Privacy Notice

Who is responsible

Zodial Labs GmbH, Cosimastrasse 121, 81925 München, Germany, operates Reel Follow-up. Contact mail@zodial.xyz. Company details are in our Legal Notice.

Instagram connection and automation

When you authorize Reel Follow-up, Instagram provides your account ID, username, permissions and access token. We use the Instagram API and signed webhook events to process comments, messages, button interactions and follower checks needed for your selected flows.

The service stores account settings, keywords, links, message content, participant identifiers, conversation history, scheduled jobs and delivery receipts to operate the automations you enable. Each account has a separate workspace. The flow editor reads your owned Reel captions, thumbnail URLs, permalinks, publication dates and comment counts from Instagram to display previews and configure Reel targeting. Preview metadata is cached on the host to limit repeated API reads; thumbnail images are loaded from Instagram’s content-delivery servers. Comment reminders are sent only by that account on its own media.

Instagram handles sign-in and authorization. We do not ask for your Instagram password. Account tokens are kept encrypted on the server and are not displayed in the dashboard.

Purposes and legal bases

We process account and automation data to provide the service you request and manage your connection. Processing necessary for that service is based on performance of a contract or steps you request before entering one. Security, abuse prevention, operational reliability and delivery deduplication rely on legitimate interests. Where we ask for optional consent, you can withdraw it for future processing.

You must have authority to manage the connected account and a lawful basis for the messaging and audience data you process through your flows.

Storage, hosting and providers

Vercel hosts the website and connection endpoints. The automation host stores account credentials, flows, messages, contacts and jobs in SQLite. Some existing installations use Neon for their archive or webhook queue. Access tokens are encrypted; the full message archive is not described as encrypted at rest.

Meta receives authorization and API requests, including the messages or comment replies you choose to send. Hosting and database providers may process request metadata such as IP address, timestamps and device information for delivery, security and diagnostics. Providers may process data outside the European Economic Area subject to their applicable transfer arrangements.

See Instagram’s Privacy Policy, Vercel’s Privacy Policy and Neon’s Privacy Policy.

Cookies, preferences and retention

A necessary, Secure, HttpOnly session cookie identifies your signed-in account and expires after two hours. A short-lived security cookie protects Instagram authorization. Your explicit light or dark appearance choice is stored locally as reel-theme. Light is the default. These preferences are not sent to a server for advertising.

Reel Follow-up does not include advertising cookies or a product-analytics tracker. Account settings, archive records and delivery receipts remain while needed for the service or until a verified deletion request is completed. Signing out or pausing does not delete saved data. Security logs and backups follow the applicable provider and operator retention processes; there is no automatic archive-expiry setting in the current app.

Assisted setup waitlist

If you join the waitlist, we store your email address, optional name and Instagram username, consent and signup time to manage invitations. You can withdraw your consent or request deletion by emailing us. Rate limiting uses a temporary keyed hash derived from request IP metadata; the waitlist does not store your original IP as a signup field.

Waitlist signup does not authorize Instagram or enable automation.

Your rights and deletion

Subject to applicable law, you may request access, correction, deletion, restriction, objection and data portability, withdraw consent, and complain to a competent data protection authority. Email mail@zodial.xyz to exercise your rights. Include the account username or signup email needed to identify your request; never send passwords or access tokens.

Read the Data Deletion instructions and Zodial’s general Privacy Notice. Reel Follow-up’s service-specific information on this page applies to its Instagram workflows.