ZapMob collects and processes the data necessary to operate its social media automation service (including Instagram). As the publisher of the service, we are committed to complying with the General Data Protection Regulation (GDPR) and applicable data protection laws.
We collect the following categories of data:
Data is used to: provide the service (run Zaps: reply to comments, send DMs); authenticate the user; improve and maintain the service. We never sell your data to third parties. We do not read existing DM conversations. We do not store message content beyond delivery status (sent/failed).
Your data is shared only with: Meta/Instagram (via their API, to perform actions authorized by the user); hosting providers (Render for servers, Neon for the PostgreSQL database, Vercel for the website); Airtable, where access requests submitted through the website form are stored (email address and Instagram handle); Vercel Web Analytics for aggregated audience measurement; the AI agents you choose to connect to your account yourself (see section 5). No other third party has access to your personal data and no data is ever resold.
You can connect a third-party artificial intelligence assistant that supports the MCP protocol, such as Claude, ChatGPT or Cursor, to your account. This connection only happens at your request, after you approve a consent screen listing the permissions requested. The agent then acts on your behalf and only sees what you see in ZapMob:
The agent never has access to the content of the comments, messages or replies you receive, nor to your credentials, your Instagram tokens or Meta's technical identifiers. Information sent to the agent is then processed by the agent's publisher, under its own privacy policy. You can disconnect an agent at any time from Settings › Connected AI agents: its access is cut off immediately. Resetting your password also disconnects all your agents. The log of connections, disconnections, pauses and resumes is kept for 12 months.
We implement appropriate technical measures: hashed passwords (never in plain text); encrypted Instagram tokens (pgp_sym_encrypt) in the database; AI agent tokens stored only as a fingerprint (SHA-256); HTTPS connections; API authentication via JWT. These measures are intended to protect the integrity and confidentiality of your data.
Data is retained for as long as your account is active. Upon account deletion or explicit request, personal data is deleted within the timeframes required by law, except where legal retention obligations apply.
In accordance with GDPR and platform requirements (Meta / Instagram), you have the right to access, rectify, erase (“right to be forgotten”), restrict processing, data portability, and to object. To request the deletion of your personal data or Instagram-related data, email us at contact@zapmob.app with the subject “Data Deletion Request”. We will verify your identity and process your request within 30 days. You can also view our dedicated deletion instructions page on /data-deletion. Additionally, we recommend revoking ZapMob's access directly from your Instagram / Meta account settings (Authorized Apps and Websites). You may also lodge a complaint with your supervisory authority.
The only cookie set by the website is technical: it remembers your language choice. Your session token is not a cookie, it is stored in your browser's local storage and disappears when you log out. We use Vercel Web Analytics to measure website traffic and the sign-up journey: this measurement is aggregated, with no advertising cookies, no resale and no individual profiling. We do not use any ad network.
This privacy policy may be updated. In the event of a material change, we will notify you by email (to the address associated with your account). The date of the last update is shown at the top of this page.
For any questions regarding the protection of your data, data deletion requests, or to exercise your rights: contact@zapmob.app.