Privacy policy

Xukko is operated by Xukko, [registered address], India. For anything in this policy, write to hello@xukko.com.

For the account data of businesses that sign up, we decide how it is used. For the comments and messages of people who contact those businesses, the business decides what its automations do, and we process that data on the business’s behalf and on its instructions.

From businesses that sign up

• Your name, email address and password (stored only as a one-way hash).
• Your business name, time zone and the team members you invite.
• The content you give us to answer customers: automation rules, message templates, link buttons, your business description, price list and FAQs.
• Posts and reels you schedule, including the images and videos you upload.

From your Instagram account, through Meta’s official API

When you connect Instagram and grant permission, we receive:

• Your Instagram profile: account ID, username, name and profile picture.
• Your posts and reels: captions, thumbnails, links and publish times, so you can choose which ones to automate.
• An access token that lets us act for your account. We never see or store your Instagram password.

From people who comment on or message a connected business

• Their Instagram-scoped ID, username, name and profile picture, as Instagram provides them for business messaging.
• The text of comments on the business’s posts and reels, direct messages, story replies and story mentions sent to the business, and the replies sent back.
• Contact details they choose to share in the chat, such as an email address or phone number, when the business has asked for them.

When you use the website

• Basic technical logs (IP address, browser type, pages requested, errors) to keep the service secure and working.
• A sign-in cookie that keeps you logged in. We don’t use advertising cookies or third-party trackers on the app.

We use this data only to run Xukko for the business that connected the account:

• to detect comments and messages that match the business’s rules and send the replies it set up;
• to write AI answers from the business’s own price list and FAQs, when the business turns that on;
• to show conversations in the inbox and contacts in the Contacts list;
• to publish the posts and reels the business schedules;
• to keep accounts secure, prevent abuse, fix problems, and send service emails such as sign-in links and important changes;
• to meet legal obligations.

We do not sell personal data. We do not use Instagram data for advertising, to build profiles of people across businesses, or to train AI models.

Xukko accesses Instagram only through Meta’s official APIs and follows the Meta Platform Terms and Developer Policies. In particular:

• We request only the permissions needed for the features you use, and you can see them before you agree.
• Data we receive from Instagram is used only to provide Xukko to the business that connected the account. It is not sold, licensed or shared with data brokers or advertising networks.
• We follow Instagram’s messaging rules, including the 24-hour messaging window and one private reply per comment.
• We delete Instagram data when it’s no longer needed, when you ask, or when Meta asks us to.

You can remove Xukko’s access at any time from Instagram (Settings, then Website permissions, then Apps and websites) or by disconnecting in Xukko. Xukko is not affiliated with or endorsed by Meta or Instagram.

We share data only with service providers that help us run Xukko, under contracts that limit their use:

• cloud hosting and database providers, which store the data;
• an email provider, which sends sign-in and service emails;
• a media storage provider, for images and videos you upload for scheduled posts;
• an AI model provider, which receives the customer’s question and the business’s price list and FAQs to write an answer, only when the business has turned on AI answers, and is not permitted to use them to train its models.

We send messages and posts to Instagram, because that’s where they’re delivered. We may disclose data if the law requires it, and to a buyer if Xukko or Xukko is sold, under this same policy. A current list of service providers is available on request from hello@xukko.com.

• While your account is active, we keep your rules, conversations and contacts so the inbox and Contacts keep working.
• When you disconnect Instagram, we delete the access token straight away and stop receiving new comments and messages.
• When you delete your workspace or ask us to delete your data, we delete it from our systems within 30 days. Backups are overwritten within a further 30 days.
• Server logs are kept for up to 90 days.
• We keep billing records for as long as Indian tax law requires, once paid plans start.

Under India’s Digital Personal Data Protection Act, 2023 and other laws that apply to you, you can ask to see the personal data we hold about you, correct it, or have it deleted, and you can withdraw consent you gave earlier. Write to hello@xukko.com. We reply within 30 days.

If you messaged or commented on a business that uses Xukko, you can contact that business, or write to us with your Instagram username and we’ll delete the data we hold about you for that business. Step-by-step instructions are on the data deletion page.

Grievance officer: [name], Xukko, [registered address]. Email: hello@xukko.com.

Data is encrypted in transit, access tokens are encrypted at rest, and only the staff who need access to run the service have it. No system is perfectly secure; if a breach affects your data, we’ll tell you and the authorities as the law requires.

Xukko is for businesses and is not meant for anyone under 18. We don’t knowingly collect data from children for our own purposes. If you think a child’s data has reached us, write to hello@xukko.com and we’ll delete it.

Our service providers may store and process data outside India. When they do, we use providers that protect it to the standard this policy describes, and we follow any transfer restrictions the Indian government sets.

If we make a significant change, we’ll email workspace owners and show a notice in the app before it takes effect. The date at the top says when this policy last changed.

Xukko, [registered address], India. Email hello@xukko.com.