Privacy Policy

1. Who we are

Recadly ("Recadly", "we", "us") is an iOS application that helps brands and creators manage their Instagram direct messages with AI assistance. Recadly is operated by Helena Emilia Martínez Pérez, a self-employed business (autónoma) based in Barcelona, Spain. We are the data controller for the personal data described in this policy. For any privacy question, contact us at privacy@recadly.com.

2. Who this policy covers

This policy covers two groups of people:

• Recadly users — the brands and creators who install Recadly and connect their Instagram professional account.
• Message senders — the Instagram users who send direct messages to a connected account. Their messages are processed by Recadly so that the Recadly user can read and reply to them.

3. What data we process

When you connect an Instagram professional account, and as you use Recadly, we process:

• Instagram account information — the account's ID, username, and basic profile details provided by Instagram.
• Access tokens — a secure token issued by Instagram that lets Recadly act on the connected account's behalf.
• Direct message and comment content — the text and metadata of direct messages and post/reel comments sent to and from the connected account, including messages from the people who contact that account.
• Automation rules — keyword and topic routing rules the user creates.
• Drafted replies — AI-generated reply drafts awaiting the user's approval.

We collect only the data needed to provide the service. We do not use it for advertising and we do not sell it.

4. How we use your data

We use this data solely to provide Recadly's features:

• Display the connected account's Instagram conversations in the app.
• Generate suggested replies using AI (see Section 6).
• Route incoming messages by keyword or topic according to the user's rules.
• Send replies that the user has written or reviewed and approved.

5. Legal basis (GDPR)

We process this data to perform our contract with the Recadly user (providing the service) and on the basis of our legitimate interest in operating and securing it. Message processing is carried out on the instruction of the Recadly user and under Instagram's terms governing business messaging.

6. AI processing

To generate reply suggestions and to route messages by topic, Recadly sends the relevant message content to Anthropic's Claude API. Anthropic processes this content to return the suggestions and, under its commercial API terms, does not use it to train its models.

7. Sub-processors

We rely on these providers to operate Recadly:

• Anthropic — AI reply suggestions and message classification.
• Neon — database hosting (European Union — Frankfurt, Germany).
• Fly.io — application hosting (European Union — Frankfurt, Germany).
• Meta Platforms — Instagram, the source of the messaging data.

8. Where your data is stored

Recadly's database and servers are hosted within the European Union (Frankfurt, Germany).

9. Data retention

We retain your data for as long as your Instagram account remains connected to Recadly. When you disconnect the account or request deletion, we delete the stored data — see Section 11 and our Data Deletion page.

10. Your rights

Under the GDPR you have the right to access, correct, export, and delete your personal data, and to object to or restrict its processing. To exercise these rights, contact privacy@recadly.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

11. Data deletion

You can disconnect your Instagram account in Recadly at any time, which revokes Recadly's access and deletes the stored access token. To request full deletion of all stored data, see recadly.com/data-deletion or email privacy@recadly.com.

12. Security

Access tokens and message data are stored in our EU-hosted database with restricted access. Access to backend systems is limited to authorised operators.

13. Children

Recadly is intended for use by businesses and creators and is not directed to anyone under 18 years of age.

14. Changes to this policy

We may update this policy from time to time. The current version is always posted here, with the "last updated" date above.

15. Contact

Helena Emilia Martínez Pérez — privacy@recadly.com, Barcelona, Spain.