Privacy Policy

okan helps Instagram creators reply to comments and story replies, sell digital products in direct messages, and schedule posts. It is operated by OKAN Solutions (“we”). This policy explains what we collect, why, who else handles it, how long we keep it, and the rights you have. It applies wherever you live; the sections on regional rights add to it rather than replace it.

Whose data this covers

• Creators who sign up and connect an Instagram professional account.
• People who interact with a creator on Instagram by commenting on a post or replying to a story the creator has automated.
• Buyers who get a product from a creator, through a direct message or the creator’s page on okan.in.
• Visitors to okan.in.

What we collect

• Your sign-in. If you sign in with Google we receive your name, email address and Google account id. If you sign in with a password we store your email and a one-way hash of the password, never the password itself.
• Your Instagram account. Your account id, username, display name, biography, website, profile picture link, follower and post counts, the permissions you granted, and a long-lived access token issued by Meta.
• Your posts and reels. We read them so you can choose which ones an automation watches, and show them from Instagram’s own servers. If you use Persona, the reels you pick are downloaded to our servers, their audio is transcribed there, and the transcripts and captions are kept with your persona.
• Planned posts. Photos and videos you upload to the planner, with their captions and schedule. They are stored privately and sent to Instagram only when you schedule or post them.
• Comments, story replies and messages. When someone comments on a post or replies to a story you have automated, we receive what they wrote, their Instagram-scoped id and username, and we keep the replies we sent them.
• What you create here. Products, prices, uploaded files, automation and message templates.
• Orders and money. For every sale: the amount, Razorpay’s fee, our fee and its tax, your share, refunds and settlements. For your own subscription: its plan and billing status.
• Buyers’ contact details. When someone pays, Razorpay sends us the email address and phone number they entered at checkout. We keep them with the order so it can be delivered, so the creator can find the order when the buyer asks for help, and so a refund can be matched. Card, UPI and bank details go to Razorpay and never reach us.
• Technical records. Our servers log requests, including IP address, browser type and time, to keep the service secure and to investigate faults.

Why we use it, and on what legal basis

• To provide the service you asked for (performance of our contract with you): connecting Instagram, matching comments and story replies to your automations, sending the replies you wrote, publishing the posts you scheduled, taking payment, delivering products and settling your earnings.
• To keep it secure and working (our legitimate interests): preventing abuse and fraud, fixing faults, and protecting your account and ours.
• To meet legal duties (legal obligation): keeping transaction and tax records, and answering lawful requests from authorities.
• Where you choose an optional feature (your consent, which you can withdraw): signing in with Google, and the AI features described below.

For comments, story replies and messages, the creator decides which people are messaged and what is said. For that data we act on the creator’s behalf, and the creator is responsible for having a lawful reason to message the people who interact with them. For accounts, payments and orders, we decide how the data is used and are responsible for it.

AI features

Some features use Google’s Gemini AI service: suggesting variations of your reply templates, improving a planned post’s caption, and describing your content style in Persona. For these we send Google only the text needed: the template or caption you wrote, and for Persona the captions and transcripts of the reels you picked. We never send buyers’ contact details or payment information to an AI service. Persona’s audio transcription runs on our own servers. AI output is a suggestion: nothing it writes is sent or posted until you choose it.

What we never do

• Publish anything to your Instagram that you did not upload and schedule or post yourself.
• Message anyone unless an automation you created and switched on matched their comment or story reply.
• Sell personal data, or share it for advertising or cross-site tracking.
• Send your Instagram access token to a browser. It stays on our servers.
• Read direct messages in conversations your automations were not part of.

Who else handles it

Services we exchange data with to provide okan:

• Meta (Instagram), to read comments and story replies, send messages and publish posts on your behalf.
• Razorpay, which processes buyers’ payments and your subscription. Payment details go to Razorpay directly.
• Google, if you sign in with Google, and as the provider of the Gemini AI service.

Providers that run our infrastructure. They process data on our instructions to keep the service running, never for their own purposes:

• Google Cloud runs the application, in Google’s Mumbai region in India.
• MongoDB Atlas stores accounts, automations, products, orders and message history.
• Cloudflare R2 stores uploaded product files and planned posts. Files are private and reachable only through short-lived links.
• Vercel serves this website and passes your browser’s requests to our servers.

We may also disclose data where the law requires it, or to protect people from fraud or harm.

International transfers

We are based in India and our application runs in India, so if you use okan from elsewhere your data is transferred to and processed in India, and by our providers in the countries where they operate. For data from the European Economic Area, the United Kingdom and Switzerland, we rely on the Standard Contractual Clauses and equivalent safeguards in our providers’ data processing terms.

Cookies and storage

We use one cookie, which keeps you signed in to the dashboard, and your browser’s local storage, which remembers whether you chose the light or dark theme. Both are strictly necessary for something you asked for, so they need no consent banner. We use no analytics, advertising or social-media tracking cookies, and none are set when you visit a creator’s page or check out. Razorpay’s checkout, which opens on Razorpay’s own site, is covered by Razorpay’s policy.

How long we keep it

• Account, automation and product data: while your account exists.
• Your Instagram access token: deleted the moment you disconnect the account. What you built with it is kept, so reconnecting picks up where you left off.
• Files you upload to the planner: deleted a week after the post goes live on Instagram.
• Server logs: kept for a short period for security, then deleted by our hosting provider.
• Orders, payments and settlements: kept for as long as tax and accounting law requires, which is up to eight years, even after an account is deleted.

Deleting your account removes everything else. See data deletion for how.

Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct anything that is wrong;
• delete your data, except what the law requires us to keep;
• give you your data in a portable format;
• stop or limit a use you object to;
• withdraw a consent you gave, without affecting what was done before.

Email amangoel300@gmail.com from the address on your account, or tell us your Instagram username if you are a buyer or someone who commented. We may ask you to confirm it is you. We answer within 30 days. Exercising a right never costs you anything and never changes how we treat you.

• European Economic Area, United Kingdom and Switzerland. You also have the rights in the GDPR and UK GDPR, including the right to complain to your local data protection authority.
• California and other US states. You have the right to know, delete and correct, and the right not to be discriminated against for using them. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer anything about you.
• India. Under the Digital Personal Data Protection Act 2023 you also have the right to grievance redressal through our Grievance Officer, below, and to nominate someone to act for you.

If you bought from or messaged a creator, they decide what was sent to you; you can ask them, or us, and we will help.

Children

Creators must be at least 18 to use okan. okan is not directed at children and we do not knowingly collect data from anyone under 13, or under 16 in the European Economic Area. If you believe a child has given us personal data, tell us and we will delete it.

Security

Data travels over encrypted connections. Access tokens never leave our servers, passwords are stored only as one-way hashes, and uploaded files are private, reachable only through links that expire. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authorities as the law requires.

Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your data, we tell signed-in creators in the dashboard or by email before it takes effect.

Who we are and how to reach us

okan is operated by OKAN Solutions, an enterprise registered with the Government of India’s MSME Udyam registry under number UDYAM-HR-10-0110943, with its head office in New Delhi, India.

• General questions, support and privacy requests: amangoel300@gmail.com
• Grievance Officer, amangoel300@gmail.com. We acknowledge a grievance within 24 hours and resolve it within 15 days.