Privacy Policy
Build Automate Grow · last updated 30 October 2026
Who we are
The Build Automate Grow app (our Instagram tools) is run by Build Automate Grow, LLC, a Wyoming limited liability company. "We" and "us" mean Build Automate Grow, LLC. Contact: Build Automate Grow, LLC, 712 9th St, Wheatland, WY 82201 · phil@buildautomategrow.com · 307-322-9838.
This policy covers the Instagram features of Build Automate Grow: connecting an Instagram professional account, publishing posts, reading and answering comments and direct messages, and sending one automatic direct message when someone comments a keyword. These features run on our service called Hermod. It applies to two groups of people:
- Account owners: businesses and creators who connect their Instagram account to Build Scale Grow.
- People who interact with a connected account: anyone who comments on its posts or sends it a direct message.
What we collect
From account owners
- Your sign-in email and a hashed password (we never store the password itself).
- When you connect Instagram (Instagram Login): your Instagram account ID, username and account type (Business or Creator), the permissions you granted, and the access token Instagram gives us. The token is encrypted before we store it.
- The rules you write (keywords, your message, your link) and the posts you publish or schedule (caption, the web address of your image or video, and the result Instagram returns: post ID and link).
From people who comment on or message a connected account (Instagram sends this to us because the account owner connected their account)
- Your Instagram-scoped ID (a number Instagram gives our app for you) and, if you commented, your username.
- The text of your comment, and which post it was on.
- The text of direct messages you send the account, and links to any attachments Instagram includes.
- Whether you asked us to stop messaging you (by replying STOP).
- The time you last messaged the account (Instagram only lets a business reply within 24 hours of your last message, so we must know it).
What we do not collect: your password for Instagram, your followers, your contacts, your email or phone number from Instagram, your location, or anything from accounts that are not connected to us.
Cookies: we set one cookie, only when an account owner signs in, to keep them signed in. We use no advertising or tracking cookies.
Server logs: like any web service, our servers record requests (time, address requested, IP address) for security and troubleshooting.
How we use it
- To do what the account owner asked: publish their posts, show them their comments and messages, and let them reply, hide or delete comments.
- To send one automatic direct message when someone comments a keyword the owner chose. That message is text the owner wrote, includes a link, and says it is automated. We send it at most once per comment and once per person per rule, and only within 7 days of the comment.
- To keep the account working: refresh the access token before it expires, and tell the owner if it stops working.
- To honour "stop": if you reply STOP (or UNSUBSCRIBE), we record it and send you no more messages from that account. Reply START to undo it. We keep a hashed opt-out record (a one-way hash of your Instagram ID and the business account's ID, nothing else) so that we never message someone who said STOP, even after the business disconnects and reconnects, or after a deletion request.
We do not message anyone first or send bulk or cold messages; use AI to reply to people automatically (automatic messages are only text the owner wrote); sell or rent anyone's data, or use it for advertising; or use Instagram data to build profiles of people across accounts.
Who we share it with
- The account owner whose account you interacted with. They see your comments and messages, as they would in the Instagram app, and may keep them in their own Build Automate Grow workspace (for example as a contact).
- Meta / Instagram, because every action (posting, replying, sending a message) is a call to Instagram's API.
- Our hosting provider (Hostinger), which runs the server.
- The law: if we are legally required to.
How long we keep it
| Data | Kept for |
|---|---|
| Comment text and direct message text | 30 days, then deleted automatically |
| Raw notifications from Instagram (they contain comment and message text) | 14 days, then deleted |
| Events passed to the account owner's workspace | 30 days in Hermod (the owner's copy is theirs) |
| An account owner's access token, account record, rules and post records | Until the account is disconnected, from Build Automate Grow or by removing the app in Instagram. Then deleted at once. |
| A commenter's or messager's ID and username | Deleted 90 days after their last comment or message to that account, or when the account is disconnected |
| A hashed opt-out record for someone who replied STOP (a one-way hash of their Instagram ID, and the business account's ID; nothing else) | Kept, so we never message someone who said STOP. Deleted if they reply START. |
| Log of automatic messages (who, which comment, the text and link) | Text and link deleted after 90 days; the bare record that a message was sent is kept only as long as we keep the person (above), so nobody gets the same message twice. |
| A deletion confirmation (code and dates, no personal data) | Kept, so the code can be looked up |
Security
Access tokens are encrypted at rest. Passwords are stored only as a salted hash. Instagram's notifications are checked against Instagram's signature before we accept them. Each business's data is kept separate from every other business's. Only Build Automate Grow, LLC operates the service.
Your choices and rights
- Account owners: you can disconnect Instagram at any time, on the Accounts page of Build Scale Grow or from Instagram (Settings → Website permissions → Apps and websites → remove Build Automate Grow). Either way we delete your data. See Data deletion.
- Anyone else: to stop automatic messages, reply STOP. To have us delete what we hold about you, email phil@buildautomategrow.com with your Instagram username and the account you interacted with. We delete it within 30 days and confirm by email.
- Depending on where you live (for example California or the EU), you may have extra rights to know, correct or delete your data. Email us and we will honour them.
Children
Build Automate Grow is for businesses and is not directed at children under 13 (16 in some countries). We do not knowingly collect their data; tell us and we will delete it.
Changes
If we change this policy we will update the date above, and tell account owners of any material change by email or in the app.
Contact
Build Automate Grow, LLC, 712 9th St, Wheatland, WY 82201 · phil@buildautomategrow.com · 307-322-9838