Encryption & Security
All platform OAuth access tokens are encrypted at rest in Cloudflare D1 using AES-GCM (256-bit WebCrypto) with versioned keys (v1:<iv>:<ciphertext>). Inbound webhook deliveries are verified using constant-time HMAC signature checks before any payload is parsed.
4. Data Retention & How to Delete Your Data
Inbound message and comment text is automatically redacted from event logs after 30 days. You can delete your data at any time by: (a) opening Channels in your dashboard (app.pikvato.com/channels) and clicking Disconnect to immediately wipe stored OAuth tokens and pause automations; (b) opening Account Settings (app.pikvato.com/settings) and selecting Delete account to permanently erase your workspace and all associated records; (c) removing Pikvato from your social platform's connected apps settings (which triggers our automated Meta Deauthorize and Data Deletion callbacks at /api/webhooks/instagram/data-deletion); or (d) emailing support@pikvato.com to request manual deletion within 7 business days.
5. Contact
For privacy inquiries, data access requests, or data deletion support, contact us at support@pikvato.com.