Privacy policy
Linkar helps creators and businesses automate Instagram conversations and public Facebook Page comment replies. This policy explains what we collect, why we use it, who we share it with, and how you can exercise your rights over it.
Who is responsible
Linkar is operated by its proprietor as a sole proprietorship trading as Linkar. For your account, billing, and site analytics, the proprietor is the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act). For the conversations your automations handle, you decide what happens and we act on your instructions, as described in the data processing addendum.
Account and sign-in information
When you create an account we receive your email address, your name if you give one, and a password that our authentication provider, Supabase, stores only in hashed form. If you sign in with Google, Google shares your name, email address, and Google account identifier with us. If you sign in with Facebook, Facebook shares your name, email address, and public profile picture. We also record your workspace details, your role, sign-in times, and the support messages you send.
When you invite a teammate, we store the email address you enter and send the invitation through our email provider, Resend. If the person does not accept, the invitation expires and is not used for anything else.
Billing information
Paid plans are billed through Razorpay. Razorpay receives your billing contact details and payment method directly when you check out, and returns to us the subscription and payment identifiers, plan, amount, status, and billing period. We never receive or store your card number, UPI PIN, or bank credentials. We keep invoices and payment records for as long as Indian tax law requires.
Connected Instagram and Facebook data
When you connect an Instagram professional account, we receive the account identifier, username where available, access token, and the Instagram comments, messages, media identifiers, and delivery events needed to run the rules you create.
When you connect a Facebook Page, we receive the Page identifier, Page name, encrypted Page access token, Page posts and top-level comments needed to run public comment-reply rules, and delivery results. Linkar ignores Page-authored and nested comment events for automation execution.
For comment-to-message automations, we store the Instagram-scoped participant identifier, source comment and media identifiers, interaction and delivery timestamps, and the latest follow-status result needed to enforce your configured follow gate and prevent duplicate delivery.
Tracked links
When someone opens a Linkar tracked link, we record the time, a one-way hash of their IP address (never the address itself), their browser’s user agent string, and the country our network provider derives from the request. The workspace that created the link sees these as click counts and country totals. If that workspace has set up a conversion address, we send it the link, the country, and the time of the click.
How we use information
We use this information to create and secure your account, authenticate connected Instagram accounts and Facebook Pages, receive official Meta events, evaluate your saved rules, send the replies you configured, prevent duplicate delivery, count usage against your plan, bill you, send service and security emails, provide support, and keep the service secure. Linkar does not use AI-generated replies in this MVP.
We process account and billing data to perform our contract with you and to meet legal obligations, and we use website analytics as described below, which you can turn off at any time. We do not sell personal information or use connected social content for advertising.
Analytics and cookies
We use Google Analytics 4 on our public website (the home, pricing, legal, support and contact pages, and the sign-in and sign-up pages) to understand which pages are useful. It does not run inside the Linkar app. In the UK, the European Economic Area and Switzerland, analytics cookies stay off until you accept them in the cookie notice; everywhere else they are on by default and you can turn them off at any time.
When analytics cookies are on, Google sets the _ga and _ga_* cookies, kept for up to two years, to distinguish one visitor from another, and receives the page you viewed, the page title, the referring page, your device and browser details, and an approximate location that Google derives from your IP address. Google keeps this data for up to 14 months. Advertising storage and personalisation are always off.
Page addresses are shortened before they are sent: query strings and fragments are removed entirely. We do not send your name, email address, workspace, or connected account details to Google, and we do not link analytics activity to your Linkar account.
You can change your choice at any time on the cookies statement, or opt out of Google Analytics everywhere with Google’s opt-out browser add-on. Refusing analytics does not affect any automation you have configured.
Sharing and service providers
We share information only with the service providers that run Linkar: Supabase for authentication and the database, our hosting and network providers, Resend for email, Razorpay for payments, Google for sign-in and analytics, and Meta’s APIs when you ask Linkar to send or receive Instagram or Facebook Page data. The full list, and what each one receives, is on the service providers page. We may also disclose information where the law requires it.
Storage and security
Access tokens are encrypted at rest. Signed events from Meta are verified before processing, and event identifiers are deduplicated. Some providers process data outside India under the terms in their agreements with us. No online service can guarantee absolute security; please use a strong password and report suspected misuse promptly. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires.
Retention and deletion
We keep account, workspace, and automation data while your account is open. Instagram comment-to-message participant records are automatically deleted 90 days after their automation finishes running or after their messaging window closes without a reply. Tracked-link click records are deleted with their link or workspace. When you close your account or ask us to delete it, we delete your personal data within thirty days, except for billing records we must keep under tax law and minimal records of the deletion request itself.
You can disconnect an Instagram account or Facebook Page in the app or request deletion sooner at /data-deletion. Meta callbacks are handled at the channel-specific data-deletion endpoints.
Your rights
Under the DPDP Act you can ask us for a summary of the personal data we hold about you and how it is processed, ask us to correct, complete, update, or erase it, withdraw consent you have given (such as for analytics) as easily as you gave it, and nominate another person to exercise these rights if you die or become unable to. Contact [email protected] with your account email, workspace, and connected Instagram username or Facebook Page name. We may need to verify your identity before acting on a request.
Linkar is meant for businesses and creators and is not directed at children. Do not create an account if you are under 18.
Grievance officer
If you have a concern about how we handle your personal data, write to our grievance officer, the proprietor of Linkar, at [email protected]. We acknowledge complaints within 48 hours and aim to resolve them within one month. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Changes
We may update this policy as Linkar changes. We will update the effective date above and, where appropriate, notify account owners of material changes.