Privacy Policy

ohyap is a product of PIXCEL IT (“we”, “our”, or “us”) — a registered company at pixcelit.com. ohyap is a software service that connects to your Instagram professional (Business or Creator) account through Meta’s official Instagram API and automatically replies to direct messages and comments on your behalf using an AI assistant.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. By creating an account or connecting your Instagram account, you agree to the practices described here.

2.1 Account information

• Your email address and a securely hashed password
• Your business name and business type
• Your Instagram account username and ID (obtained when you connect via Meta)

2.2 Instagram data (via the Meta Graph API)

When someone interacts with your connected account, we process:

• Direct message content — including text and any photos or attachments people send to your business account
• Comments on your posts, and the image of the post being commented on (used by the Comment-to-DM feature to identify the product)
• The Instagram username and user ID of people who message or comment on your account
• Message and comment timestamps and delivery/read status

2.3 Content you create

• Your Knowledge Base (business facts, delivery info, FAQs) that grounds the AI
• Your product catalogue — product names, prices, stock, and product images
• Your Comment-to-DM and story-mention settings

2.4 Your customers’ order details

When your AI captures an order during a conversation, we store the details your customer provides — which may include their name, delivery address, phone number, and the products ordered — so the order appears in your dashboard. You are responsible for this data as described in section 11.

2.5 Usage data

• Monthly usage counts (AI replies and photo-match requests) used to apply your plan limits
• Aggregate analytics such as message and order counts shown in your dashboard

• To run the service — read incoming DMs and comments and send automated replies on your behalf
• To power the AI agent — your Knowledge Base, product catalogue, and the incoming message (including photos) are used to generate a relevant reply and match products
• To capture orders — record the order details your customers share so you can fulfil them
• To enforce plan limits — count monthly AI and photo-match usage
• To handle billing — process subscription payments through Lemon Squeezy
• To support and improve the service — troubleshoot issues and improve features

ohyap uses Meta’s Instagram API. When you connect your account you authorise us to use the following permissions on your behalf:

• instagram_business_basic — read your basic professional-account profile
• instagram_business_manage_messages — read and send direct messages for your account
• instagram_business_manage_comments — read comments on your posts to trigger Comment-to-DM automations
• public_profile — default permission used during the Instagram Login authorization flow

We comply with Meta’s Platform Terms and Developer Policies. We use this data only to provide ohyap’s features to you, we do not sell Meta Platform Data, and we do not use it to train AI models. We retain it only as long as needed to provide the service (see section 7).

To generate replies, the text of incoming messages and any photos sent to your account — together with your Knowledge Base and product catalogue — are sent to our AI provider, OpenAI, which processes them as our data processor solely to return a reply. This data is not used to train models. Photos are processed to match a customer’s picture to a product in your catalogue; we do not use them for any other purpose.

We use trusted service providers (sub-processors) who process data strictly on our behalf and are contractually barred from using it for their own purposes:

• Supabase — database and authentication hosting (United States)
• OpenAI — generating AI replies and matching photos to products
• Inngest — reliably processing message and comment events in the background
• Lemon Squeezy — payment processing and merchant of record (receives your email and subscription details)
• Vercel — application hosting
• Meta / Instagram — the platform we send and receive messages through

We do not sell, rent, or trade your data or your customers’ data to anyone. We may disclose information only if required by law.

• Your account, messages, contacts, and orders are kept while your account is active so your inbox, orders, and analytics stay available to you.
• You can erase everything at any time from Settings → Danger zone, or by disconnecting your Instagram account to stop all processing.
• When you delete your account, your data is removed from our live database immediately and purged from routine backups within 30 days.

You can request deletion of your data at any time by:

• Deleting your account from Settings → Danger zone — this immediately erases your profile, messages, contacts, orders, products, settings, and Instagram connection
• Disconnecting your Instagram account from Settings → Danger zone to stop all processing
• Emailing hi@ohyap.com with the subject “Delete my data”

We process deletion requests within 30 days. If you remove ohyap's access from your Instagram settings, Meta notifies us automatically and we immediately stop all processing and revoke our access to your account; if you also request data deletion through Instagram, Meta forwards that request and we erase the associated data.

• All data is transmitted over encrypted connections (HTTPS/TLS)
• Row-Level Security in our database means each account can only access its own data
• Instagram access tokens are stored securely and used only by our backend to send and receive messages for you
• We carry out regular security reviews

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data
• Export your data
• Withdraw consent at any time by disconnecting your Instagram account

To exercise any of these, contact hi@ohyap.com.

When you use ohyap to chat with and take orders from your customers, you are the controller of your customers’ personal data and ohyap acts as your processor. You are responsible for having a lawful basis to collect it and for giving your customers your own privacy disclosures. We handle that data only to provide ohyap’s features to you.

ohyap is intended for businesses and is not directed at anyone under 16. We do not knowingly collect personal information from children.

We process and store data in the United States and other countries where our service providers operate. By using ohyap you consent to your data being transferred to and processed in these locations with appropriate safeguards.

We may update this Privacy Policy from time to time. We’ll change the “Last updated” date above and, for significant changes, notify you by email or in the app. Continued use after changes means you accept the updated policy.

Questions about this policy or your data? We’re happy to help. To report a security vulnerability, please email hi@ohyap.com with the subject "Security report".