Privacy Policy

1. Who we are

OwlHook is a product of OwlKraft, a sole proprietorship of Abhay Choudhary. In this policy, “OwlKraft”, “we” and “us” mean Abhay Choudhary, sole proprietor, trading as OwlKraft, registered in Haryana, India, at 4-5, Rameshwar Nagar, Yamunanagar, Haryana 135001, India. You can reach us at hello@owlhook.com.

This policy covers the OwlHook service and this website, owlhook.com. It explains what personal data we process, why, where, for how long, who we share it with, and how you can control it.

2. Our role: whose data, whose decisions

OwlHook processes three kinds of personal data, and our role depends on whose data it is.

• Our customers' own data (the businesses that use OwlHook, and the people who manage their accounts): we decide why and how it is processed, so we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• Instagram data about the people who interact with our customers (people who comment on a customer's posts or message a customer's Instagram account): we process it only on behalf of that customer and on their instructions, to run the automations they set up. The customer is the Data Fiduciary and we are their Data Processor. Meta's terms for apps that serve other businesses treat us the same way: we act for our customers.
• Instagram data about the people who interact with our own accounts (the Instagram accounts we use to test and demonstrate OwlHook): we decide how it is used, so we are the Data Fiduciary. We collect the Instagram data listed in section 3, use it only to test, demonstrate and fix OwlHook, and keep it no longer than section 7 says.

If you commented on or messaged a business that uses OwlHook, that business decides how your data is used. Please contact them first about your data; we help them answer. You can also contact us, as section 9 explains.

3. What we collect and why

From our customers

• Account and contact details: name, email address, phone number, business name and the messages you send us. We use them to provide the service, support you and tell you about changes.
• Your Meta connection: when you connect through Meta's login (Facebook Login for Business), Meta gives us an access token for the business portfolio and Instagram accounts you chose, the permissions you granted, the IDs and usernames of those Instagram accounts, your business portfolio ID, and the Meta user ID and name of the person who connected. We use them to run your automations, keep the connection working, and match deletion requests to the right account.
• Your automations: keywords, the posts and reels you choose, reply texts, messages, links and settings.
• Usage and billing: how many replies and messages OwlHook sent for you, your plan, your GSTIN, invoices and payment status. Payments are handled by our payment gateway; we don't receive your full card number or UPI PIN.
• Records of your agreement to our terms: which version, when, and the IP address it came from.

Instagram data we process for our customers

We receive this from Meta through Meta's official Instagram API and webhooks, and only for the Instagram professional accounts our customers connect and our own accounts that we use to test and demonstrate OwlHook:

• Comments on the customer's posts and reels: the comment's text, time and ID, the post or reel it is on, the comment it replies to, and the commenter's Instagram username and Instagram-scoped ID.
• Direct messages in conversations with the customer's account: the text of messages sent to and from the account; photos, videos, voice notes, stickers, and posts or stories people share (as Meta's links to them); button taps and quick replies; reactions; read receipts; referral details, such as the ad or link that opened the conversation; their times and IDs; the sender's Instagram-scoped ID and, where Meta provides it, their username; and whether a message was unsent.
• The customer's posts and reels: their IDs and the details Meta provides so the customer can choose them.
• Our own records: which replies and messages OwlHook sent, when, and Meta's response; who opted out by replying STOP; and which conversations are paused for a human.

We use this data only to provide OwlHook to that customer:

• to decide whether a comment or message matches the customer's automations;
• to send the public replies and messages the customer configured;
• to honour opt-outs and requests for a human, and to avoid messaging the same person twice;
• to stay within Meta's limits;
• to show the customer what happened to each comment and conversation; and
• to find and fix problems with the service.

We don't sell or license this data, use it for advertising, build profiles of people, or combine one customer's data with another's. We don't use it to train AI models. OwlHook doesn't send this data to any AI service today; if that changes, we'll update this policy and name the provider first.

From visitors to this website

This website sets no cookies and runs no analytics, tracking, advertising or third-party scripts. It has no forms: the early-access button opens your own email app. Cloudflare, which hosts the site, processes your IP address and request details to deliver the pages and protect them from attacks. If you email us, we receive what you send.

4. Why we're allowed to process it

We process our customers' data because they give it to us to use OwlHook (a legitimate use under section 7(a) of the DPDP Act), to meet obligations under Indian law such as tax and cyber-security record keeping, and otherwise with consent. You can withdraw consent by emailing us; this doesn't affect processing already done, but we may then be unable to provide the service.

For Instagram data we process as a Data Processor, the customer is responsible for having a lawful basis and for giving any notice the law requires to the people they interact with. Our Terms of Service require this.

For Instagram data about people who comment on or message our own accounts, we are the Data Fiduciary. We use what they send to those accounts only to reply to them and to test, demonstrate and fix OwlHook, and they can ask us to stop or to delete it at any time.

5. Who we share it with

These service providers process personal data for us, only to provide OwlHook and under written data processing terms that require them to protect it:

These providers handle our own communications under their standard terms:

We add error-tracking and monitoring providers to these lists before they receive any personal data, including IDs or IP addresses. Before we start taking payments, we'll add our payment gateway. We update the lists before adding any provider that receives personal data.

• Meta: the replies and messages OwlHook sends for a customer go through Meta's API. Meta's own terms and privacy policy apply to Instagram. Meta's terms for apps that serve other businesses let Meta ask us which businesses use OwlHook; when it does, we give it each business's name, contact details and connected accounts.
• Authorities: we disclose data to a government authority only when Indian law requires it, after checking that the request is lawful. Where the law allows, we tell the affected customer first.
• A change of ownership: if the OwlHook business is transferred, its data goes with it, still protected by this policy.

6. Where your data is stored

Our application servers and database are in India (Bengaluru). Meta's webhooks reach us through Cloudflare's global network, which may process them outside India on the way. Short-term copies of webhooks and our encrypted nightly database backups are stored outside India, in Cloudflare R2 in the Asia-Pacific region. Email we receive is stored by Google. Any transfer outside India is made in line with the DPDP Act, which allows it except to countries the Government of India restricts.

7. How long we keep it

Deleted data can remain in encrypted database backups for up to 30 days, until those backups expire; we don't restore it except to recover from an incident. Where Indian law requires us to keep certain data or logs for a set period, we keep only what it requires, with restricted access, and delete it when the period ends.

8. How we protect it

• All connections to OwlHook and between our systems use HTTPS.
• We check Meta's signature on every webhook before accepting it.
• Access tokens from Meta are encrypted at rest.
• Each customer's data is kept separate from every other customer's in our database.
• Our logs record IDs and counts, not the text of comments or messages.
• Only the proprietor has administrative access, with two-factor authentication.

If a personal data breach affects a customer's data, we tell that customer within 24 hours of becoming aware of it, so they can meet their own reporting duties. We also report to CERT-In, the Data Protection Board of India and Meta as the law and Meta's terms require.

9. Your rights and choices

If you are an OwlHook customer

Under the DPDP Act you can ask us for a summary of the personal data we process about you, correct or complete it, erase it, withdraw consent, and nominate someone to exercise these rights if you die or become unable to. Email us from the address on your account, so we can confirm the request is yours. We reply within 30 days.

If you commented on or messaged a business that uses OwlHook

• Reply STOP in the conversation to stop that business's automated messages.
• If you unsend a message on Instagram, OwlHook removes its text from our database; copies in Cloudflare's short-term storage and in backups are deleted on the schedule in section 7.
• For anything else, contact the business; we help them answer. You can also email us, and we'll pass your request to the business and help it respond.

If you commented on or messaged one of OwlHook's own accounts

Reply STOP to stop automated messages, or email us: we handle your request ourselves and reply within 30 days.

To have data deleted, follow our Data Deletion instructions.

10. Removing OwlHook's access to Instagram

A customer can remove OwlHook's access at any time in Meta's settings: in the business portfolio's Business Settings, open Integrations → Connected apps, choose OwlHook and remove it. Meta may label these screens slightly differently. Removing access stops OwlHook from reading or acting on your accounts; to delete what we already hold, see Data Deletion.

11. Children

OwlHook is a service for businesses. Customer accounts must be opened and managed by adults. We don't knowingly process children's data for our own purposes. Customers must not use OwlHook to target children, and as Data Fiduciaries they are responsible for any parental consent the law requires for the people they message.

12. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we process customers' data, we email customers before it takes effect.

13. Contact and grievances

Questions about this policy or how we process personal data go to our Grievance Officer, who is also our contact for personal data under the DPDP Act:

Email the Grievance Officer with “Grievance” in the subject. Include your name, how to reach you, the email address of your OwlHook account or the Instagram account involved, and what happened.

• We acknowledge your complaint within 24 hours, with a reference number and a copy of the complaint as we recorded it.
• We resolve it, and tell you what we did, within 7 days.
• If you're not satisfied, you can approach the National Consumer Helpline (consumerhelpline.gov.in) or, for a complaint about personal data, the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

OwlKraft · 4-5, Rameshwar Nagar, Yamunanagar, Haryana 135001, India