Privacy policy

Who we are

Arcdrop is operated by Nuttapol Pechsiri. In this policy, "Arcdrop", "we" and "us" mean the operator. For any question about your data, write to privacy@arcdrop.app.

What Arcdrop does

Arcdrop helps businesses and creators answer Instagram comments and messages automatically, share links and collect the email addresses people choose to leave with them. A business or creator (a customer) creates an Arcdrop account and connects an Instagram professional account they manage. This policy covers our customers, the people who interact with our customers on Instagram, and the people who open our customers’ links or leave their email address with them.

Data we collect

• Account data: your email address, your password (stored only as a secure hash by our sign-in provider), your language and the workspaces you belong to.
• Instagram connection data: when you connect an Instagram professional account, Meta gives us its id, username, name, account type, the permissions you allowed and an access token, and the ids of the business integration you approved and of your business portfolio. We use those two ids to match a request from Meta to your connection. We store the access token encrypted.
• Posts: when you open the list of your posts in Arcdrop, we read their captions, type, link and date from Instagram to show them. We do not copy your photos or videos.
• Comments and messages: once you turn on DM automation for an Instagram account, Meta sends us its comment and message events. When one matches an automation, we keep the Instagram id and username of the person who wrote, the text and what was sent, as the delivery history. When one matches none, we keep only that the event arrived (its id, the post and the time), not who wrote it or what it said. Nothing of this is received before you turn DM automation on.
• Contacts: the people an automation answered, with their Instagram id and username, where they came from (a comment, a message or a story mention, for example) and the tags automations add, such as lead. Each new email address left on a Lead Gate page also becomes a contact, which holds nothing but its link to that address.
• Follow checks: when an automation sends its link only to followers, we ask Instagram whether the person follows the account, and keep the answer and when we asked.
• Past comments (Rewind): when you start Rewind for an automation, we read the comments on its posts from the last 7 days through Instagram and handle the ones that match it as if they had just arrived. We keep nothing of the comments that match none.
• Smart Links: the links you create and where they lead. When someone opens one, we record the click with its time, country and type of device.
• Lead Gate visits: when someone opens a link with a Lead Gate, we record the visit with its country, the type of device and whether it was opened inside an app such as Instagram. We do not keep the IP address or the browser’s details with it.
• Email addresses: a person can leave an email address on a customer’s Lead Gate page, or by answering an automated message that asks for it. We keep the address encrypted, with a keyed hash that lets us recognize the same address again without reading it, the consent the person gave, the version of the notice they saw and when, and, on a Lead Gate page, whether they asked for updates from the customer. The message that carried an address is not kept as text. When the customer’s plan has used its monthly allowance of new leads, a new address is not stored at all; on a Lead Gate page the person still continues to the link.
• Security data: to protect sign-in, our sign-in provider records the IP address and device of each session. Our own rate-limit records keep only a keyed hash, never the address or email itself.
• Deletion requests: when Meta sends us a request to delete your data, we keep a hash of its confirmation code, the dates it was sent, received and carried out, and the id Meta gives for you until it is carried out.

How we use data

• To provide the features you use and turn on.
• To give customers the email addresses people leave with them: in Arcdrop, in exports they download and, when a customer sets it up, at a web address of the customer’s choice.
• To keep accounts and the service secure and to prevent abuse.
• To send service emails, such as confirming your email address or resetting your password.
• To meet legal obligations.

We do not sell personal data. We do not use it for advertising, and we do not use Instagram data to build profiles of people.

Instagram and Meta data

We use data we receive from Meta only to provide the features you turn on, and we follow the Meta Platform Terms when handling it. You can disconnect an Instagram account in Arcdrop at any time, which deletes its access token at once, or delete it, which also deletes the data that came from it. Our data deletion page explains both.

If you leave your email address with an Arcdrop customer

Some Arcdrop customers ask for your email address on a Lead Gate page before you continue to their link, or in an Instagram message. The customer who asks, the business or creator named on the page or in the message, decides how your address is used and is responsible for it. Arcdrop stores and processes it for them.

• What we keep: your address, encrypted; a keyed hash that lets us recognize the same address again without reading it; the consent you gave, the version of the notice you saw and when; and, on a Lead Gate page, which link you came from and whether you asked for updates from the customer.
• What we record about a Lead Gate visit: its country, the type of device and whether the page was opened inside an app, kept for 30 days. Not your IP address or your browser’s details. The page sets no cookies.
• Who sees your address: the customer, through Arcdrop (for example in an export they download), and at a web address of their choice if they set that up. We do not use it for our own purposes, and we do not send you email.
• When the customer’s plan has used its monthly allowance of new leads, a new address is not stored, and you still continue to the link.
• How long: while the customer’s workspace exists, or until you ask for it to be deleted. An address left in an Instagram message also goes if the customer deletes that Instagram account from Arcdrop.

To have your address deleted, ask the customer, or write to us at privacy@arcdrop.app from that address. We delete it from Arcdrop within 30 days. Copies the customer already keeps in their own systems are under their control.

Why we may use data

We use account data to perform our agreement with you, security data for our legitimate interest in keeping Arcdrop safe, and data the law requires us to keep to meet that obligation. For people who interact with a customer on Instagram, open a customer’s link or leave their email address with a customer, the customer decides why their data is used and is responsible for that use, and Arcdrop processes it on the customer’s behalf.

Who we share data with

• Service providers that run Arcdrop for us: Supabase (database and sign-in), Cloudflare (network and hosting), Upstash (a message queue that carries only internal ids, never names, messages or email addresses) and an email delivery provider for service emails.
• Meta, when you connect Instagram and when an automation replies.
• The customer a person left their email address with, who gets it through Arcdrop, for example in an export they download. A customer can also have Arcdrop send the leads from its Lead Gate pages to a web address of its choice; the email address is included only if the customer turns that on. Once data reaches a customer’s own systems, the customer’s privacy policy applies.
• Authorities, when the law requires it.

We do not share personal data with advertisers or data brokers.

Where data is stored

Arcdrop’s database is hosted by Supabase in the United States. Our providers may process data in other countries.

How long we keep data

• Account data: while your account exists.
• An Instagram access token: until you disconnect or delete the account, or Meta tells us you removed Arcdrop.
• Comment and message events and delivery history: while the Instagram account stays in Arcdrop.
• Contacts, follow checks and email questions asked in messages: while the Instagram account stays in Arcdrop.
• Email addresses people leave, with their consent records: while the customer’s workspace exists, or until the person asks us to delete them. An address left in an Instagram message also goes when the customer deletes that Instagram account from Arcdrop.
• Lead Gate visits: 30 days.
• Leads sent to a customer’s web address: a copy, kept encrypted so that a failed delivery can be sent again, while the workspace exists.
• Data from an Instagram account you delete: removed as our data deletion page describes.
• Rate-limit records: 2 days.
• Security records: as long as needed to protect the service and meet legal obligations.

To delete your Arcdrop account itself, write to privacy@arcdrop.app.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your data, to restrict or object to its use, and to withdraw consent. Write to privacy@arcdrop.app; we answer within 30 days. You can also complain to your local data protection authority. If you interacted with an Arcdrop customer on Instagram or left your email address with one, you can ask that customer or us, and we will help.

Cookies

Arcdrop uses only cookies it needs to work: session cookies that keep you signed in, a short-lived cookie that protects an Instagram connection while it is in progress, and a cookie that remembers your language. We use no advertising or analytics cookies.

Security

Connections use HTTPS, passwords are hashed and Instagram access tokens are encrypted. No system is perfectly secure; if a breach affects your data, we will tell you when the law requires it.

Age

Arcdrop is for businesses and creators. You must be 18 or older to create an account.

Changes to this policy

We post changes on this page and update the effective date. For significant changes, we tell account holders by email before they take effect.

Contact

Nuttapol Pechsiri. Email: privacy@arcdrop.app.

Waitlist

When you join the waitlist on arcdrop.app, we collect the email address you enter. If the link that brought you had a campaign tag, we store that tag. If you joined the waitlist earlier and answered its optional questions then, your answers (your Instagram handle, the option that describes you, how you get paid and which DM tool you use) are kept with your entry.

We use this information only to invite you to the beta in the right wave and to tell you about the launch. We don’t sell it or share it for advertising. It is stored with Cloudflare, which hosts this page, and with the service that sends our emails. We keep it until you unsubscribe or ask us to delete it.

To see, change or delete your waitlist entry, email privacy@arcdrop.app. Every email we send has an unsubscribe link.