Skip to content
ClasshAI
Back to ClasshAI

Privacy Policy

Effective August 31, 2026

ClasshAI (“we”) sends automated replies to comments and direct messages on Instagram accounts that creators connect to the service. This policy explains what we store, why we store it, who we share it with, and how to have it deleted.

Who operates ClasshAI

ClasshAI is a product operated by BUILT FOR CREATORS, the data controller for the personal data described below. Reach us at support@classhai.com; the registered postal address is on our contact page.

ClasshAI is an independent service. It is not affiliated with, endorsed by, or sponsored by Meta, Instagram or Google. We access Instagram only through Instagram’s official APIs, using permissions you grant on Instagram’s own screens.

What we collect

From you, when you sign in

  • Your Google account identifier, email address and name.
  • The effective dates of the Terms of Service and this Privacy Policy as published at the time you signed in, and the time you signed in — the record of which version of these documents you agreed to.
  • We never receive or store your Google password. Sign-in happens on Google’s own pages.

The free-month record

The free month is one per Google account, for good. To hold it to one without keeping your account on file after you delete it, we store a privacy-preserving keyed fingerprint of your Google account identifier — an HMAC-SHA256 computed with a secret key we hold, together with the date it was recorded. Nothing derived from your Instagram account is kept: your Instagram account ID is never fingerprinted, and the free-month record does not survive on the Instagram side of your account in any form.

Being accurate about what that is and is not: the stored value does not contain your raw Google account identifier, your email address, your name or your Instagram handle. It is not reversible into any of them, and without our key it cannot be tested against a guessed identifier either. What it does do is the reason it exists: it lets us recognise whether the same Google account has claimed the free month before — so it is not anonymous data, and we do not describe it as anonymous. It is data derived from your identifiers, kept in a form that limits it to that single question.

It is kept after your ClasshAI account is deleted, indefinitely, and it is the only thing that is — a limit a deletion resets is not a limit. Its purpose is limited to preventing trial abuse. It is not used for advertising, profiling or analytics, it is not linked to your account, your rules, your logs or anything you sent, and it is not used to recognise you if you come back and pay.

From Instagram, when you connect an account

  • Your Instagram username and account ID.
  • An access token issued by Meta, used only to send the replies your own rules define. We store its expiry so we can tell you when reconnecting is needed.

From people who interact with your account

When a comment or direct message matches one of your rules, we store a record of it so you can see what the service did on your behalf:

  • The Instagram user ID of the person who commented or messaged you.
  • The text of their comment or message, truncated to 1,000 characters.
  • The ID of the comment or post involved.
  • The reply we sent, whether it succeeded, and any error returned by Instagram.

Instagram sends us every new comment and direct message on your account, and we process the text to check it against your active rules. That check happens in memory, as the notification is handled. If nothing matches, we store nothing — no record of the comment or message is written, and its content is gone as soon as the check finishes. Only a comment or message that matches one of your rules produces the stored record described above. We do not build profiles of the people who contact you.

If a creator enables a follow gate, we temporarily store the interacting viewer’s Instagram-scoped ID, the rule, the fallback confirmation word and the final response for up to 24 hours. After the viewer uses the confirmation action or sends that word, Meta tells us only whether that viewer follows the connected account. We use that boolean result to send the resource or the creator’s reminder; we do not retrieve or store a follower list.

Usage and billing

  • Daily counts of replies sent, engagements and failures, used for your dashboard.
  • Your Razorpay customer and subscription identifiers, the currency you are billed in, plan and subscription status. Card details never reach our servers — payment happens entirely on Razorpay’s checkout pages.

The Instagram permissions we ask for, and why

When you connect an Instagram professional account, Instagram’s own authorization screen asks you to grant exactly three permissions. These are all we request, and each one is used only for the purpose below:

  • instagram_business_basic — reads the username and account ID of the account you connected. We use it to show you which account is connected, and to address every API call we make on your behalf to the right account.
  • instagram_business_manage_comments — receives new comments on your posts and sends the public and private replies you configured. We use it to check incoming comment text against your active rules and, on a match, to send those replies.
  • instagram_business_manage_messages — receives direct messages sent to your account and sends messages from it. We use it to check incoming message text against your active rules, deliver your reply, and—only after a viewer messages the account—ask Meta whether that viewer follows it when a follow gate is enabled.

We do not request permission to publish posts or stories, retrieve a follower list, run ads, or access Instagram Insights. A follow gate checks only the relationship of the viewer who replied in that private conversation.

What Instagram sends us

The permissions above are how we act. Instagram tells us there is something to act on through webhooks, and we subscribe your account to exactly these fields — nothing that happens outside them ever reaches us:

  • comments and live_comments — a new comment on one of your posts, or on a live video. This is what a keyword rule matches against.
  • mentions — someone @mentions your account in a comment. Answered publicly on the mentions edge, never by private message.
  • messages — a direct message sent to your account, which is what a DM rule matches against and what a follow confirmation arrives on.
  • messaging_postbacks — the viewer tapped a button we sent, such as the follow confirmation. Without this the button would do nothing.
  • messaging_referral — the conversation was opened from a link or an ice breaker, which tells us which of your rules to run.
  • messaging_seen — the viewer read the message. Used only to cancel a pending reminder so we do not nudge someone who already looked.

Every automated reply we send carries a line saying it was automated and naming the creator who configured it, because Instagram requires the recipient to be able to tell an automated message from one typed by a person.

Two different actions end this, and it is worth being exact about which does what. Disconnecting in ClasshAI stops replies and deletes ClasshAI’s stored Instagram token — that is entirely within our control and takes effect immediately. To ensure the authorization itself is removed from Instagram, remove ClasshAI in Instagram under Apps and websites (Settings → Website permissions → Apps and websites). We do also ask Instagram to drop the grant when you disconnect, but Meta does not currently document a permission-revoke endpoint for the Instagram login we use, so that call is best-effort and we do not promise it succeeded.

Why we collect it

  • To send the replies you configured — the core function of the service.
  • To check whether an interacting viewer follows you when you enable a follow gate.
  • To show you logs and analytics of what was sent.
  • To count visits to this website. We use Cloudflare Web Analytics, which sets no cookies and does not track individual visitors across sites.
  • To enforce the reply and rule limits of your plan.
  • To bill you, and to keep your subscription status current.
  • To diagnose failures when a reply does not go out.

We do not sell your data, we do not sell the data of people who contact you, and we do not use any of it for advertising.

Who we share it with

Only the processors needed to run the service:

  • Meta / Instagram — to send replies and receive the events that trigger them.
  • Google — sign-in, and cloud hosting for our API.
  • Razorpay — subscription payments. Razorpay Software Private Limited is an Indian payment aggregator authorised by the Reserve Bank of India.
  • Neon — managed PostgreSQL hosting for our database.
  • Vercel — hosting for this website.
  • Cloudflare — DNS, and the cookieless Web Analytics that counts visits to this website.

We disclose data otherwise only where we are legally required to, and we will tell you unless we are prohibited from doing so.

How your data is separated from other creators’

Every record belongs to exactly one creator, and that separation is enforced by the database itself through row-level security policies — not only by application code. Your Instagram access token is used solely to deliver replies for rules on your own account.

How long we keep it

  • Reply logs are deleted automatically 90 days after they are written. That includes the comment or message text that triggered each reply. A scheduled job removes them; you do not have to ask.
  • Pending follow-gate records expire after 24 hours and are deleted after completion or expiry. The follow-status boolean is used for the decision and is not retained as a follower profile.
  • Daily analytics are counts only — replies sent, engagements, failures, per day — with no message content and no identifiers of the people who contacted you. They are kept while your account is open, so your dashboard can show history beyond the log window.
  • When you disconnect Instagram, we delete the stored access token, username and account ID immediately, cancel pending follow deliveries and any replies still queued. Logs and analytics already recorded are not affected — see the data deletion page for how to remove those.
  • When you delete your account, your rules, logs, analytics, pending follow deliveries, queued replies, Instagram credentials, acceptance record and sessions are deleted with it, immediately and in the same operation. Nothing is retained in a deactivated state.
  • The keyed free-month fingerprint described above is kept after your account is deleted, indefinitely, because it exists to stop the one free month being taken twice. It holds no raw identifier, email, username or Instagram handle, and it is derived from your Google account alone — nothing that came from Instagram outlives your account. It can be matched against the same Google account if it signs up again; that is what it is for, and it is used for nothing else.
  • Records Razorpay keeps for financial and tax compliance remain with Razorpay under their own retention rules.

Deleting your data

Our data deletion page sets all of this out in full, including how to revoke access from inside Instagram itself. In short:

  • Disconnect Instagram — open Settings and choose Disconnect. Disconnecting in ClasshAI stops replies and deletes ClasshAI’s stored Instagram token, along with your Instagram identifiers, pending follow deliveries, and anything still queued. To ensure authorization is removed from Instagram itself, remove ClasshAI in Instagram under Apps and websites.
  • Delete everything — open Settings and choose Delete account. It happens immediately and without us being involved: your creator record is deleted, and with it your rules, reply logs, analytics, pending follow deliveries, queued replies, Instagram access token and identifiers, your acceptance record and every session. We also ask Instagram to drop the grant, but that call is best-effort — remove ClasshAI in Instagram under Apps and websites if you want to be certain it is gone from your account. An active subscription is cancelled with Razorpay first, so nothing can be charged afterwards; the remainder of the period you have paid for is not refunded. It cannot be undone, and signing in again creates a new, empty account — without another free month. One thing survives that deletion: the keyed free-month fingerprint of your Google account, kept indefinitely so the free month cannot be claimed twice. It is described in full above.
  • If you cannot reach Settings for any reason, email support@classhai.com from the address you signed up with, with the subject “Delete my account”, and we will do the same thing within 30 days and confirm by email.

What we cannot delete for you: the payment records Razorpay holds for its own financial and tax compliance. Those stay with Razorpay under their retention rules, and they are the only record of your payments that survives — we keep no separate payment ledger of our own.

If you are someone who commented on or messaged a creator using ClasshAI and you want the record of that interaction removed, email us at support@classhai.com with the creator’s Instagram handle and we will remove it.

Your rights

Depending on where you live, you may have the right to access, correct, export or erase the personal data we hold about you, and to object to our processing of it. Email support@classhai.com and we will respond within 30 days. You may also complain to your local data protection authority.

Privacy and grievance contact

Privacy questions, data requests and complaints about how we have handled your data all go to the same address, which is read by the people who operate the service:

  • Name: Usha Bharat Yadav
  • Designation: Proprietor and Consumer Grievance Officer
  • Email: support@classhai.com

We acknowledge a consumer complaint within 48 hours of receiving it, and address it within one month. If you are not satisfied with the outcome, you can escalate to the data protection authority where you live, and a consumer may approach any consumer commission or other forum having jurisdiction under law. Writing to us first is not a condition of doing either. The same same contact is on our contact page.

Security

All traffic is encrypted in transit. Sessions use signed, HTTP-only cookies. Your Instagram access token is encrypted before it is written to the database, with AES-256-GCM and a key held separately from the database in Google Cloud Secret Manager, so a copy of the database on its own does not yield a usable token. The database itself is managed and not reachable from the public internet. No system is perfectly secure, and we will notify affected creators without undue delay if we become aware of a breach involving their data.

Children

ClasshAI is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, email support@classhai.com and we will delete it.

Changes

If we make a material change we will update the effective date above and notify active creators by email before it takes effect.

Contact

Questions about this policy: support@classhai.com, or see our contact page.