Privacy Policy
Effective 3 November 2026 · Last updated 3 November 2026
This policy explains what data Afkat ("Afkat", "we", "us") collects, why, who we share it with, how long we keep it, and how you can have it deleted. Afkat is operated by SmartSpark Services, Arizona, USA. Questions go to info@smartsparkservices.com.
In short
- We use your data only to provide Afkat: creating, publishing and measuring your Instagram and Facebook Page content, and answering your customers on your behalf.
- We do not sell data, do not use it for advertising, and do not share data obtained from Instagram or Facebook with data brokers or anyone else except the service providers needed to run Afkat.
- Instagram and Facebook access tokens are encrypted, and you can disconnect or delete everything at any time (Data Deletion Instructions).
1. Who this policy covers
- Business users: people who sign up for Afkat, or join a business on it, and connect the business's Instagram professional account or Facebook Page. For their account data we are the data controller.
- Their customers: people who comment on the posts of, or send messages to, an Instagram account or Facebook Page connected to Afkat (including messages on Messenger). We process this data on behalf of that business (as its processor), under the business's instructions. The business is responsible for its own use of it.
2. Data we collect
From business users, directly
- Account data: name, email address, and password (stored only as a salted hash; we never store the password itself). If you sign in with Google, we receive your Google account ID, name and email address instead of a password.
- Business data: business name, description, location, products, prices, availability, delivery terms, FAQs, brand voice and business rules.
- Product photos you upload, and your logo.
- Brand photos: photos of your place, team or work, with your description of each and your confirmation that everyone recognisable in them agreed to appear. They may show staff or customers. Afkat draws them onto post images itself; they are never sent to an AI image provider. Only your written description is sent to our text AI provider, to plan posts.
- Your library and settings: statements about your field you approve (with any evidence links you add, which we fetch from approved sites to check them), the countries your customers live in, the occasions you choose to mark, and your sound and card style settings.
- Notification contacts: the WhatsApp numbers where the business wants to receive alerts.
- Team invitations: the email address of someone a business owner invites to join the business.
- Terms acceptance: which version of our Terms of Service you accepted and when, with your IP address and browser user agent at that moment, as a record of the agreement.
- Technical data: sign-in times, IP address and browser user agent, for security and session management.
Generated by Afkat
Content plans, captions, generated images, videos, voiceovers and music, validation results, and records of what was published and when.
3. Data from Instagram
When a business user connects an Instagram professional account through Instagram's official login, Afkat asks for these permissions and receives only the data they allow:
| Permission | What we receive | Why |
|---|---|---|
instagram_business_basic | Account ID, username, account type, and the account's own posts. | Identify the connected account and confirm what was published. If the business allows it (on by default), suggest library statements from the captions of its earlier posts. |
instagram_business_content_publish | Ability to publish posts, carousels, Reels and Stories. | Publish the content the business has scheduled. |
instagram_business_manage_comments | Comments on the account's posts: the commenter's Instagram ID and username, comment text and time. | Answer customer questions from the business's facts, or pass them to the owner. |
instagram_business_manage_messages | Direct messages sent to the account: the sender's Instagram-scoped ID, username, message text and time. | Answer customer messages, or pass them to the owner. |
instagram_business_manage_insights | Post metrics such as views, reach, likes, comments, saves and shares. | Show performance and improve future content plans. |
4. Data from Facebook
When a business user connects a Facebook Page through Facebook Login for Business, Afkat asks for these permissions and receives only the data they allow, for the one Page the user chooses:
| Permission | What we receive | Why |
|---|---|---|
pages_show_list | The list of Pages the user manages. | Let the user choose which Page Afkat runs. Only the chosen Page is stored. |
pages_manage_posts | Ability to publish to the Page. | Publish the content the business has scheduled. |
pages_read_engagement | The Page's posts and the comments on them. | Link comments to their post and confirm what was published. If the business allows it (on by default), suggest library statements from its earlier posts. |
pages_read_user_content | Comments people leave on the Page's posts: the commenter's Page-scoped ID, name, comment text and time. | Answer customer questions from the business's facts, or pass them to the owner. |
pages_manage_engagement | Ability to reply to comments on the Page's posts. | Post those answers. |
pages_manage_metadata | Ability to subscribe the Page to our notifications. | Receive new comments and messages as they arrive. No other Page setting is changed. |
pages_messaging | Messenger messages sent to the Page: the sender's Page-scoped ID, name, message text and time. | Answer customer messages, send a private reply to a commenter, or pass them to the owner. |
read_insights | Post metrics such as views, reach, reactions, comments and shares. | Show performance and improve future content plans. |
For Instagram and Facebook alike, we store the access token the platform issues so Afkat can act for the account or Page. We use this data only to provide Afkat to the business that connected it. We do not use it to build profiles of individuals, for advertising, or for any purpose unrelated to that business, and we comply with the Meta Platform Terms.
5. How we use data
- To provide Afkat: plan, generate, check, schedule and publish content; answer comments and messages; notify the owner on WhatsApp when a human is needed; and report performance.
- To keep Afkat secure and working: authentication, abuse prevention, troubleshooting and audit logs.
- To communicate with business users about their account and the service.
- To meet legal obligations.
Our legal bases, where the law requires one, are performance of our contract with the business user, our legitimate interest in running a secure service, and legal obligation. We do not make decisions with legal or similarly significant effects about individuals by automated means.
6. AI processing
Suggestions from your own posts and replies
Afkat can suggest statements for a business's library from its descriptions and FAQs, the captions of its own earlier posts (on by default; the owner can turn it off) and, only if the owner turns it on, the owner's own replies to customers. Before a reply is used, customers' names, usernames and numbers are removed. A suggestion becomes part of the library only when the owner approves it; until then it is kept for up to 60 days, and a rejected or expired one keeps its text for up to 90 days. If a customer's data is erased, the unapproved suggestions made from their conversation are deleted.
What we send to AI providers
Afkat uses AI models to write captions, replies and voiceover scripts, and to create images, videos, voiceovers and music. We send each provider the minimum needed for its task: for example product facts and photos for content, a voiceover script for speech, or the text of a customer's message and the relevant business facts for a reply. We do not send passwords, access tokens or payment data, and we replace customer identifiers with internal references where possible.
- OpenAI (text: captions, replies, scripts, checks) does not use data sent through its API to train its models by default, and keeps it for up to 30 days to monitor abuse. This is the only AI provider that receives customers' messages.
- Higgsfield (images and videos) receives product photos and the visual briefs Afkat writes, and ElevenLabs (voiceovers and music) receives voiceover scripts and music descriptions. They receive no customer messages, account details or brand photos. They process what we send under their own terms, which may allow them to use it to improve their services.
AI output is treated as a suggestion: prices, availability and other facts in published content and replies are checked against the data the business provided.
7. Who we share data with
We do not sell or rent personal data. We share it only with service providers that help us run Afkat, under contracts that limit their use to providing their service to us:
| Provider | Purpose | Data involved |
|---|---|---|
| Meta Platforms (Instagram, Facebook, WhatsApp) | Publishing, comments and messages; owner notifications | Content to publish, replies, alerts to the owner |
| OpenAI | Text generation and checks | Business facts, product photos, brand photo descriptions, message text, and the owner's replies if learning is on |
| Higgsfield | Image and video generation | Product photos, creative briefs and background descriptions |
| ElevenLabs | Voiceovers and music for videos | Voiceover scripts and music descriptions |
| Sign-in with Google, if you choose it | Your Google account ID, name and email | |
| Resend | Account emails (verification, password reset, invitations) | Email address and the email's content |
| Hosting, database, file storage and backup providers | Running the service | All data described in this policy, stored encrypted |
We may also disclose data if required by law, to protect the rights and safety of our users or others, or as part of a merger or acquisition, in which case this policy continues to apply to it.
8. How long we keep data
| Data | Kept for |
|---|---|
| Instagram and Facebook access tokens | Until the account or Page is disconnected or access is revoked, then deleted immediately |
| Business data, products, photos and generated content | While the business exists on Afkat; deleted within 30 days of a request to delete it |
| Customer comments and messages | Up to 12 months after the conversation's last message, or less if the business deletes them |
| Raw notifications from Instagram and Facebook | Up to 30 days |
| Post metrics | While the business exists on Afkat |
| Brand photos | Until the business deletes them, or the business itself is deleted |
| Library suggestions not yet approved | Up to 60 days; rejected or expired ones keep their text for up to 90 days |
| Invitations to join a business | Up to 30 days after they are accepted, withdrawn or expire |
| Data exports | Available to download for 7 days, then deleted |
| Record of accepting the Terms of Service | While your account exists |
| Security and audit logs | Up to 12 months |
| Encrypted backups | Expire within 35 days |
9. Deleting your data
You can disconnect your Instagram account or Facebook Page, delete your business, or ask us to delete your data at any time. If you commented on or messaged a business that uses Afkat, you can ask that business or us to delete your data. If you appear in a business's brand photo, you can ask that business (or us, and we will pass it on) to remove it: deleting the photo stops the posts not yet published that show it; posts already published stay on Instagram or Facebook until the business removes them there. Full steps are on the Data Deletion Instructions page. We complete deletion requests within 30 days.
10. Security
- All traffic uses TLS. Databases and file storage are encrypted at rest.
- Instagram, Facebook and WhatsApp access tokens are encrypted with a per-account key and are never written to logs.
- Each business's data is isolated from every other business's data, and access within a business requires sign-in and membership of that business.
- Passwords are hashed with Argon2id.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive a copy of it in a portable format, and to withdraw consent. To use these rights, email info@smartsparkservices.com. We reply within 30 days. If your data was collected on behalf of a business (as a customer who commented or sent a message), we will pass your request to that business and help it respond. You can also complain to your local data protection authority.
12. International transfers
Our service providers may process data in countries other than yours, including the United States. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses.
13. Children
Afkat is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
14. Changes to this policy
We will post any changes on this page and update the date at the top. If a change is significant, we will notify business users by email before it takes effect.
15. Contact
SmartSpark Services
Arizona, USA
Email: info@smartsparkservices.com