Privacy Policy

MsgWeaver · Last updated 5 November 2026

MsgWeaver ("we", "us") helps businesses and creators turn comments on their Instagram posts into email subscribers. A business connects its Instagram professional account; when someone comments a keyword, MsgWeaver replies publicly, sends that person a direct message, and, if they reply with an email address, adds them to the business's email list. This policy explains what data is processed and why. MsgWeaver works with Instagram and is not affiliated with or endorsed by Meta.

Data we process

For businesses that use MsgWeaver:

• Sign-in details from the identity provider you use to log in (name and email address).
• Your connected Instagram professional account's ID, username and profile picture, and an access token that lets MsgWeaver act on your behalf. Tokens are stored encrypted in Azure Key Vault.
• Your automations, message templates and email sequences.

For people who interact with a connected Instagram account:

• Comments on that account's posts and direct messages sent to it, which Instagram delivers to us so the automation can respond.
• Your Instagram-scoped user ID and username.
• Your email address, only if you send it in a direct message, plus any tags the business applies and whether you have unsubscribed.

People who join our waitlist on msgweaver.com: your email address and the time you signed up. We use it only to tell you about MsgWeaver (for example, when your access is ready), and every email has an unsubscribe link.

Contacts a business imports: a business may import its own existing subscriber list (for example from another messaging tool). It must confirm those people agreed to receive its emails. Opt-outs in the imported file are kept.

How we use it

• To reply to comments and send the direct messages the business has set up, within Instagram's messaging rules.
• To save the email address you choose to share and send the emails the business has set up.
• To show the business an activity log and its contact list.
• Optionally, if the business turns on AI features, to classify comments and draft replies using AI models hosted in Microsoft Azure. This content is not used to train models.

We do not sell personal data, use it for advertising, or share it with anyone except the service providers below.

Service providers

• Microsoft Azure (United States) hosts the application, database, queues and email delivery (Azure Communication Services).
• Meta provides the Instagram API used to receive comments and messages and to send replies.
• Stripe processes payments for paid plans; we do not store card details.

Retention

Data is kept while the business uses MsgWeaver. When a business disconnects an Instagram account, its access token is deleted immediately. Contacts and activity are deleted when the business deletes them or when we receive a deletion request.

Your choices and rights

• Unsubscribe: every email includes an unsubscribe link.
• Delete your data: remove MsgWeaver from your Facebook or Instagram settings (Business integrations / Apps and websites). Meta notifies us and we delete the associated data, and you receive a confirmation code you can use to check the status of the request.
• Access, correction or deletion: contact the business that runs the Instagram account you interacted with, or contact us below.

Security

Data is encrypted in transit and at rest. Services authenticate with managed identities rather than stored keys, and access tokens live only in Azure Key Vault.

Children

MsgWeaver is not directed at children under 13, and we do not knowingly collect their data.

Changes

We will update this page when our practices change and revise the date above.

Contact

Questions or requests: hello@msgweaver.com