Legal · Privacy

Privacy Policy

Vkit — operated by 18083690 Canada Inc. (operating as “Vkit”).

Effective date: July 17, 2026 · Last updated: July 17, 2026

1. Who we are

Vkit is a service that lets Instagram creators and businesses automate direct message replies to their audience. Vkit is operated by 18083690 Canada Inc., a corporation incorporated under the Canada Business Corporations Act (corporation number 1808369-0), operating under the business name “Vkit.”

Contact:

For privacy questions, requests, or complaints, contact us at team@vkit.app. We are required by law to have a person accountable for our privacy practices, and that person can be reached at this address.

2. Two kinds of people are described in this policy

This is the most important section. Please read it.

Account Holders — Instagram creators or businesses who sign up for Vkit, connect their Instagram account, and build automations. If you have a Vkit login, you are an Account Holder.

Audience Members — Instagram users who comment on an Account Holder’s post, reply to their Story, or send them a direct message. Audience Members do not have Vkit accounts and did not sign up for Vkit. Their information reaches us because they interacted with an Account Holder on Instagram.

Our roles differ for each group.

For Account Holders, we determine why and how their information is used. We are responsible for it directly.

For Audience Members, we process information on behalf of and under the instructions of the Account Holder. The Account Holder decides what automations run, what messages are sent, and what information is collected. In privacy law terms, the Account Holder is generally the party responsible for that information, and Vkit acts as their service provider. We also handle a limited amount of Audience Member information for our own purposes — security, abuse prevention, and platform reliability — and for those purposes we are responsible directly.

If you are an Audience Member and want your information deleted, you may contact us at team@vkit.app and we will act on it. We will also tell you which Account Holder’s automation involved you, so you can contact them directly.

3. What we collect

3.1 From Account Holders

Account information

• Name and email address
• Password (stored as a cryptographic hash — we never see or store your actual password)
• Instagram account username, account ID, and profile information available through Instagram’s API

Billing information

• Subscription tier and billing history
• Payment card details are collected and stored by Stripe, our payment processor. Vkit does not store full card numbers. We receive only a token, the last four digits, card brand, and expiry.

Content you create

• Automations, flows, keyword triggers, and message templates you build
• Folder and workspace organization

Usage information

• Log-in times, IP address, browser and device type
• Pages viewed and features used within Vkit
• Delivery telemetry: how many messages were sent, delivered, failed, or queued

3.2 From Audience Members, through Instagram

When an Account Holder connects their Instagram account, they grant Vkit these permissions:

Our use of the Instagram API is subject to, and complies with, Meta’s Platform Terms and Developer Policies.

Through these permissions, we may receive the following about Audience Members:

• Instagram user ID — a scoped identifier assigned by Instagram
• Username and public profile information
• Message content — the text of direct messages sent to the Account Holder, including any messages sent in reply to a Story
• Comment content — the text of comments on posts, Reels, and live videos
• Interaction metadata — timestamps, which post or Story was involved, whether a message was delivered
• Information you volunteer — if an automation asks a question and you answer it, we receive your answer. This may include an email address, a phone number, or anything else you choose to type.

We do not receive your Instagram password, your email address as registered with Instagram, your phone number as registered with Instagram, or your private information from any account other than the one you messaged.

3.3 What we do not collect

We do not collect Social Insurance Numbers, government identification numbers, financial account numbers, health information, or biometric information. If you send any of this to an Account Holder in a direct message, it will pass through our systems as message content — please do not.

4. Why we use it

4.1 Account Holder information

We do not sell Account Holder information. We do not use Account Holder information for advertising.

4.2 Audience Member information

We do not sell Audience Member information. We do not use it to build advertising profiles. We do not use message content to train artificial intelligence models. We do not share it with other Account Holders.

Automated replies are generated from templates and rules the Account Holder configured. Where an Account Holder enables an AI-assisted reply feature, message content is processed to generate a response — see Section 6.

5. Consent, and how automated messages work

Instagram’s platform rules — which we are bound by and which we build to — require that the Audience Member initiate contact first. Vkit cannot and does not send unsolicited messages to people who have not interacted with an Account Holder.

An automated message is only sent after you have:

• Commented on the Account Holder’s post, Reel, or live video, or
• Replied to the Account Holder’s Story, or
• Sent the Account Holder a direct message

Your interaction is what triggers the automation. Under Instagram’s rules, the Account Holder may respond within a limited window following your interaction.

You can stop receiving automated messages at any time by replying “STOP” to the conversation, blocking the Account Holder on Instagram, or contacting us at team@vkit.app. We acknowledge a “STOP” with a single confirmation message and send you no further automated messages from that Account Holder. If you change your mind, reply “START” and automated messages are turned back on.

If an automation asks you for information — your email address, for example — providing it is your choice. You can decline and the conversation ends there.

5.1 Automated messaging

In short, the rules we hold ourselves to on this channel:

• Reply only. An automated message is only ever sent in response to an interaction you started. If you have not commented, replied to a Story, or sent a direct message, no automation will contact you.
• Inside Instagram’s messaging window. A direct message or Story reply from you opens a 24-hour window, and automated messages are only sent inside it. A comment entitles the Account Holder to a single private reply. Once the window closes, the automation cannot message you again unless you interact again.
• Opt out at any time. Reply “STOP” and we acknowledge it immediately and stop sending. Replying “START” turns automated messages back on.
• No unsolicited messages. We do not send promotional or bulk Instagram messages to people who have not contacted the Account Holder first, and Account Holders cannot use Vkit to do so.

6. Artificial intelligence

Some Vkit features use AI to interpret an incoming message and generate a reply. Where an Account Holder has enabled these features:

• Message content is sent to a third-party AI provider to generate a response
• The AI provider processes the content to produce output and does not retain it for their own purposes or use it to train their models
• The Account Holder configures what the AI is instructed to do
• We do not use your message content to train Vkit’s own models

If an Account Holder has AI features enabled, automated replies you receive may be AI-generated.

7. Who we share with

We share information with the following categories of service providers, each of whom is contractually bound to use it only to provide services to us:

We also disclose information:

• To the Account Holder whose account you interacted with — this is the purpose of the service
• When required by law — court order, subpoena, lawful government request
• To protect rights and safety — ours, an Account Holder’s, or the public’s
• In a business transaction — if Vkit is acquired or merges, information may transfer as part of that transaction, subject to this policy

We do not sell personal information to anyone.

8. Where your information goes, and what that means

Vkit is a Canadian company. Our service providers are located in Canada and the United States, and some operate globally.

This means your personal information may be stored or processed outside Canada, and outside your province. While it is in another country, it is subject to that country’s laws, and courts, law enforcement, and national security authorities in that country may be able to obtain access to it.

We assess each provider before engaging them, and we require contractual protections for information they handle on our behalf.

If you would like details about our transfers outside Quebec or outside Canada, contact us at team@vkit.app.

9. How long we keep it

Account Holders can request deletion of their stored data at any time by emailing team@vkit.app.

If an Account Holder disconnects their Instagram account or closes their Vkit account, we delete the associated Audience Member content within 90 days, except where we are required to retain it by law.

Vkit follows a 90 day retention policy for all data retrieved through the Instagram API. We do not store Instagram platform data indefinitely. All retrieved data, including account identifiers and messaging logs, is permanently deleted from our active systems within 90 days of a user disconnecting their account or upon a data deletion request. We do not sell, share, or use this data for any purpose other than providing automated messaging services to the account owner. Full details and how to request deletion are on our Data Deletion page.

10. Your rights

Whether you are an Account Holder or an Audience Member, you have the following rights. Exercising them is free, and we will respond within 30 days.

Access — Ask what personal information we hold about you and get a copy.

Correction — Ask us to fix information that is inaccurate or incomplete.

Deletion — Ask us to delete your personal information. We will do so unless we are required to keep it by law, in which case we will tell you why. See our Data Deletion page for how deletion works and what gets removed.

Withdraw consent — Stop the processing you previously agreed to. For automated messages, reply “STOP” or contact us.

Portability — Receive your information in a structured, commonly used, machine-readable format, or ask us to transfer it to another organization.

Object to automated decision-making — If a decision about you was made using automated processing alone, you can ask us to explain it and ask that a human review it.

Complain — If you are unhappy with how we handled a privacy matter, you can complain to us at team@vkit.app. You can also complain to:

• Office of the Privacy Commissioner of Canada — priv.gc.ca
• Commission d’accès à l’information du Québec — cai.gouv.qc.ca (if you are in Quebec)

To exercise any right, email team@vkit.app. We may ask you to verify your identity before we act — this protects you from someone else making a request in your name.

If you are an Audience Member, note that we may need to direct part of your request to the Account Holder whose automation involved you, because they control that data. We will tell you who they are and help you reach them.

11. If you are in Quebec

Quebec’s Act respecting the protection of personal information in the private sector gives you additional rights and imposes additional obligations on us. Specifically:

• Our privacy officer is reachable at team@vkit.app. This is the person accountable for our compliance.
• De-indexing — You may request that we stop disseminating your personal information, or that a hyperlink to it be de-indexed, where dissemination contravenes the law or a court order.
• Portability — You may request your computerized personal information in a structured, commonly used technological format.
• Automated decisions — If we make a decision about you based exclusively on automated processing, we will inform you and, on request, tell you what personal information was used, the reasons and principal factors that led to the decision, and your right to have it corrected. You may submit observations to a member of our personnel who can review the decision.
• Transfers outside Quebec — Before transferring your information outside Quebec, we conduct a privacy impact assessment. See Section 8.
• Confidentiality by default — Any privacy settings in our service default to the highest level of confidentiality without your intervention.
• Breach notification — If a confidentiality incident presents a risk of serious injury, we will notify you and the Commission d’accès à l’information.

Language — You have the right to be served in French. A French version of this policy and of our service is available at vkit.app. If any inconsistency exists between the English and French versions, the French version prevails for Quebec residents.

12. If you are under 18

Vkit is not intended for people under 18, and Account Holders must be 18 or older.

We recognize that Instagram users of any age may interact with an Account Holder’s content and therefore with our automations. We treat personal information of anyone under 18 as sensitive. We do not knowingly use it for any purpose beyond delivering the automated reply the Account Holder configured.

If you believe we hold information about a person under 18 and you want it removed, email team@vkit.app and we will delete it promptly.

13. Security

We protect information using:

• Encryption in transit (TLS) and at rest
• Access controls limiting employee access to what is necessary
• Cryptographic hashing of passwords
• Logging and monitoring of access to systems holding personal information
• Vendor assessment before engaging service providers

No system is perfectly secure. If a breach occurs that creates a real risk of significant harm, we will notify affected people and the applicable regulators — the Office of the Privacy Commissioner of Canada, and where Quebec residents are affected, the Commission d’accès à l’information — as the law requires.

14. Cookies

Vkit uses cookies and similar technologies on vkit.app for:

• Strictly necessary — logging you in, keeping your session, security. These cannot be disabled.
• Analytics — understanding how the product is used. These require your consent, and you may withdraw it at any time.

We do not use advertising cookies and we do not permit third-party advertising trackers on our site.

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent Vkit from working.

15. Changes to this policy

We may update this policy. If we make a material change — one that meaningfully affects how we handle your information — we will notify Account Holders by email at least 30 days before it takes effect, and post a notice in the product.

The “Last updated” date at the top reflects the most recent version. Continuing to use Vkit after a change takes effect means you accept the updated policy.

16. Contact

Privacy questions, requests, complaints: team@vkit.app

We will respond to any privacy request within 30 days.

See also our Terms of Service and Contact.