Meta Compliance & User Privacy

Data Deletion Instructions & Policy

Last Updated: 22 October 2026

Our Data Deletion Commitment:

RespoFire provides clear, accessible methods for creators and businesses to delete their data and disconnect connected Instagram accounts. We support Meta's data deletion callback specification with status verification tracking, in-app account disconnection, and manual deletion request handling.

1. Overview & Compliance Commitment

Afira Technologies Private Limited (“Company”, “we”, “us”, or “our”), operating the software platform RespoFire (“RespoFire”, “the Service”), respects your privacy and is dedicated to providing transparent, accessible mechanisms for users to manage, disconnect, and delete personal data and connected Instagram Business account records.

This policy provides the public Data Deletion Instructions required by Meta Developer Policies and explains our data deletion workflows, including automated callback handling, self-serve in-app disconnection, and manual support deletion.

Product: RespoFire

Legal entity: Afira Technologies Private Limited

Registered office: 7th Floor, RR Tower 4, Thiru Vi Ka Industrial Estate, Guindy Industrial Estate, Chennai 600032, Tamil Nadu, India

Support & privacy email: support@respofire.com

Website: https://respofire.com

Privacy Policy: https://respofire.com/privacy

Data Deletion Instructions URL: https://respofire.com/data-deletion

2. Three Methods to Request Data Deletion

Method A: Meta / Instagram App Removal (Automated Callback)

Automated

When you remove RespoFire from your Instagram account settings, Meta sends a signed data-deletion request to our callback endpoint (/api/auth/instagram/data-deletion).

  • Cryptographic Verification: Our server verifies the signed_request payload using HMAC-SHA256 against our Meta App Secret. Unverified requests fail closed.
  • Atomic Execution: A trusted PostgreSQL database procedure (public.process_data_deletion_request) executes an atomic transaction that deletes linked account records, cascades deletion to messages, conversations, leads, and customer entries, and tombstones credentials.
  • Confirmation Response: RespoFire returns a confirmation code and a status link to Meta in its callback response. For deletion requests submitted by email, our support team will provide confirmation details directly.

Method B: In-App Account Disconnection

Self-Serve

Workspace Owners and Admins can disconnect any linked Instagram Professional account directly from the RespoFire web application:

  1. Log in to your RespoFire dashboard at /login.
  2. Navigate to Dashboard → Settings → Connected Accounts & Integrations.
  3. Locate the account you wish to disconnect and click Disconnect.
Important Distinction: Disconnecting an account immediately stops ongoing automation, halts webhook processing, and revokes connection credentials. However, disconnecting does not by itself erase historical CRM records (such as past conversations, messages, leads, or customer profiles). If you require complete deletion of historical records, please use Method A or submit an email deletion request via Method C.

Method C: Manual Request via Email

Support Request

To request complete deletion of your account, workspace, customer interactions, or connected Instagram data, email our support team:

Email: support@respofire.com

Subject line: Data Deletion Request — [Your Workspace or Instagram Handle]

Required information: Your registered account email address and your connected Instagram username.

Security Notice: Never send passwords, OAuth access tokens, or sensitive credentials by email. We will only ask for information reasonably needed to locate and verify your account.

Processing Timeline: We acknowledge manual requests within 2 business days and aim to complete deletion within 30 days, unless applicable law requires a longer period or requires certain data to be kept.

3. What Data Is Deleted

When a full data deletion request is processed through our deletion workflow, the following categories of application data are deleted:

Instagram Account Bindings & Profile Metadata

Connected Instagram Business Account IDs, usernames, profile picture URLs, and workspace account mappings.

Access Credentials & Vault Secrets

OAuth page access tokens and secrets stored in Supabase Vault are revoked and tombstoned for credential deletion.

Customer & CRM Lead Records

Instagram-scoped customer identifiers (IGSID), customer CRM entries, lead stage classifications, and calculated purchase intent indicators associated with the deleted account.

Conversations, DMs & Comments

Direct message texts, direct message IDs (mid), comment IDs, comment texts, timestamps, and conversation threads associated with the deleted account.

Note regarding Meta's own systems: RespoFire deletes data held within its own systems. Meta Platforms, Inc. independently controls its own servers, platforms, and logs. Data held directly by Meta on Instagram or Facebook is governed by Meta's Privacy Policy and cannot be deleted by RespoFire.

4. Legitimate Retention Exceptions

Limited records may be retained for strictly defined legal, compliance, and security purposes:

  • Compliance Deletion Records: A record is retained for each deletion request to support confirmation and status verification. It contains a confirmation code, the associated Meta user/app-scoped identifier (and internal account lifecycle reference if linked), the request status, and the request timestamp. It does not contain customer names, email addresses, access tokens, credentials, or message bodies.
  • Security & Operational Logs: Technical telemetry needed to investigate abuse, defend against rate-limiting attacks, or protect the Service may be retained under applicable infrastructure settings.
  • Backups: Information held in infrastructure backups is retained under applicable backup lifecycle settings until it is removed through normal rotation. We do not promise immediate removal from all backups.
  • Statutory Financial & Tax Records: For paid subscriptions, statutory accounting, invoice, and transaction records are retained in accordance with applicable tax and statutory legal requirements.

Where information must be retained under applicable law, we limit its use strictly to the permitted purpose.

5. Confirmation Code & Status Verification

When an automated data deletion request is processed, RespoFire returns a confirmation code (such as del_...) and status URL to Meta. You can check the status of your request at any time using our dedicated status page or machine-readable status API:

Human-Readable Status Page:

https://respofire.com/data-deletion/status?code=YOUR_CONFIRMATION_CODE

Machine-Readable Status Query API:

GET https://respofire.com/api/auth/instagram/data-deletion/status?code=YOUR_CONFIRMATION_CODE

Sample JSON Response:

{
  "confirmation_code": "del_a1b2c3d4e5f6...",
  "status": "completed",
  "message": "Instagram user data deletion request has been processed successfully.",
  "requested_at": "2026-10-12T12:00:00.000Z"
}

Privacy & Security Guarantee: Both verification methods are publicly accessible without user login, requiring only the exact confirmation code. The machine-readable status API returns only confirmation_code, status, message, and requested_at. The human-readable status page presents these request status details alongside explanatory context, such as the deletion scope and applicable compliance retention information. Neither interface exposes workspace IDs, account credentials, customer personal details, or message content.

6. Step-by-Step Revocation Guide

To remove RespoFire's access directly through Meta or Instagram settings:

Option A: Via Instagram Mobile App (iOS / Android)

  1. Open the Instagram app and navigate to your profile.
  2. Tap the Menu icon (☰) → Settings and activity (or Settings and privacy depending on app version).
  3. Under Your app and media, tap Website permissions.
  4. Tap Apps and websites.
  5. Under the Active tab, locate RespoFire.
  6. Tap Remove and confirm removal.
  7. Switch to the Removed tab, tap RespoFire to view app details, and tap Send Request to initiate the automated data deletion callback.

Note on Meta Interface Variations: Meta periodically updates menu navigation labels across mobile operating systems and app versions. If this exact path does not match your app version, search for “Apps and websites” in settings or manage connected permissions via Meta Accounts Center.

Option B: Via Instagram Web Browser or Meta Accounts Center

  1. Log in to your Instagram account on a desktop browser or access Meta Accounts Center.
  2. Navigate to Settings → Apps and Websites (or Meta Accounts Center → Your information and permissions → Apps and websites).
  3. Locate RespoFire in the active authorized applications list and click Remove.
  4. Click View Removed Apps and Websites (or the Removed tab).
  5. Click View next to RespoFire, and click Send Request to trigger the automated data deletion callback.

When Meta sends a data deletion callback upon app removal, RespoFire processes it automatically through our verified deletion workflow.

7. Manual Support & Privacy Inquiries

If you require assistance with a data deletion request, wish to check the status of your data, or need to request a full workspace deletion, please contact our data protection team:

Afira Technologies Private Limited

Product: RespoFire

Registered office: 7th Floor, RR Tower 4, Thiru Vi Ka Industrial Estate, Guindy Industrial Estate, Chennai 600032, Tamil Nadu, India

Email: support@respofire.com

Privacy Policy: https://respofire.com/privacy

We acknowledge manual deletion requests within 2 business days and aim to complete them within 30 days, unless applicable law requires a longer period or requires certain data to be kept. Please provide your registered account email and connected Instagram handle so we can locate your records. Do not send passwords or access tokens.