Privacy Policy

Last updated: October 10, 2026

This Privacy Policy explains how PlanReply (“PlanReply”, “we”, “us”) collects, uses and protects personal data when you visit planreply.com, join our waitlist, use PlanReply as a creator, or interact with an Instagram or Facebook account that uses PlanReply.

1. Who we are

PlanReply is operated by Bro print MB, company code 307779094, registered in the Republic of Lithuania. For website visitors, waitlist members and creators who use PlanReply, Bro print MB is the data controller. Contact: hello@planreply.com.

When a creator uses PlanReply to automate conversations with their audience, the creator decides why and how their audience’s data is used. For that audience data the creator is the controller and PlanReply acts as a processor on the creator’s behalf.

2. Data we collect

Waitlist and website

• Your email address, the date and time you joined, and which form you used (for example “hero” or “pricing”).
• A one‑way hash of your IP address, used only to prevent abuse and spam signups. We do not store your IP address in plain text for the waitlist.
• Standard server logs (IP address, browser user agent, requested page, time) kept for security and troubleshooting.

Creators who connect an Instagram account

• Instagram account ID, username, name and profile picture, provided by Meta when you log in with Instagram.
• Access tokens issued by Meta, stored encrypted and used only to provide the service.
• Your posts and Reels, captions, the videos you upload for scheduling, and insights such as views, reach, shares and saves.
• Your automation settings (keywords, messages, links) and account settings.
• When paid plans launch: billing details handled by our payment provider Stripe. We never see or store full card numbers.

People who interact with a creator’s account (audience data)

Through the official Meta APIs (Instagram API with Instagram Login, and later the Messenger Platform), PlanReply processes the following data about people who comment on, message, reply to or mention a creator’s account that uses PlanReply:

• Instagram‑scoped user ID (profile ID) and username;
• comments (text, comment ID, the post it was written on, time);
• direct messages exchanged with the creator’s account, including button taps, story replies and story mentions;
• follow status, meaning whether the person follows the creator’s account (checked only when the creator enables the “must follow first” step);
• an email address, only if the person types it into the conversation when asked.

We do not access data that Meta does not make available through its APIs, we do not scrape Instagram or Facebook, and we never ask for anyone’s password.

3. How we use data and legal bases

We do not sell personal data. We do not use data received from Meta for advertising, profiling for third parties, or to build data broker profiles, and we use it only as permitted by the Meta Platform Terms and Developer Policies.

4. Emails collected for creators

When a creator enables email capture, the email a person types in a DM is checked (fake, disposable and typo addresses are rejected), stored for that creator, shown in the creator’s dashboard, can be exported as CSV, and can be sent to the email list provider the creator connects. The creator is responsible for having a lawful basis to email those contacts and for honouring unsubscribe requests.

5. Who we share data with

• Meta Platforms (Instagram and Facebook), to read comments and messages, send replies and publish content through the official APIs.
• Email provider, to send waitlist and service emails, and to deliver collected emails to the email list provider a creator connects.
• Hosting and infrastructure providers that run our servers in the European Union and the United States.
• Stripe, to process payments once paid plans launch.
• Authorities, if required by law.

All providers process data only on our instructions and under appropriate data processing agreements.

6. Where data is stored

Data is stored on servers located in the European Union and the United States. When data is transferred outside the European Economic Area we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU‑US Data Privacy Framework.

7. How long we keep data

• Conversation state (where a person is in an automation, button taps, follow check results): up to 90 days after the last interaction, then deleted. This is also how we make sure each person goes through an automation at most once per 90 days.
• Waitlist emails: until you unsubscribe or ask us to delete them, and in any case no longer than 24 months after you joined if you do not become a user.
• Creator account data: while the account is active. When a creator disconnects PlanReply or deletes their account, we delete their data within 30 days, except where we must keep records by law.
• Emails collected for a creator: while the creator keeps them in PlanReply, or until the person or the creator asks us to delete them.
• Server logs: up to 30 days.

8. Security

We use HTTPS everywhere, encrypt access tokens at rest, limit staff access to what is necessary, and keep our systems up to date. No system is perfectly secure, but we work hard to protect your data and will notify affected people and authorities of a breach where the law requires.

9. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To use any of these rights, email hello@planreply.com. To delete data collected through an Instagram conversation, see our Data deletion page.

You can also lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or your local supervisory authority.

10. Messaging opt‑out

Anyone who receives messages through a PlanReply automation can reply STOP to stop receiving automated messages from that account.

11. Cookies

planreply.com does not use advertising or tracking cookies. We only use what is strictly necessary for the site to work.

12. Children

PlanReply is not directed at children under 16 and we do not knowingly collect their personal data.

13. Changes

We may update this policy as PlanReply grows (for example when paid plans or Facebook support launch). We will change the date above and, for important changes, notify users by email.