1. Who we are
Vkit is a software service for creators and businesses to automate replies to Instagram comments and direct messages, create and schedule content, publish to supported connected accounts, manage a link-in-bio page, and use AI-assisted content tools. Availability depends on the feature and the permissions granted by each platform.
Contact:
Vkit[email protected]For privacy questions, requests, or complaints, contact us at [email protected]. We are required by law to have a person accountable for our privacy practices, and that person can be reached at this address.
2. Two kinds of people are described in this policy
This is the most important section. Please read it.
Account Holders — creators and businesses who sign up for Vkit to create content, manage connected accounts, build automations, or manage their link-in-bio page. If you have a Vkit login, you are an Account Holder.
Audience Members — people who interact with an Account Holder, including Instagram users who comment on a post, reply to a Story, or send a direct message, and people who visit or submit information through an Account Holder’s Vkit page or form. You do not need a Vkit account for these interactions.
Our roles differ for each group.
For Account Holders, we determine why and how their information is used. We are responsible for it directly.
For Audience Members, we process information on behalf of and under the instructions of the Account Holder. The Account Holder decides what automations run, what messages or content are published, and what information their forms collect. In privacy law terms, the Account Holder is generally the party responsible for that information, and Vkit acts as their service provider. We also handle a limited amount of Audience Member information for our own purposes — security, abuse prevention, and platform reliability — and for those purposes we are responsible directly.
If you are an Audience Member and want your information deleted, you may contact us at [email protected] and we will act on it. We will also tell you which Account Holder’s automation involved you, so you can contact them directly.
Visitors can also use Vkit’s public website and free tools without an account. We handle their submitted tool inputs and limited technical and usage information as described in Sections 3 and 6. The rights and contact methods in this policy apply to them too.
3. What we collect
3.1 From Account Holders
Account information
- Name and email address
- Password (stored as a cryptographic hash — we never see or store your actual password)
- Usernames, account identifiers, profile information, and authorization credentials for accounts you choose to connect, as made available by the relevant platform
Billing information
- Subscription tier and billing history
- For website purchases, payment card details are collected and stored by Stripe, our payment processor. Vkit does not store full card numbers. We receive only a token, the last four digits, card brand, and expiry.
- For iOS subscriptions, Apple processes the payment. Vkit and RevenueCat process purchase history, receipts and transaction identifiers, subscription status, and an identifier linked to your Vkit account and workspace to validate purchases, restore purchases, and provide paid access. RevenueCat also processes limited app and device technical information needed to operate purchases. We do not receive your Apple payment card details.
Content you create
- Automations, flows, keyword triggers, and message templates you build
- Folder and workspace organization
- Media files (images and videos), captions, connected accounts, and the schedules you set for content you upload or create for publishing, including publishing to Instagram
- Brand information you provide, or that we derive from information available through your connected account, to style your content
- Link-in-bio page content, form configuration, and prompts, reference material, and outputs you save through AI-assisted tools
Usage information
- Log-in times, IP address, browser and device type
- Pages viewed and features used within Vkit
- Delivery telemetry: how many messages were sent, delivered, failed, or queued
3.2 From Audience Members, through Instagram
The following permissions describe the Instagram access used by Vkit. Access is limited to the permissions available and authorized for your connection.
| Permission | What it allows us to access |
|---|---|
instagram_business_basic | The Account Holder's Instagram profile and account information |
instagram_business_manage_messages | Direct message conversations on the Account Holder's account — reading incoming messages and sending replies |
instagram_business_manage_comments | Comments on the Account Holder's posts and Reels — reading them and replying |
instagram_business_content_publish | Publishing media and captions to the Account Holder’s connected Instagram professional account, on their explicit instruction, immediately or at the scheduled time |
Our use of the Instagram API is subject to, and complies with, Meta’s Platform Terms and Developer Policies.
Where you use Vkit to publish or schedule content, we publish only the media and captions you create and confirm, only to the account you connected, and only at the time you set. We do not create or publish content on your behalf without your instruction.
Through these permissions, we may receive the following about Audience Members:
- Instagram user ID — a scoped identifier assigned by Instagram
- Username and public profile information
- Message content — the text of direct messages sent to the Account Holder, including any messages sent in reply to a Story
- Comment content — the text of comments on posts, Reels, and live videos
- Interaction metadata — timestamps, which post or Story was involved, whether a message was delivered
- Information you volunteer — if an automation asks a question and you answer it, we receive your answer. This may include an email address, a phone number, or anything else you choose to type.
We do not receive your Instagram password, your email address as registered with Instagram, your phone number as registered with Instagram, or your private information from any account other than the one you messaged.
3.3 What we do not collect
We do not collect Social Insurance Numbers, government identification numbers, financial account numbers, health information, or biometric information. If you send any of this to an Account Holder in a direct message, it will pass through our systems as message content — please do not.
3.4 Other connected platforms
In addition to Instagram, our available connections include LinkedIn personal profiles, X, Bluesky, Dev.to, Hashnode, Lemmy, Listmonk, Medium, Moltbook, Nostr, Skool, and WordPress. Connecting an account does not mean that every platform supports every Vkit feature. The connection and publishing options available in your workspace determine which actions you can use.
When you connect a supported account, we receive the account identifiers, profile information, authorization tokens or credentials, and connection status needed to provide that connection. For supported publishing actions, we transmit content you create and approve to the accounts you select and receive publishing status, post identifiers, or errors. Each platform’s own terms and privacy policy apply to its handling of that information. We do not publish to an account you have not connected or to a platform for which publishing is unavailable.
3.5 Public pages, forms, and free tools
We receive information visitors choose to submit through an Account Holder’s forms, such as contact details and answers, and provide it to that Account Holder. Content an Account Holder publishes on a link-in-bio page is public. Free-tool inputs are processed to provide the requested output; AI inputs may be sent to the providers described in Section 6. We also use limited technical information and usage counters to operate the tools, enforce usage limits, and prevent abuse.
4. Why we use it
4.1 Account Holder information
| Purpose | Legal basis |
|---|---|
| Providing the Vkit service | Performance of our contract with you |
| Billing and payment | Performance of our contract |
| Security, fraud prevention, abuse detection | Our legitimate interest and legal obligations |
| Support and communication about your account | Performance of our contract |
| Improving the service, diagnosing problems | Our legitimate interest |
| Legal and regulatory compliance | Legal obligation |
| Publishing content you create to your connected accounts, at the time you choose | Performance of our contract with you |
We do not sell Account Holder information. We do not use Account Holder information for advertising.
4.2 Audience Member information
| Purpose | Who decides |
|---|---|
| Matching your message or comment against an Account Holder's automation triggers | The Account Holder |
| Sending you an automated reply on the Account Holder's behalf | The Account Holder |
| Storing your interaction so the Account Holder can see their conversation history | The Account Holder |
| Detecting spam, abuse, and platform policy violations | Vkit |
| Ensuring message delivery and platform reliability | Vkit |
| Displaying public page content and delivering form submissions to the Account Holder | The Account Holder |
We do not sell Audience Member information. We do not use it to build advertising profiles. We do not use message content to train Vkit’s own artificial intelligence models. Provider processing is described in Section 6. We do not share it with other Account Holders.
Automated replies are generated from templates and rules the Account Holder configured. Where an Account Holder enables an AI-assisted reply feature, message content is processed to generate a response — see Section 6.
5. Consent, and how automated messages work
Instagram’s platform rules — which we are bound by and which we build to — require that the Audience Member initiate contact first. Vkit cannot and does not send unsolicited messages to people who have not interacted with an Account Holder.
An automated message is only sent after you have:
- Commented on the Account Holder’s post, Reel, or live video, or
- Replied to the Account Holder’s Story, or
- Sent the Account Holder a direct message
Your interaction is what triggers the automation. Under Instagram’s rules, the Account Holder may respond within a limited window following your interaction.
You can stop receiving automated messages at any time by replying “STOP” to the conversation, blocking the Account Holder on Instagram, or contacting us at [email protected]. We acknowledge a “STOP” with a single confirmation message and send you no further automated messages from that Account Holder. If you change your mind, reply “START” and automated messages are turned back on.
If an automation asks you for information — your email address, for example — providing it is your choice. You can decline and the conversation ends there.
5.1 Automated messaging
In short, the rules we hold ourselves to on this channel:
- Reply only. An automated message is only ever sent in response to an interaction you started. If you have not commented, replied to a Story, or sent a direct message, no automation will contact you.
- Inside Instagram’s messaging window. A direct message or Story reply from you opens a 24-hour window, and automated messages are only sent inside it. A comment entitles the Account Holder to a single private reply. Once the window closes, the automation cannot message you again unless you interact again.
- Opt out at any time. Reply “STOP” and we acknowledge it immediately and stop sending. Replying “START” turns automated messages back on.
- No unsolicited messages. We do not send promotional or bulk Instagram messages to people who have not contacted the Account Holder first, and Account Holders cannot use Vkit to do so.
6. Artificial intelligence
Vkit uses AI to assist with content ideas, captions, images, post content, brand styling, and replies where an Account Holder enables an AI-assisted reply feature. Public free tools also use AI when a visitor requests generation.
- The inputs needed for your request — such as prompts, reference images, brand information, and relevant message content when AI replies are enabled — are sent to a third-party AI provider to generate an output. OpenRouter routes requests to the model provider used by the feature.
- Provider retention and training practices depend on the endpoint and its terms. Vkit’s configured in-app OpenRouter clients request providers that disallow collection for training. That routing setting is not a guarantee of zero retention: providers may retain information for permitted operational, security, or legal purposes.
- You choose what to submit and review generated content before using or publishing it. For enabled reply automations, the Account Holder configures the instructions and the replies are sent under that configuration.
- We do not use customer content, tool inputs, or message content to train Vkit’s own models.
If an Account Holder enables AI-assisted replies, automated replies you receive may be AI-generated. AI output can be inaccurate; it is not a substitute for reviewing facts, permissions, and suitability before use.
The public free AI generators use NVIDIA’s Nemotron free endpoint through OpenRouter. NVIDIA states that use is logged for security and to improve its products and services; improvement session data is not linked to an identity or persistent identifier. Do not submit personal data, private audience messages, or confidential information to these free generators. We cannot promise that this endpoint retains nothing or excludes all improvement or training uses. This disclosure concerns the public free generators, not a grant to use connected-account data for model training.
NVIDIA free-endpoint disclosure · OpenRouter provider data practices
7. Who we share with
We share information needed to operate the service with the following providers and connected platforms. Providers acting on our behalf process information under the applicable service terms. Connected platforms apply their own terms, and the public free AI endpoint has the additional processing practices explained in Section 6.
| Provider | What they receive | Where |
|---|---|---|
| Meta Platforms (Instagram) | Messages we send on the Account Holder's behalf | United States and globally |
| Stripe | Account Holder billing information for website purchases | United States and Canada |
| Apple | App Store payment and transaction information for iOS subscriptions | United States and other locations where Apple operates |
| RevenueCat | Account/workspace purchase identifier, purchase history, receipts, subscription status, and limited app/device technical information for validation, restoration, and access | United States and other locations used by its service providers |
| Cloud hosting and infrastructure providers | Data at rest and in transit | See Section 8 |
| AI providers, including OpenRouter and the model provider used by the feature | Inputs needed for requested AI generation, including prompts, reference media, brand context, and message content only when AI-assisted replies are enabled; see Section 6 for the public free-tool exception | United States and other locations used by the selected provider |
| Other platforms you connect | Connection credentials, account identifiers, and approved content needed for supported actions, as described in Section 3.4 | Where the connected platform operates |
| Analytics and error monitoring | Usage and diagnostic information | United States |
We also disclose information:
- To the Account Holder whose account you interacted with — this is the purpose of the service
- When required by law — court order, subpoena, lawful government request
- To protect rights and safety — ours, an Account Holder’s, or the public’s
- In a business transaction — if Vkit is acquired or merges, information may transfer as part of that transaction, subject to this policy
We do not sell personal information to anyone.
8. Where your information goes, and what that means
Vkit is a Canadian company. Our service providers are located in Canada and the United States, and some operate globally.
This means your personal information may be stored or processed outside Canada, and outside your province. While it is in another country, it is subject to that country’s laws, and courts, law enforcement, and national security authorities in that country may be able to obtain access to it.
We assess each provider before engaging them, and we require contractual protections for information they handle on our behalf.
If you would like details about our transfers outside Quebec or outside Canada, contact us at [email protected].
9. How long we keep it
| Information | Retention |
|---|---|
| Account Holder account information | For as long as your account is active, then 90 days after closure |
| Billing records | 7 years, as required by Canadian tax law |
| Message and comment content | 90 days from the interaction, unless the Account Holder configures a shorter period |
| Delivery telemetry and logs | 12 months |
| Security and abuse logs | 12 months |
| Aggregate, de-identified analytics | Indefinitely — this cannot be linked back to you |
| Scheduled and published post content, media, and publishing records | Scheduled content is retained while awaiting publication. Published post content, including uploaded media and captions, is retained while your account is open and is deleted when your account is closed. You can request deletion of specific content — unpublished, cancelled, failed, or already published — by emailing [email protected]. |
Account Holders can request deletion of their stored data at any time by emailing [email protected].
If an Account Holder disconnects their Instagram account or closes their Vkit account, we delete the associated Audience Member content within 90 days, except where we are required to retain it by law.
Vkit follows a 90 day retention policy for all data retrieved through the Instagram API. We do not store Instagram platform data indefinitely. All retrieved data, including account identifiers and messaging logs, is permanently deleted from our active systems within 90 days of a user disconnecting their account or upon a data deletion request. We do not sell this data. We use it to provide the connected-account features you authorize and share it only as described in this policy. Full details and how to request deletion are on our Data Deletion page.
10. Your rights
Whether you are an Account Holder or an Audience Member, you have the following rights. Exercising them is free, and we will respond within 30 days.
Access — Ask what personal information we hold about you and get a copy.
Correction — Ask us to fix information that is inaccurate or incomplete.
Deletion — Ask us to delete your personal information. We will do so unless we are required to keep it by law, in which case we will tell you why. See our Data Deletion page for how deletion works and what gets removed.
Withdraw consent — Stop the processing you previously agreed to. For automated messages, reply “STOP” or contact us.
Portability — Receive your information in a structured, commonly used, machine-readable format, or ask us to transfer it to another organization.
Object to automated decision-making — If a decision about you was made using automated processing alone, you can ask us to explain it and ask that a human review it.
Complain — If you are unhappy with how we handled a privacy matter, you can complain to us at [email protected]. You can also complain to:
- Office of the Privacy Commissioner of Canada — priv.gc.ca
- Commission d’accès à l’information du Québec — cai.gouv.qc.ca (if you are in Quebec)
To exercise any right, email [email protected]. We may ask you to verify your identity before we act — this protects you from someone else making a request in your name.
If you are an Audience Member, note that we may need to direct part of your request to the Account Holder whose automation involved you, because they control that data. We will tell you who they are and help you reach them.
11. If you are in Quebec
Quebec’s Act respecting the protection of personal information in the private sector gives you additional rights and imposes additional obligations on us. Specifically:
- Our privacy officer is reachable at [email protected]. This is the person accountable for our compliance.
- De-indexing — You may request that we stop disseminating your personal information, or that a hyperlink to it be de-indexed, where dissemination contravenes the law or a court order.
- Portability — You may request your computerized personal information in a structured, commonly used technological format.
- Automated decisions — If we make a decision about you based exclusively on automated processing, we will inform you and, on request, tell you what personal information was used, the reasons and principal factors that led to the decision, and your right to have it corrected. You may submit observations to a member of our personnel who can review the decision.
- Transfers outside Quebec — Before transferring your information outside Quebec, we conduct a privacy impact assessment. See Section 8.
- Confidentiality by default — Any privacy settings in our service default to the highest level of confidentiality without your intervention.
- Breach notification — If a confidentiality incident presents a risk of serious injury, we will notify you and the Commission d’accès à l’information.
Language — You have the right to be served in French. Contact [email protected] for assistance in French.
12. If you are under 18
Vkit is not intended for people under 18, and Account Holders must be 18 or older.
We recognize that Instagram users of any age may interact with an Account Holder’s content and therefore with our automations. We treat personal information of anyone under 18 as sensitive. We do not knowingly use it for any purpose beyond delivering the automated reply the Account Holder configured.
If you believe we hold information about a person under 18 and you want it removed, email [email protected] and we will delete it promptly.
13. Security
We protect information using:
- Encryption in transit (TLS) and at rest
- Access controls limiting employee access to what is necessary
- Cryptographic hashing of passwords
- Logging and monitoring of access to systems holding personal information
- Vendor assessment before engaging service providers
No system is perfectly secure. If a breach occurs that creates a real risk of significant harm, we will notify affected people and the applicable regulators — the Office of the Privacy Commissioner of Canada, and where Quebec residents are affected, the Commission d’accès à l’information — as the law requires.
14. Cookies
Vkit uses cookies and similar technologies on vkit.app for:
- Strictly necessary — logging you in, keeping your session, security. These cannot be disabled.
- Analytics — understanding how the product is used. These require your consent, and you may withdraw it at any time.
We do not use advertising cookies and we do not permit third-party advertising trackers on our site.
You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent Vkit from working.
15. Changes to this policy
We may update this policy. If we make a material change — one that meaningfully affects how we handle your information — we will notify Account Holders by email at least 30 days before it takes effect, and post a notice in the product.
The “Last updated” date at the top reflects the most recent version. Continuing to use Vkit after a change takes effect means you accept the updated policy.
16. Contact
Vkit[email protected]Privacy questions, requests, complaints: [email protected]
We will respond to any privacy request within 30 days.
See also our Terms of Service and Contact.