Privacy policy

Last updated: October 21, 2026

moribot ("we", "us") is a tool that businesses connect to their Instagram professional account to reply to direct messages and comments with keyword rules they write, and to answer customers from a shared inbox. This policy explains what data we process, why, and how you can have it deleted. It applies to moribot.net and the moribot panel at moribot.net/app.

1. Who is responsible for your data

When a business ("Merchant") connects its Instagram account to moribot, the Merchant decides how customer conversations are used, and moribot processes those conversations on the Merchant's behalf. For Merchant account data (login and settings), moribot is responsible.

2. Data we collect

• Merchant account data: business name, email address and a hashed password.
• Connected account data: when a Merchant connects an Instagram professional account, we receive the account ID, username and the access token Instagram issues for that connection.
• Customer conversation data: direct messages and image links that customers send to the connected account, the customer's Instagram-scoped ID, username, name and profile picture link, and the replies sent by moribot's rules or the Merchant's team.
• Comments: comments on the Merchant's recent posts are read from Instagram when the Merchant opens the Comments page and are not stored by moribot. We store only the ID of each comment a rule has answered, so it is not answered twice.
• Rules: the keywords and reply texts the Merchant writes.

3. How we use data

• To receive incoming messages and comments and send the replies the Merchant set up, or that the Merchant's team writes.
• To show conversations in the Merchant's inbox so their team can follow up or take over.
• To keep the service secure, prevent abuse and fix problems.

We do not sell personal data. We do not use data received from Instagram for advertising, and we do not use it to build profiles of people outside the Merchant's own conversations.

4. Who we share data with

• The Merchant whose account the conversation belongs to.
• Meta Platforms, when we send replies through the Instagram API.
• Our hosting provider, which runs the servers moribot uses, under confidentiality obligations.
• Authorities, only when the law requires it.

5. How long we keep data

Conversation data is kept while the Merchant's account is active so the Merchant can see chat history. When a Merchant disconnects Instagram in the moribot panel, we delete the access token we stored, so moribot can no longer read or send messages for that account. When a Merchant removes moribot in Instagram's settings, Instagram notifies us and we delete the token, conversations and rules for that account. When a Merchant uses Remove data or Delete account in the panel, or a person asks us to delete their data, we delete it as described in our data deletion instructions.

6. Security

Access tokens and conversations are stored on access-controlled servers in the United States, sent over encrypted connections, and only available to staff who need them to run the service. Passwords are stored only as salted hashes. No online service can promise perfect security, and we will notify affected Merchants if a breach affects their data.

7. Your rights

You can ask us to access, correct or delete your personal data, or to stop processing it. Customers of a Merchant can also contact that Merchant directly. Send requests to info@moribot.net. We answer within 30 days.

8. Children

moribot is a business tool and is not directed at children under 13. We do not knowingly collect their data.

9. Changes

We may update this policy. The date at the top shows the latest version. We will tell Merchants about important changes by email.

10. Contact

Questions about this policy: info@moribot.net.