Privacy Policy
Last Updated: 23 October 2026
1. Who we are
RespoFire is an Instagram AI Sales Assistant operated by Afira Technologies Private Limited (“RespoFire”, “we”, “us” or “our”). The Service helps creators and businesses manage eligible Instagram conversations, automate replies, organise leads and answer product questions using business information supplied by workspace owners.
This Privacy Policy applies to the RespoFire website, application, APIs and related services.
Company: Afira Technologies Private Limited
Registered office: 7th Floor, RR Tower 4, Thiru Vi Ka Industrial Estate, Guindy Industrial Estate, Chennai 600032, Tamil Nadu, India
Privacy and support: support@respofire.com
Data deletion instructions: https://respofire.com/data-deletion
We use personal data to provide, protect and operate the Service. We do not sell personal data or customer lists, and we do not share personal data with advertising networks or data brokers for their own advertising purposes. We do not ask users for their Instagram passwords. Instagram connections use Meta's authorisation process.
2. Information we process
The information involved depends on how you use RespoFire, the features enabled and the permissions granted through Meta.
Account and workspace information
We collect and process names (such as first name and last name), email addresses, phone numbers (only if optionally provided), authentication and security credentials, workspace names, member roles, invitations, business profiles, product catalogues, product prices and descriptions, FAQs, business policies, automation rules and workspace settings. Providing a phone number is optional; you can register, authenticate, and use RespoFire without providing one.
Users may sign up and sign in directly using email credentials or through Google single sign-on (“Sign in with Google”). When you choose Google sign-in, Google processes your authentication credentials under its privacy policy and shares your verified email address, name and account identifier with RespoFire to authenticate your account. Google does not receive your Instagram direct messages, comments, customer records or workspace business data.
Account passwords are handled by our authentication provider, Supabase Auth. RespoFire does not store account passwords in plain text.
Instagram and customer interaction information
When a workspace owner connects a supported Instagram Professional account (Business or Creator) and grants the relevant Meta permissions, RespoFire processes information made available through official Meta Graph APIs, workspace owners, and customer interactions:
- Customer interaction details received from Meta: Instagram-scoped user identifiers (IGSID), interaction timestamps, and where provided by Meta webhooks or APIs, usernames. Where available and supported, optional customer profile fields (such as name or profile picture) may be stored, but are not available or collected for every interacting user.
- Conversations and messaging: Post and Reel identifiers, captions, direct message identifiers, message content, media references, comment text, commenter usernames, timestamps, and delivery statuses.
- Workspace business information supplied by owners: Product catalogues, product names, descriptions, prices, links, keywords, business operating hours, shipping/return policies, FAQs, and custom AI prompt instructions.
- CRM data generated or inferred by RespoFire: CRM lead stages (such as engaging, qualified, converted, or lost), lead priority rankings, conversation handoff statuses, and purchase-intent indicators derived from customer message analysis.
We use this information to connect accounts, process incoming comments and messages, apply automation rules, generate AI-assisted replies grounded in approved business information, organise CRM leads, and facilitate human agent takeover.
Instagram permissions
RespoFire requests three Instagram permissions to provide its account connection, messaging and comment automation features. instagram_business_basic lets us access basic information about the connected Instagram professional account. instagram_business_manage_messages lets us manage Instagram messages on that account. instagram_business_manage_comments lets us support comment-related features, including private replies to comments, where permitted by Meta.
Technical and security information
We may process IP addresses, request metadata, browser or device information made available to the Service, login and security events, error logs, diagnostic information, rate-limit counters and webhook records. We use this information to operate the Service, prevent misuse, protect accounts and investigate technical problems.
Billing and invoice information
The Starter plan is free. Paid plans (Growth and Pro) are billed through Razorpay, a third-party payment gateway.
For paid subscriptions, Razorpay processes payment transactions. RespoFire stores invoice and transaction records for payment administration, customer receipts, subscription management, customer support, accounting, and statutory financial and tax compliance. Depending on the transaction and information provided during checkout, stored billing records may include customer name, customer email, plan tier, billing amount, currency, transaction identifiers, subscription identifiers, invoice numbers, billing period dates, payment status, and links to hosted receipts or invoice documents.
We do not store card numbers or card security codes. Payment card details and payment credentials are submitted directly to Razorpay through its secure checkout interface and processed under Razorpay's independent privacy policy and PCI-DSS standards.
3. How we use information
We use information to:
- Provide and operate the Service, including Instagram connections, eligible message processing, automation, AI-assisted replies, lead organisation and human takeover.
- Maintain accounts, workspaces, product catalogues, FAQs and automation settings.
- Protect the Service, enforce access controls and rate limits, investigate suspicious activity and respond to security incidents.
- Answer support requests and investigate service or billing issues.
- Diagnose errors, maintain reliability and improve the functionality of the Service.
- Comply with applicable law, respond to lawful requests, maintain required records and enforce our terms.
We process information on the legal grounds available under the law applicable to the relevant activity. Depending on the circumstances, those grounds may include providing a requested service, consent, compliance with a legal obligation or another lawful ground recognised by applicable law.
Where processing relies on consent, it may be withdrawn as permitted by applicable law. Withdrawal may affect features that depend on that processing.
4. AI processing
RespoFire uses OpenAI's API to generate automated conversation replies and assist with customer inquiries.
When an AI reply is generated, the information sent for processing may include:
- The incoming customer message and recent conversation history.
- Relevant product information, including titles, descriptions, pricing, links, and keywords.
- Business profiles, policies, and FAQs supplied by the workspace owner.
The exact information sent depends on the customer's inquiry and the context required to generate an accurate response.
RespoFire excludes human-agent messages from the AI context and avoids sending separate user account identifiers. However, because customers may freely include personal information within their messages, incoming message content transmitted to the AI provider may still contain personal data.
We use AI processing solely to generate relevant customer replies based on the workspace's business information. AI-generated replies may occasionally be incomplete or inaccurate. Workspace owners remain responsible for their product listings, offers, and business communications, and can pause automation or handle conversations manually at any time.
Under OpenAI's published API data policies, API inputs and outputs are not used to train or improve its models by default unless a customer explicitly opts in. For abuse-monitoring and security purposes, OpenAI may retain API data for up to 30 days, after which it is deleted, subject to limited exceptions such as security or abuse investigations, applicable legal compliance obligations, or services configured to retain data by design. RespoFire uses standard Chat Completions without persistent thread storage and does not opt in to model training. For more details, see OpenAI's data privacy documentation: https://developers.openai.com/api/docs/guides/your-data
RespoFire does not use customer personal data to train general-purpose AI models.
5. When information is shared
We do not sell personal data or customer lists.
We share information only as reasonably necessary to provide and protect the Service, follow a workspace owner's authorised instructions, meet legal obligations or address legitimate security and legal needs.
Service providers
Depending on the feature and information involved, the Service uses:
- Supabase: database hosting, authentication, and backend infrastructure, including secure credential storage.
- Google: user authentication services when signing in with Google. Google processes account identity data (such as name and email address) strictly to authenticate you. Google does not receive your Instagram messages or CRM data.
- Vercel: application hosting and edge content delivery.
- OpenAI: AI language processing and automated reply generation.
- Meta Platforms: Instagram authorisation, Graph API interactions, and webhook delivery.
- Razorpay: third-party payment gateway for subscription billing, payment processing, and invoice management on paid plans.
These providers process information under the terms, settings and arrangements applicable to their services.
We may also disclose information where required by law or a valid legal process, to investigate fraud or security incidents, or in connection with a merger, restructuring or transfer of business assets, subject to applicable law.
6. Instagram and Meta data
RespoFire uses Meta's APIs to provide Instagram-related features. Your use of Instagram and Meta services is also subject to Meta's own terms and policies.
Disconnecting an Instagram account
A workspace owner can manage connected accounts through Settings, then Connected Accounts and Integrations in the dashboard.
Disconnecting an account immediately disables the connection, clears active access credentials, and halts ongoing automated messaging. Disconnecting does not by itself delete historical conversations, messages, leads or other CRM records already held by RespoFire.
Disconnecting an account and requesting deletion of historical data are separate workflows.
Requesting deletion through Meta
When you remove RespoFire from your Instagram account settings and submit a deletion request using “Send Request” in Meta's removed-apps settings, Meta sends a cryptographically signed data-deletion request to our callback endpoint. When Meta sends a valid signed deletion request to RespoFire, we process it through our data-deletion workflow.
Follow the current instructions at https://respofire.com/data-deletion. You can check the status of a deletion request at https://respofire.com/data-deletion/status using the confirmation information provided by the workflow.
Meta independently processes information on its own systems. RespoFire cannot delete information that Meta retains independently under Meta's own policies.
7. Cookies, local storage, and payment scripts
RespoFire uses essential first-party authentication cookies to securely maintain login sessions and browser local storage to preserve your theme preference. These essential items are necessary for the platform to function properly.
We do not use analytics cookies, advertising pixels, or third-party behavioural tracking technologies.
When accessing billing and checkout features, the Service dynamically loads Razorpay's secure checkout script (checkout.razorpay.com) directly from the payment provider to display the payment interface and facilitate transactions. Razorpay may set its own cookies during checkout, under its own privacy policy. The payment provider may process technical and device information necessary to securely process payments and prevent fraud under its own policies.
You can control cookie settings through your browser. Blocking essential authentication cookies will prevent you from logging in and using the Service.
8. Data security
We use technical and organisational safeguards designed to protect information against unauthorised access, disclosure, alteration, loss and misuse.
Depending on the system and data involved, safeguards include workspace access controls, database access restrictions, secure handling of Instagram credentials, encrypted network connections, authentication and permission checks, and verification of incoming Meta webhook signatures.
No system can guarantee absolute security. We will take appropriate steps if we become aware of a personal-data breach and provide notifications to affected individuals or authorities where required by applicable law.
Workspace owners are responsible for protecting their login credentials, limiting workspace access to trusted people and contacting us promptly if they suspect unauthorised access.
9. Data retention and deletion
We retain information for as long as reasonably necessary to provide the Service, fulfil the purposes described in this policy, comply with legal obligations, resolve disputes and protect the Service.
Retention depends on the type of information, the operational purpose for which it is processed, and applicable legal or accounting requirements.
How to request deletion
You can:
- Follow the instructions at https://respofire.com/data-deletion to submit a deletion request through Meta's removed-apps settings using ‘Send Request’.
- Contact support@respofire.com from your registered email address to request deletion or ask a privacy question.
- Disconnect a connected Instagram account through the available RespoFire settings. Remember that disconnecting does not by itself erase historical CRM records.
We may request reasonable information to verify a request and protect against unauthorised deletion.
Processing requests
Meta-originated deletion requests are verified and processed through the data-deletion workflow. The status can be checked using the confirmation information provided at https://respofire.com/data-deletion/status.
Manual requests are acknowledged within two business days and are targeted for completion within 30 days, except where applicable law permits or requires additional time or requires specific information to be retained.
Information that may be deleted or retained
Subject to the applicable workflow and law, deletion may cover connected-account information, associated credentials, customer records, lead stages, purchase-intent indicators, messages, comments, conversations and related interaction information held by RespoFire.
Limited records are retained where necessary for legal compliance, security, fraud prevention, dispute resolution, or documenting the handling of a deletion request. When a deletion request is processed, RespoFire retains a record containing the confirmation code, the associated Meta user/app-scoped identifier, the internal account lifecycle identifier (where linked), request status, and timestamps to process the request, support status verification, and document completion of the deletion. To protect your privacy, our public status lookup tool at https://respofire.com/data-deletion/status displays only the confirmation code, current request status, and timestamps, and does not expose internal or platform identifiers. Information held in backups may remain until removed through standard backup lifecycle expiration.
Where information must be retained, we limit its use to the permitted purpose.
10. Your privacy rights
Depending on your location and applicable law, you may be entitled to request access to, correction of or deletion of personal data, withdraw consent where processing relies on consent, or exercise other rights provided by law.
Contact support@respofire.com to submit a request. We may need to verify your identity and clarify the scope of your request before responding.
If your information is processed through a business that uses RespoFire, that business may determine why the information is used and may need to handle your request directly. We will assist or direct the request as appropriate to our role and applicable law.
Rights, remedies and regulatory complaint routes depend on the law that applies to the request.
11. International processing
RespoFire is operated from India. Our service providers may process information in other countries, depending on the infrastructure and services used.
Where international transfers are subject to legal requirements, we will apply the safeguards or transfer mechanisms required by applicable law.
12. Children and minors
RespoFire is intended for business users aged 18 or older and is not designed for children to register for accounts.
If you believe a child has provided personal information directly to RespoFire, contact support@respofire.com so we can assess the request and take appropriate action under applicable law.
Workspace owners are responsible for ensuring that their use of RespoFire and the information they submit complies with applicable law and platform requirements, including requirements relating to minors.
13. Third-party services and links
The Service interacts with third-party services, including Meta, Instagram, OpenAI, Supabase, Google, Vercel, and Razorpay. Those providers' own terms and privacy policies govern their independent services and processing activities.
We do not control the privacy practices of third-party websites linked from our website or Service. Review their policies before providing them with personal information.
14. Changes to this policy
We may update this Privacy Policy when our processing activities, features, providers or legal obligations change.
The current version will be published on this page with its revision date. Where applicable law requires notice or consent for a change, we will follow those requirements.
15. Contact us
For privacy questions, personal-data requests, deletion requests or complaints about our handling of information, contact:
Afira Technologies Private Limited
Product: RespoFire
7th Floor, RR Tower 4, Thiru Vi Ka Industrial Estate, Guindy Industrial Estate, Chennai 600032, Tamil Nadu, India
Email: support@respofire.com
Data deletion: https://respofire.com/data-deletion
We acknowledge general privacy inquiries and requests within two business days and aim to complete them within 30 days, subject to applicable law and any necessary retention of information. We respond to privacy requests in accordance with the legal requirements that apply to them.
Please provide enough information to understand your concern. Do not send passwords, access tokens or other authentication secrets by email.
If you remain dissatisfied, you may have the right to contact a competent regulator or other authority, depending on your location and the law applicable to your request.