Privacy Policy
Liberatori Chat · last updated: 28 October 2026
1. Who we are
Liberatori Chat is a service of Liberatori OÜ, Pärnu mnt 388b, 11612 Tallinn, Estonia, registry code 17621674 ("Liberatori", "we"). For any privacy question: info@liberatori.eu.
Liberatori Chat lets businesses (our customers) connect their Instagram professional account and automate replies to comments and direct messages, manage conversations and keep the contacts of the people who write to them.
- For the data of the customers who use the service (user accounts, the connected Instagram account) we are the data controller.
- For the data of people who comment on or message a customer's Instagram account, the controller is the customer; we process that data as a processor, only on the customer's behalf and instructions.
2. What data we process
| Whose | Data |
|---|---|
| Customers and their teams | Name, email, password (stored only as a hash), role, log of sign-ins and actions. |
| Connected Instagram account | Professional account ID, username, name, profile picture, access token (encrypted), list of posts so the customer can choose which ones an automation applies to. |
| People who interact with the customer's account | Instagram-scoped ID, username, name and profile picture, whether they follow the account, text of comments that trigger an automation, direct messages exchanged with the account, taps on buttons and links sent, data the person chooses to share in the chat (for example email or phone), tags and fields set by the customer. |
We do not process special categories of data and we ask customers not to collect them through the service.
3. Instagram permissions and what they are for
| Permission | Use |
|---|---|
| instagram_business_basic | Read the connected account's ID, username and picture and its list of posts, to show them in the dashboard and choose which posts an automation applies to. |
| instagram_business_manage_comments | Receive comments on the account's posts, reply publicly to the comment and send the private reply Instagram allows to the person who commented the keyword chosen by the customer. |
| instagram_business_manage_messages | Receive direct messages sent to the account, reply automatically according to the customer's flows, show conversations in the team inbox and read the name, picture and "follows the account" status of the person writing. |
We only message people who commented on a customer's post or wrote to the customer, and only within the time limits set by Meta (one private reply per comment within 7 days; other messages within 24 hours of the person's last message). We do not send unsolicited messages.
4. Why we use it
- To provide the service to the customer: automations, conversation inbox, contacts, statistics (legal basis: the contract with the customer; for people who write, the customer's legitimate interest in answering whoever contacts them, and consent where the person volunteers their data).
- Security, abuse prevention and support (legitimate interest).
- Legal obligations (for example tax rules for customers' billing data).
We do not sell data, we do not use it for advertising and we do not use it to train artificial intelligence models.
5. Artificial intelligence
If the customer turns on AI replies, the text of the ongoing conversation and the customer's instructions are sent to Anthropic's Claude model to write the reply. We send only the text of the messages, without the person's username or identifiers. If the customer does not turn this feature on, no data is sent.
6. Who we share it with
| Provider | Service | Where |
|---|---|---|
| IONOS SE | Servers and backups | Germany (EU) |
| Meta Platforms Ireland Ltd | Instagram, through its APIs, to receive and send comments and messages | EU and Meta group countries |
| Anthropic PBC | Only if the customer turns on AI replies | United States, under standard contractual clauses |
| Customer's own tools | Only if the customer sets up webhooks or integrations (for example their CRM) | Chosen by the customer |
7. How long we keep it
- Contacts and conversations: as long as the Instagram account stays connected or until the customer deletes them.
- When the customer disconnects the account or removes the app from Instagram's settings, the token is deleted immediately; contacts and conversations are deleted on request, and in any case within 90 days.
- A data deletion request sent by Meta is carried out immediately (see Data deletion).
- Raw copy of notifications received from Instagram: 14 days, for troubleshooting.
- Log of team actions: 24 months.
8. Security
Encrypted connections (HTTPS), access tokens encrypted in the database, passwords stored only as hashes, dashboard access by invitation only and with roles, signature check on every notification received from Meta, action log, servers in the European Union.
9. Your rights
You can ask for access, rectification, erasure, restriction, portability or object to processing by writing to info@liberatori.eu. If you wrote to a business that uses Liberatori Chat, you can also contact that business directly: it is the controller of that data, and we help it answer. You can also lodge a complaint with the Estonian supervisory authority (Andmekaitse Inspektsioon) or the one in your country.
10. Changes
If this policy changes, we update the date at the top and, for important changes, notify customers in the dashboard.