Privacy Policy

Karrar Enterprises LLC operates CoffeeReach and is the data controller for the hosted service. Contact us at any time at support@coffeereach.com.

Two groups of people are described below, and it matters which one you are. Customers are businesses and agencies who sign in and connect an Instagram account. Commenters are members of the public who comment on a customer's post and receive a reply. We hold much less about commenters, and we hold it on the customer's behalf.

• Account details. Your email address, and — if you sign in with Google — the name and profile picture Google returns. We never receive your Google password.
• Workspace data. Workspace names, team member roles, and the email addresses of people you invite.
• Instagram connection. The account's Instagram user ID, username, display name, profile picture, follower count, and an access token. Tokens are encrypted with AES-256-GCM before storage and are decrypted only in memory at the moment a request is made.
• Campaign configuration. Keywords, message text, links, and the settings you choose.
• Session cookies. Strictly necessary for keeping you signed in. We set no advertising or tracking cookies.

When someone comments a configured keyword on a connected post, Instagram sends us that event and we store what is needed to send one reply and to show the customer what happened:

• The comment's ID and text, the post it was left on, and the commenter's Instagram user ID and username.
• A delivery record — what was sent, when, and if it failed, why.
• If the message contained a tracked link, the click: the time, the browser's user agent, the referring page, and a one-way hash of the IP address. We do not store raw IP addresses.

We do not build advertising profiles, we do not sell data, and we do not use this information to target anyone outside the campaign the person themselves interacted with.

CoffeeReach uses the official Instagram API with Instagram Login. We never ask for an Instagram password, never scrape Instagram, and never use browser automation. Each permission we request maps to one thing:

• instagram_business_basic — identify the connected account so it can be attached to your workspace.
• instagram_business_manage_comments — receive comments on your own posts and, if you enable it, post a public reply beneath them.
• instagram_business_manage_messages — send the private reply, and display your inbox so you can respond from the dashboard.
• instagram_business_manage_insights — show post performance and follower counts in your reports.

Direct message conversations shown in the dashboard inbox are read live from Instagram each time you open them. We do not copy your message history into our database.

We use a small number of providers, each processing data only to run the service and bound by their own agreements:

• Vercel — application hosting.
• Neon — the PostgreSQL database.
• Railway — the Redis queue and background worker.
• Meta Platforms — the Instagram API itself.
• Google — sign-in, if you choose that option.
• Resend — sign-in emails, if magic-link sign-in is enabled.

We do not sell personal data, and we do not share it with anyone for their own marketing.

• Raw webhook payloads — 14 days. Kept briefly so a failed delivery can be replayed, then deleted automatically.
• Duplicate-prevention records — 30 days. The list of comment IDs already handled, so nobody is messaged twice.
• Operational logs — 30 days. Diagnostics such as failed sends and token refreshes.
• Delivery logs and campaign data — kept while your account is open, because they are your record of what was sent, and deleted when you delete your workspace.

We may receive requests from law enforcement, courts, or other public authorities for information about our customers or the people they message.

We require valid legal process. We disclose data only where we are compelled by a subpoena, court order, warrant, or equivalent legal demand that is valid under applicable law, and we disclose only the narrow set of data the request actually requires.

We review every request. Requests that are overbroad, legally defective, or made without proper authority are rejected or challenged.

We notify affected customers where we are permitted to do so, so they can seek to protect their own interests, unless a court order or applicable law prohibits notice or there is an emergency involving a risk of serious harm.

We have received no such requests to date.

You can disconnect an Instagram account at any time from Settings, which removes the stored token and stops campaigns for that account immediately. You can export your delivery logs as CSV from the Logs page.

You may request access to, correction of, or deletion of your personal data, and you may object to or restrict our processing of it. The Data Deletion page explains how, and we respond to requests sent to support@coffeereach.com.

If you are a commenter rather than a customer and want your data removed, email us and we will remove it, or contact the business whose post you commented on.

Instagram access tokens are encrypted at rest with AES-256-GCM. All traffic is served over HTTPS. Webhook deliveries are verified against Meta's signature before being processed, so a forged request is rejected. Access to a workspace's data requires membership of that workspace.

CoffeeReach is a business tool and is not directed at children. We do not knowingly collect data from anyone under 13, or under the minimum age required by local law.

If we change how we handle data we will update this page and the date shown at the top. Material changes affecting customers will also be sent by email.