Skip to content
raplyflow.
Start free
Menu

PRIVACY

Privacy Policy

This policy describes RaplyFlow’s account and workspace services, content planning, managed social connections and existing Instagram comment-to-DM automation, including data about people who comment on connected accounts. Updated October 8, 2026.

RaplyFlow is operated by Farhat Content & Commerce Group LLC, 1001 S. Main St., STE 600, Kalispell, MT 59901, USA.

What RaplyFlow does

RaplyFlow provides accounts, workspaces and content planning, plus authorized social publishing, scheduling, insights, conversations and keyword-triggered private replies through our social integration provider. Existing direct Meta comment automations remain available separately.

Managed social connections

With your authorization, RaplyFlow connects Instagram, Facebook, TikTok, Threads or WhatsApp through our social integration provider. Each workspace has a separate provider profile. Our social integration provider handles platform authorization and stores the platform credentials. RaplyFlow keeps provider identifiers, platform names, profile display information and connection status. The provider API key is held only on the server and is never sent to your browser.

When account selection is required, RaplyFlow temporarily stores an encrypted authorization grant, bound to the initiating session and workspace. The grant is valid for up to ten minutes and is removed on completion or cancellation, or by expired-state cleanup. It is never returned to the account-selection interface or written to application logs.

Our social integration provider processes authorized connection data under its own Privacy Policy. Platform permissions and account eligibility still apply. Connecting an account does not automatically publish your drafts or import inbox history.

Managed social tools

When you open these tools, RaplyFlow requests your account’s recent posts, Reels, public comments, insights, automation settings or conversations from our social integration provider. Workspace members can read this data. Only the workspace owner can activate or change provider automations, publish, schedule, cancel posts or send private/public inbox replies. Shared Instagram and Facebook automation settings are stored in the workspace, with the provider rule identifier and confirmation status for each account. Automation configuration includes keywords, matching mode, private-reply text, optional public-reply text and an optional link button. Our social integration provider processes matching comments and sends configured replies; tracked link buttons produce click statistics. Owners can also create Instagram and Facebook inbound-message flows that ask questions and keep replies in the provider’s workflow execution data. RaplyFlow displays aggregate run counts and does not copy those answers into its own database. A flow sends no follow-up if a person does not reply within 23 hours.

Audience displays verified contact records for your connected accounts, including available names, email addresses, tags, notes, saved fields and conversation channels. Workspace members can view these records; only the owner can edit names, emails, companies, tags and notes. These records are read from and changes are stored by our social integration provider, not copied into RaplyFlow’s database or logs. CSV exports contain only the contacts loaded by the requesting user and are downloaded to that user’s device. A contact’s messaging subscription status does not establish email marketing consent.

Media selected for publishing is uploaded to provider storage and is accessible to anyone with its URL, including before publication. RaplyFlow stores workspace ownership, the media URL, MIME type and file size. Publishing and messaging use workspace-scoped retry receipts containing a request identifier, a content fingerprint and a minimal result; these prevent accidental duplicate actions. Inbox message content is returned to authorized workspace members without being copied into RaplyFlow’s database or application logs. The provider’s independent storage and retention still apply.

Workspace deletion removes provider automation rules and cancels pending provider posts, and removes provider conversation flows, before disconnecting accounts and deleting local records. If a publication is already in progress, deletion is blocked until it finishes. Content already published on social platforms is not removed by workspace deletion. Provider-side copies, uploads, completed-post records and the opaque provider profile may require a separate erasure request to support.

Guide link measurement

Guide conversations can optionally collect a valid email and save its source in the provider’s contact record. This does not establish email marketing consent. When a public HTTPS tracking address is configured, RaplyFlow issues opaque guide links and keeps the automation, account, post and original destination together with a pseudonymous conversation reference. We do not copy a recipient’s name, email or raw conversation identifier into these tracking records. The first Open guide action is recorded; merely previewing the link is not counted. Repeated opens do not add another result, and forwarded links retain their original attribution. We do not use tracking cookies or store IP addresses in these records. Tracking records expire after 90 days and are removed with the automation or workspace. Ordinary server and hosting access logs may have their own retention. Workspace members can view aggregate results and available guide-link activity in Audience.

Information we access and use

  • RaplyFlow account information: name, email, authentication records, and session information including IP address and browser user agent where available. Workspace names, memberships, and roles support sign-in and workspace access.
  • Instagram profile and connection: account ID, username, display name, profile picture URL, account type returned during connection, granted permissions, connection status, and connection and token-expiry dates. These identify and manage the account you connect.
  • Direct Meta authorization credentials: access tokens let the service make authorized requests and maintain the connection. RaplyFlow does not ask you to give it your Instagram password.
  • Comment notifications: comment text and ID, parent comment ID, commenter ID and username, media ID and media type when supplied by Meta. Notifications are evaluated for keyword matches, including comments that do not match. Comment text, commenter username and ID, parent comment and media information are evaluated in memory; new background jobs do not store that content. A matched comment’s ID is stored in an action record linked to the workspace, account, and automation. Private-reply recipient IDs returned by Meta are stored with the action outcome.
  • Automation configuration: keywords, enabled state, account selection, public and private reply text, and an optional URL. These are used to send the responses you configure.
  • Action records: account and comment IDs, public reply ID, private message and recipient IDs, statuses, attempt counts, timestamps, and error/status codes. These support delivery handling, troubleshooting, and prevention of duplicate responses.

Instagram permissions

RaplyFlow requests basic professional-account access to identify the connected account, comment-management access to receive comment notifications and publish public replies, and messaging access to send comment-triggered private replies. It uses these permissions for the workflow you enable. Meta controls permission availability and delivery limits.

Content drafts and planning

When you save a content draft, RaplyFlow stores its title, caption, intended channels, optional planned date and edit timestamps in your workspace. Other members of that workspace can read drafts; owners and admins can edit them. A planned date does not automatically publish or schedule content with a social platform. Drafts remain until deleted or the workspace is deleted.

Storage, access, and protection

Account, workspace, connection, automation, and action records are stored in the service database. Background jobs hold only an opaque reference to an action record, rather than comment text, commenter profiles, message copy, or access tokens. Stored direct Meta credentials are encrypted at application level and are not included in the account data returned to the dashboard. Workspace membership checks restrict access to workspace records. Incoming Meta notifications are checked for a valid signature before processing.

Operational automation logs use hashed identifiers and status metadata rather than comment text or access tokens. This does not make all records anonymous. Sign-in uses session cookies; production authentication is configured to use secure cookies. The current website does not include advertising trackers or third-party analytics scripts.

Who receives information

RaplyFlow sends account/comment identifiers and your configured reply text to Meta to perform the authorized actions. Public replies are visible on Instagram; private replies are delivered to the relevant commenter. Workspace members can access the connected-account information and automation configuration exposed in their workspace. Workspace content drafts are shared with members of the same workspace. Service hosting and data-storage providers process the records required to run the application. Fonts are served by the application; the current site does not load Google Fonts directly in visitors’ browsers. Meta handles information under its own Privacy Policy.

Retention

  • Account and workspace records: profiles, memberships, social-account metadata, content drafts and automation settings remain while the account or workspace exists, until explicitly deleted. Inactive accounts are not automatically erased.
  • Instagram credentials: disconnecting clears stored credentials immediately. Expired credentials are cleared when detected by token handling or the next scheduled cleanup. Cleanup also clears credentials for connections that RaplyFlow has marked as no longer connected.
  • Action history: comment IDs, reply/message/recipient IDs, statuses and timestamps are removed once their action record is 30 days old. This also bounds the stored duplicate-response history.
  • Authentication: expired sessions, connection authorization states and verification records are removed by scheduled cleanup. Account deletion also removes that user’s sign-in credentials and sessions.
  • Queue history: completed job references are cleaned after 24 hours, and failed job references after 30 days, or sooner under history-count limits. Pending jobs may remain, but a reference whose database record was deleted cannot retrieve comment data or execute an automation.

Cleanup runs at worker startup and hourly while the worker is operating. Age limits are eligibility thresholds; deletion occurs on the next successful sweep. Outages or maintenance failures can delay cleanup until service resumes. New jobs do not persist comment text or commenter usernames.

Deleting your account or workspace

Use Manage and delete your data after signing in. Deletion requires your current password and typed confirmation. A workspace owner can permanently delete the workspace for all members, including connected-account metadata and credentials, automations, action history, memberships and pending connection requests. Other workspaces and members’ personal accounts remain.

Deleting your personal account removes your profile, authentication records, sessions, pending connection authorizations and memberships. You must first delete any workspaces you own or arrange an ownership transfer with support. Data belonging to shared workspaces owned by other people remains with those workspaces; request any additional personal-data removal through support.

Disconnecting is different from deletion

Disconnecting in Social Accounts clears RaplyFlow’s stored Instagram credentials and marks the connection inactive. It does not erase profile metadata, automations or action history, and does not itself revoke permission at Meta. Remove RaplyFlow’s access in Instagram’s connected-app settings to revoke that authorization too.

An action already in flight may still complete. Deletion does not retract comments or messages already sent on Instagram. Future authorized connections or interactions can result in new data being processed. See User Data Deletion for email requests, including requests from Instagram commenters.

For managed connections, Disconnect requests removal of the account at our social integration provider and marks it inactive locally. The provider documents a one-hour reconnect grace period for disconnected accounts. Workspace deletion requests disconnection of its provider accounts before deleting local records; if this request fails, local deletion does not complete. An opaque provider profile may remain. Provider-side retained records, an authorization already in progress and operational copies may require a separate support-assisted erasure request. We do not move disconnected accounts into another customer’s profile or claim immediate erasure of independently retained provider data.

Scope of deletion and operational copies

The deletion actions cover RaplyFlow’s live application database and remove older comment-containing queue payloads for the affected workspace. Remaining background references cannot restore deleted records. Hosting logs, provider backups and support-email correspondence are managed separately; they are not erased by the in-app action. Contact us about these copies and any applicable retention obligations. We do not claim that deletion from the live service instantly removes every backup or records held independently by Meta.

Your privacy choices and contact

You can disable an automation or disconnect an account in your workspace. Depending on applicable law, you may have rights to access, correct, obtain a copy of, or request deletion or restriction of your personal data, and to complain to a data-protection authority. Commenters can request deletion of their data without creating a RaplyFlow account.

Email support@farhatagency.com with the subject “RaplyFlow data deletion request”. This opens your email application; your request is sent only when you send the email.

Policy updates

Changes to this policy will be published here with an updated date. Contact and support information is also available on our Contact page.