Privacy Policy

Last updated: October 2026

This policy explains how Monarch Softwares ("Candifynd", "we") handles personal data when you use our service, which sends automatic replies to comments on Instagram accounts that you connect.

Who is responsible

Monarch Softwares is the data controller for your account data. For data about people who comment on your Instagram posts, you decide why the replies are sent and we process that data on your behalf to run the automations you configure. Contact us at contact@monarchsoftwares.com or through the contact form.

What we collect

• Account data: your email address and a salted, one-way hash of your password. We never store your password itself. We also record when you accepted these terms.
• Instagram connection (only if you connect): your Instagram account ID and username, and an access token that is stored encrypted. We request only the permissions needed: instagram_business_basic (read your profile), instagram_business_manage_comments (receive comments on your posts, post a public reply, and hide or delete comments if you turn on moderation) and instagram_business_manage_messages (send the private reply, and receive and answer direct messages and story replies if you create those automations).
• Comments on your posts: when someone comments, Instagram sends us the comment text, the commenter's Instagram ID and username, and the post ID. We use them to match your rules and send the reply. We keep a short excerpt (up to 140 characters) and the commenter's username in your activity log for 30 days, then delete it. We keep a comment ID (no text, no username) for 8 days to avoid sending the same reply twice. If you turn on comment moderation, the comment text is checked against your rules on our servers (no third party receives it) and the result is recorded in the same 30-day activity log.
• Direct messages and story replies (only if you create those automations): when someone messages your account or replies to a story, Instagram sends us the message text and the sender's Instagram-scoped ID. We check the text against your keywords and send your reply. We keep a short excerpt (up to 140 characters) in your activity log for 30 days, and a marker (sender ID and automation ID, no text) for 24 hours so each person gets at most one automatic reply per day.
• Your automations: the rules and message text you create, and for each one the ID, link and a short caption excerpt (up to 80 characters) of the post you chose, so you can tell your posts apart. When you open the post picker we load your recent posts from Instagram to show them to you; that list is not stored.
• Account safety data: whether your email is confirmed, short-lived single-use confirmation and reset tokens (stored only as hashes), and, if an account is suspended for abuse, the reason. A small number of staff administrators can see account emails and suspend accounts to keep the service safe.
• Technical data: a session cookie that keeps you logged in, and standard server logs (such as IP address and request time) kept by our hosting provider for security and troubleshooting.

How we use it

Only to provide the service: run your automations, keep your account secure, prevent abuse, and answer your support requests. We do not sell personal data, we do not use it for advertising or profiling, and we do not share it with data brokers. Data received from Meta is used only to provide the features you asked for.

Who we share it with

• Meta Platforms (Instagram): to authenticate your account and to send and receive messages and comments on your behalf.
• Infrastructure providers: Vercel (application hosting) and Upstash (database). They process data only on our instructions.
• Email delivery provider (Resend): receives your email address to send account confirmation and password-reset messages.
• Authorities, if the law requires it.

Data may be processed in countries outside your own, including the United States, with appropriate safeguards where required.

Security

All traffic uses HTTPS. Instagram access tokens are encrypted at rest. Passwords are hashed with a slow, salted algorithm. Webhooks from Meta are verified by signature before processing. Each user can only access their own data.

Your rights and deleting your data

You can access, correct and delete your data at any time:

• Disconnect Instagram: on the Automations page. This deletes your stored access token and connection immediately.
• Delete your account: on the same page, use Delete my account. This permanently deletes your account, automations, activity log and Instagram connection.
• Remove Candifynd from Instagram: in Instagram, go to Settings → Website permissions → Apps and websites and remove Candifynd, or use the data deletion request in your Facebook/Instagram settings. We receive Meta's deletion request automatically and delete your Instagram data. You can check the status at our deletion status page using your confirmation code.
• Depending on where you live (for example under the GDPR or CCPA) you may also have the right to object, restrict or port your data, and to complain to your data protection authority. Contact us to exercise these rights.

People who comment on your posts

If you commented on a post of an account that uses Candifynd and want your data removed, contact us with your Instagram username and we will delete it from the activity log. Activity entries are deleted automatically after 30 days.

Children

Candifynd is not for anyone under 13 (or the minimum age in your country). We do not knowingly collect their data.

Changes

We will update this page when our practices change and revise the date above. Material changes will be announced in the product.