KaroPost Privacy Policy

1. Introduction & Scope

This privacy policy describes how KaroPost Global Inc. ("Company", "we", "us", or "our") collects, protects, stores, and processes information when you utilize our social media management, auto-direct messaging, and omnichannel conversational commerce platform.

2. Use of Instagram & Meta Platform Data

KaroPost uses Instagram data strictly to provide authorized comment monitoring, automatic DM replies, and scheduled media publishing for accounts explicitly connected by users:

• We only access necessary scopes: instagram_basic, instagram_manage_messages, and instagram_manage_comments.
• We NEVER request, store, or process user account passwords. Connections are established exclusively via Meta's OAuth 2.0 handshake.
• We NEVER sell, rent, or transfer Instagram data to advertising brokers or unauthorized third parties.

3. Security & AES-256 Token Encryption

All client access tokens and webhook secret keys are encrypted at rest using military-grade AES-256-GCM. All inbound and outbound traffic is enforced through modern TLS 1.3 protocol. Our server architecture is completely multi-tenant, ensuring strict database isolation between accounts.

4. Data Deletion & Right to be Forgotten (GDPR & CCPA)

Users may request permanent deletion of their connected Instagram and customer data at any time either via the self-service "Delete Account" button in their dashboard or by emailing privacy@karopost.com. All associated records, tokens, conversation histories, and media files will be irrevocably expunged within 7 business days.