Privacy Policy

Who is responsible

The data controller is Drum Class S.R.L., Via San Giovanni Bosco 4, 20100 Milan, Italy, VAT IT13191870966, Milan register of companies REA 2751862. It is the company behind Liaison. Questions about this policy or about your data go to support@liaisone.com, and we answer within 30 days.

ReplyLia is not a service sold to other companies. It connects only Instagram accounts that Drum Class S.R.L. owns and operates.

Whose data we process

There are two groups, and they are different.

People who comment on or send a message to one of our Instagram accounts. We receive what Meta sends us: the Instagram scoped user ID, the username, the text of the comment or message, and the identifier of the post it belongs to. We use it to decide whether the comment matches a keyword and to send a reply.

Members of the Liaison team who sign in. We store the email address used to sign in and the session that follows from it.

What we store

Instagram account identifiers and access tokens for our own accounts, encrypted at rest. Campaign settings, meaning the keywords and the reply text a person wrote. Incoming webhook payloads. Delivery logs recording which message went to which recipient and when. Clicks on links we sent. Periodic snapshots of follower counts on our own accounts. Diagnostic records when something fails.

Why we are allowed to do this

Our legal basis is legitimate interest under Article 6(1)(f) GDPR: answering people who publicly ask us a question under our own posts, and keeping a record of what was sent. Someone who comments a keyword on our post is asking to be contacted, and every reply is a reply to that.

We do not sell this data, we do not use it to build advertising audiences, and we do not combine it with data from other sources.

Instagram and Meta

ReplyLia never asks for an Instagram password, does not scrape Instagram, and does not drive a browser. It calls the official Meta APIs with a token our own account granted. Tokens are encrypted at rest and used only for actions the connected account authorised.

Meta is an independent controller for the data it holds about the same people. Their handling of it is governed by their own policy, not by this one.

Where the data lives

On a server rented from Hetzner Online GmbH in Nuremberg, Germany. Sign in emails are delivered by Resend. The database and the queue run on that same server and are not shared with anyone. No data is transferred outside the European Economic Area by us.

How long we keep it

Delivery logs and the comments that triggered them: 12 months. Link clicks: 12 months. Follower snapshots about our own accounts: 24 months. Sign in sessions: 30 days. Instagram tokens: until the account is disconnected, then deleted. Diagnostic records: 90 days.

Your rights

You can ask what we hold about you, ask for a copy, ask for a correction, ask us to delete it, or object to the processing described above. Write to support@liaisone.com from any address, or send us a direct message from the Instagram account in question, which is often the fastest way for us to find the right record.

The Data Deletion page, linked in the footer, explains exactly what a deletion request removes.

If you think we have handled your data badly, you can complain to the Garante per la protezione dei dati personali in Italy, or to the supervisory authority where you live.