Instagram Privacy Notice

Ushbu sahifa ALLOS’ning Meta / Instagram integratsiyasi haqida. Mas’ul operator — Abdulloh Abdusamatov, O‘zbekiston. Savol, tuzatish yoki o‘chirish so‘rovi: allos.uzchat@gmail.com. Ulanishni uzish CRM tarixini avtomatik o‘chirmaydi; o‘chirish yo‘riqnomasi hamma uchun, ALLOS’ga kirmasdan ochiq.

1. Who is responsible

The responsible operator of ALLOS for this integration is Abdulloh Abdusamatov, Uzbekistan. Privacy and deletion contact: allos.uzchat@gmail.com. This notice covers Meta Platform Data used by the ALLOS Instagram integration; it does not replace a client business’s own customer privacy notice.

Each client business chooses the professional account, branch, authorized employees and customer-service purposes for its CRM use. ALLOS provides the technical service on those instructions and remains responsible for its own operation, access controls and handling of data. A client’s responsibility does not remove ALLOS’s obligations to users or Meta. The separate, limited MENSWEAR authorization for Meta administration is described in the legal notice; it does not transfer ownership of ALLOS or automatically make MENSWEAR the operator of client CRM data.

2. Data received

• Connection information: selected Facebook Page and professional Instagram account identifiers, Page name, Instagram username, granted permissions and access tokens needed for the selected connection. ALLOS does not ask for or store your Facebook or Instagram password.
• Direct conversations: Instagram-scoped sender and message identifiers, message text, direction and timestamps; employee replies and their delivery status. Media notifications may be represented by a notice to open Instagram rather than a transferred file.
• Optional account insights: current follower and content counts, views, reach, engaged accounts, interactions, likes, comments, saves, shares and daily reach for the requested dates, only when the account owner separately grants the Insights permission. A comment count is not the text of a comment.
• Service and security records: company/branch connection mapping, short-lived authorization state, permissions and audit events needed to operate the integration and investigate failures. Access tokens are not included in ordinary employee status or report responses.

3. Why and how the data is used

ALLOS uses these data to connect the account chosen by its owner, receive and display customer conversations in that business’s CRM, deliver authorized employee replies, provide requested account analytics, prevent duplicate delivery and protect the service. The integration does not use these data to buy advertisements, sell customer lists, build cross-company customer profiles or train an AI model. The integration does not automatically enable every function of the Instagram mobile app.

Available functionality depends on implemented ALLOS features and permissions approved by Meta. At this notice’s date the integration implements Direct text and optional read-only account insights. It does not yet implement comment replies/moderation, media transfer, message editing/unsending or importing old conversations. Those features must not be represented as already available.

4. Access, hosting and sharing

Client data is separated by company and branch. Employee access follows the client’s assigned roles and CRM/Marketing permissions; connecting an account requires the company owner’s authorization. Connection secrets are encrypted in server storage. The shared app credential is held by the platform, not shown to client employees. These controls reduce risk but are not a guarantee that an incident can never occur.

The current hosting provider is Render Services, Inc., a US company; the current ALLOS service is deployed in its Frankfurt, Germany region. Hosting and authorized support can involve processing outside Uzbekistan, including by Render and its subprocessors. See Render Privacy Policy, Data Processing Addendum and subprocessor information. An email deletion request is handled through the ALLOS Gmail contact; do not include conversation contents or credentials in the initial email.

Meta receives authorization requests, authorized replies and API calls necessary to provide its own service. Meta’s own processing is described in the Instagram Privacy Policy. ALLOS does not make a client’s conversations visible to other client businesses.

5. Retention and disconnecting

Connection tokens are kept while the connection is needed. Disconnecting the branch in ALLOS removes that branch’s stored connection tokens and pending authorizations and clears the local analytics cache. It does not itself delete existing CRM conversation history or revoke permissions you gave other apps.

CRM conversation history is retained for the client’s ongoing customer-service use until separately deleted or covered by a verified deletion request; there is currently no automatic age-based purge of that history. Reports are reused from a ten-minute cache rather than continuously polled. Authorization state is valid for ten minutes. These validity/cache intervals are not a promise that every stored row is physically erased at that exact time.

When data is no longer needed for the stated purpose, or a valid user, client or Meta deletion request applies, the operator must arrange deletion without undue delay. A specific legal retention requirement may limit deletion; its basis and affected data must be documented and communicated where permitted. Backup copies require a separate retention/deletion review and must not silently restore data that has already been deleted. ALLOS does not claim that disconnecting instantly erases every backup or the original messages held by Meta.

6. Your choices and requests

You can decline optional Insights access, disconnect the branch, or remove ALLOS’s permissions in your Meta account. To request access, correction or deletion of data held by ALLOS, contact allos.uzchat@gmail.com or follow the data deletion instructions. Requests are available to account owners, client businesses and people whose messages were received; an ALLOS login is not required.

We verify the requester’s authority before changing or disclosing data. Do not send passwords, tokens, one-time codes or identity-document scans in the initial request. Any necessary follow-up should be proportionate to the request.

7. Legal requests and changes

A request from a public authority is not, by itself, permission for unrestricted access. The operator must check the applicable lawful basis and limit any response to necessary information. Changes to this notice are dated here; additional processing or permissions require the relevant disclosures, user consent and Meta approval where applicable.