Privacy Policy
Last updated: · Version: 2026-10-05 · Previous versions
This policy explains what data we collect when you use Rudud, why, who we share it with, and what your rights are. It is written to match what the code actually does, and nothing more.
Data controller: Alhramayn LLC, a Pennsylvania limited liability company, United States · 34 E Main St, Carnegie, PA 15106, United States · privacy@rudud.app.
If you commented on one of our users' posts and received a message, read the Commenter Privacy Notice. It was written for you.
1. Summary
- We do not sell your data or share it for advertising. No ads, no tracking, no third-party analytics on the website or in the app.
- We collect only what the Service needs: your account, your Instagram connection, your automations, and the people your replies reached.
- Data about people who comment on your posts is processed on your behalf and stays in your workspace only.
- You can delete your account and all your data from the app or the website at any time.
2. What we collect
| Data | Source | Why |
|---|---|---|
| Name and email | You at sign-up, or Google, or Apple (name on first sign-in only; the email may be an Apple private relay address) | Creating your account, signing in, password reset, verification |
| Password | You | Stored hashed; we cannot read it |
| Rudud account ID, Apple and Google identifiers | Generated by us or provided by the sign-in provider | Identifying your account |
| Instagram account ID, username, profile picture, access token | Meta, when you connect, with your permission | Replying to comments for you. The token is encrypted. We never hold your Instagram password |
| Automations: keywords, reply text, public reply, automation name, selected post | You | Doing what you asked |
| Thumbnails of your posts | Meta | Choosing a post in the builder. Kept 24 hours only |
| People: Instagram username and ID of each person who commented and received your reply, interaction dates, message counts | Meta, when the comment arrives | Showing your People list and insights, preventing duplicate replies. Processed on your behalf (see 5) |
| Raw event archive from Meta (comment and message text) | Meta | Diagnosing failures. Deleted automatically within 23 hours and never stored in the database |
| Consent record: document, version, time, IP address, browser or device type | Logged when you accept | Proof that you accepted the Terms and this policy. Kept for the life of the account |
| Push token (APNs), device language, time zone, app version | The app, if you allow notifications | Sending notifications at the right time and in the right language |
| IP address and browser or device type for each session | Your requests | Security and abuse prevention. We do not derive your location from it |
| Audit log: connect, disconnect, deletion, sign-in events, with IP and Instagram username | Your actions | Security and compliance. Deleted after 12 months |
| Your messages to us | You | Support |
What we do not collect: location, your phone contacts, your photos, browsing history, advertising identifiers, or any health or financial data. We do not read your Instagram direct messages, except for an automatic, momentary check of replies to Rudud's messages, looking only for the stop word, without keeping their text outside the temporary archive that is deleted within 23 hours. Nor do we read comments that match neither your keywords nor the stop word.
3. Legal basis
Where a legal basis is required (for example in Saudi Arabia, the UAE, Egypt, the EU and the UK):
- Contract: account, connection, automations, people, service notifications.
- Legitimate interests: security and abuse prevention (IP, audit log), and the global list of people who asked not to be messaged.
- Legal obligation: consent records, and tax records in future.
- Consent: marketing email (off by default) and push notifications.
4. How we use data
To run the Service, send your replies, show your insights, tell you about your account, protect the Service and its users, and comply with the law. We do not use it for advertising or profiling, and we do not sell or share it for anything in return.
5. Data about people who comment on your posts
When you connect Instagram and create an automation, the usernames and IDs of people who comment reach us from Meta and we process them on your behalf. You are the controller and we are the processor, under the Data Processing Agreement. We keep this data in your workspace only, do not combine it across accounts, and use it for our own purposes only to prevent abuse and to honor people who asked not to be messaged (a global suppression list that stores only a hashed username). This data is deleted when you delete your account, 30 days after you disconnect Instagram, or after 12 months without interaction. Commenters can request deletion directly through the notice written for them.
6. Who we share data with
We share data only with providers who work for us under contracts that require them to protect it. They are listed on the Subprocessors page:
- Cloudflare (hosting, database, storage, queues, inbound email): global network; processing may occur in the United States.
- Resend (outbound email): United States.
- Apple (Sign in with Apple, push notifications) and Google (Google Sign-In): depending on how you sign in.
- Meta (Instagram API): receives our requests on your behalf under Meta's policy.
We may also disclose data when required by law or court order, to protect our rights or users' safety, or to a successor of the Service with notice to you.
7. International transfers
Our servers run on Cloudflare's global network, and your data may be processed in the United States or elsewhere. We protect it with encryption in transit and at rest and with data processing agreements with every provider. For users in Saudi Arabia, the UAE and Egypt: we follow the transfer rules of your country's law to the extent they apply to us. For the EU and UK, when the Service becomes available there: Standard Contractual Clauses and the EU-US Data Privacy Framework.
8. Retention
| Data | Period |
|---|---|
| Account and automations | Life of the account; deleted immediately on deletion |
| Instagram access token | Until disconnect or deletion, then deleted immediately |
| People (who received your reply) | Until account deletion, 30 days after Instagram disconnect, or 12 months without interaction |
| Raw event archive | 23 hours |
| Post thumbnails | 24 hours |
| Consent record | Life of the account, then one anonymized row proving consent |
| Audit log | 12 months |
| Aggregated statistics (no names) | 13 months |
| Backups | Purged within 35 days of data deletion |
| People who asked not to be messaged | Stopped one account: their ID as that account sees it. Asked for a global opt-out: a hashed username. Both kept permanently, so we can honor the request |
9. Your rights
Wherever you are, you can:
- Access your data and export it (Account → Export my data).
- Correct it in account settings.
- Delete it entirely (Account → Delete account), which also revokes your Apple and Instagram tokens.
- Object to processing based on legitimate interests, and withdraw consent to marketing at any time.
- Complain to your data protection authority: SDAIA in Saudi Arabia, the UAE Data Office, the Personal Data Protection Center in Egypt, or the equivalent in your country.
We respond to requests within 30 days. Write to privacy@rudud.app; we may ask you to verify your identity. We do not discriminate against you for exercising your rights.
For residents of US states with privacy laws: we do not sell your data or share it for targeted advertising, we do not process sensitive data, and you may appeal our decision by writing to privacy@rudud.app with the subject "Appeal".
10. Deletion requests from Meta
If you request deletion from within your Instagram or Facebook settings, Meta signals us and we delete your data automatically, giving you a confirmation code and a page where you can check the status.
11. Security
Encryption in transit (TLS) and at rest, additional encryption of access tokens with a separate key, two-factor authentication on all admin accounts, least privilege, and access logging. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires. To report a vulnerability: security@rudud.app or the Security page.
12. Cookies and local storage
We use only the cookies and local storage needed to run the Service (session, CSRF protection, Instagram connection state, language, theme, Cloudflare security). No analytics or advertising cookies, so we show no consent banner. Details in the Cookie Policy. The app does not use cookies.
13. Children
The Service is for people aged 18 and over. We do not knowingly collect data from anyone younger, and if we learn we have, we delete it and close the account.
14. Changes
For material changes we notify you by email and in the Service 30 days in advance. Earlier versions are in the version history.
15. Contact
privacy@rudud.app · Alhramayn LLC · 34 E Main St, Carnegie, PA 15106, United States, United States