Privacy Policy

1. Who this policy covers

This policy applies to two groups: (a) our customers — the creators and businesses who sign up for a Nerugaa account and connect an Instagram or WhatsApp Business account; and (b) end users— the people who comment on or message our customers’ Instagram accounts and may receive automated replies.

2. Information we collect

• Account information. When a customer signs up we collect their name, email address, and authentication credentials.
• Instagram data (via Meta).When a customer connects their Instagram Business or Creator account, we receive their Instagram account ID, username, and a long-lived access token. We receive the content of comments, mentions, and direct messages relevant to the automations the customer configures, along with the sender’s Instagram-scoped user ID.
• WhatsApp data (via Meta). When a customer connects a customer-owned WhatsApp Business Account, we receive its WABA and business phone-number identifiers, display number, verified name, encrypted access token, message-template metadata, and webhook subscription status. For user-initiated support conversations we process WhatsApp identifiers, profile names, message content, button/list replies, timestamps, and delivery/read/failure status.
• Automation configuration. The keywords, rules, and message templates customers create.
• Usage and diagnostic data. Logs, error reports, and basic analytics used to operate and improve the service.

3. How we use information

• To deliver the core service: matching incoming Instagram and WhatsApp interactions against customer-configured rules, displaying conversations in the Inbox, and sending authorized automated or manual replies.
• To authenticate customers and secure their accounts.
• To operate, maintain, debug, and improve the service, and to provide customer support.
• To comply with legal obligations and enforce our Terms.

We do notsell personal information. We do not use Meta Platform Data for advertising, and we do not build profiles of end users beyond what is needed to deliver the customer’s automations.

4. How we share information

We share information only as follows:

• Meta Platforms. We exchange data with Instagram, WhatsApp, and Meta APIs as required to deliver the service, in accordance with the Meta Platform Terms and Developer Policies.
• Service providers. We use vetted infrastructure providers for hosting, databases, background job processing, and email delivery. They process data only on our instructions.
• Legal. We may disclose information where required by law or to protect rights, safety, and the integrity of the service.

5. Data retention

We retain customer account data for as long as the account is active. We retain Instagram- and WhatsApp-derived data (such as conversation history and access tokens) only as long as needed to provide the service. Access tokens are encrypted at rest. Valid, tenant-linked WhatsApp webhook audit summaries expire after 30 days and are removed earlier when the WhatsApp connection or workspace is deleted. When a customer disconnects a channel or deletes their workspace, its primary channel data is removed; bounded diagnostic records and verified support deletion requests are completed within 30 days, except where retention is required by law.

6. Data security

We encrypt access tokens at rest, transmit data over HTTPS, and restrict access to production systems. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard safeguards.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information. Customers can disconnect an Instagram or WhatsApp account or delete their Nerugaa workspace at any time. Full account/profile deletion is available through a verified support request. To make a data request, see our Data Deletion page or email support@nerugaa.com.

8. International users

We may process and store information in countries other than your own. Where required, we rely on appropriate safeguards for cross-border transfers. We aim to comply with applicable data protection laws including the GDPR, CCPA, and India’s DPDP Act.

9. Children

Nerugaa is not directed to individuals under the age of 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notifying customers.

11. Contact

Questions about this policy or your data? Email support@nerugaa.com.