Privacy Policy

This Privacy Policy explains how Croudnest, an individual (sole proprietor), D-304, Dhara homes, Mota varachha, Surat, Gujarat, India 394101 ("Croudnest", "we", "us", "our") — collects, uses, shares, and protects personal data when you use the Croudnest website and services (the "Service").

By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

---

1. Who this Policy covers

This Policy applies to: (a) our users (account holders who use Croudnest), and (b) the people our users communicate with through the Service on Instagram (for example, someone who comments on a post or sends a DM). If you interacted with a business that uses Croudnest, that business is responsible for its own messages and contact data; this Policy explains how we process data in providing the Service.

2. Who collects your data (and who does not)

Croudnest is not Meta. Instagram and Meta do not collect or use your personal data on our behalf when you interact with a business through Croudnest. Meta provides the messaging platform only.

When you interact with a business on Instagram through Croudnest:

• The business (the Croudnest customer whose account you messaged or commented on) decides what to send you and why they need your information — for example, to deliver a link, guide, offer, or follow-up.
• Croudnest provides the automation software. We process messages and any contact details you voluntarily share on that business's instructions, to run the automation they configured.
• Meta / Instagram transmits messages through their platform but does not collect your data for Croudnest's or the business's purposes beyond what Meta already processes under its own policies.

If you have questions about why a specific business is contacting you or how they use your details, contact that business directly. For how Croudnest processes data as a service provider, use the contact details at the end of this Policy.

3. If you interacted with a business on Instagram

This section is for people who commented on a post, opened a DM, or replied to an automated message from a business using Croudnest — not for Croudnest account holders.

What we may process

• Your Instagram username and the content of your comment or DM (needed to run the automation).
• Any contact details you voluntarily type in the conversation — for example, name, email, or phone number if the business asks for them.

Why

• To deliver what you asked for (link, resource, reply, follow-up).
• To let the business stay in touch with you about what you requested.
• To operate, secure, and improve the Service.

How consent works

• By commenting, messaging, or continuing the conversation, you agree to receive the automated replies the business configured in response to your action. We do not send unsolicited messages to people who have not engaged first.
• When a business asks for additional personal data (such as email or phone), by voluntarily providing that information you consent to the business collecting it and to Croudnest processing it on their behalf.
• You can stop at any time by not replying, blocking the account, or asking the business to delete your data. You may also contact us (see below) if you believe data was processed through Croudnest and want it removed.

Important: The business you interacted with is responsible for the lawfulness of their messages and for any privacy notice they give you. Croudnest processes data only to provide the Service to that business.

4. Information we collect

Information you give us

• Account data: name, email address, password (stored in hashed form), and, if you sign in with Google, your Google account email and basic profile information.
• Billing data: plan, billing country, and transaction records. Card and payment-instrument details are collected and processed by our payment partners, not stored by us.
• Support data: messages you send us and related correspondence.

Information from Instagram / Meta (via the official Graph API)

When you connect an Instagram Business or Creator account and grant permissions, we access only what is needed to provide the Service:

• Account metadata — your connected account's username, ID, and profile picture (to display and route automations);
• Comments — to detect your chosen trigger keywords;
• Messages (DMs) — to send and receive the automated and follow-up messages you configure;
• Contact details a person voluntarily provides in a conversation (for example, an email entered in a data-collection step).

We access this data through Meta's official APIs. We do not scrape Instagram, and we do not send unsolicited or "cold" messages to people who have not engaged with you.

Information collected automatically

• Usage and device data — basic log information such as IP address, browser/device type, and actions within the app, used to operate, secure, and improve the Service.
• Cookies — see Cookie Policy below.

5. How we use information

We use personal data to:

• provide, operate, and maintain the Service and its automations;
• authenticate you and secure your Account;
• process payments and manage Subscriptions;
• provide customer support and respond to requests;
• detect, prevent, and address abuse, fraud, and security issues;
• comply with legal obligations and the terms of the platforms we integrate with;
• communicate service-related notices (and, where you have agreed, product updates you can opt out of).

6. Google sign-in and Google user data

We offer the option to sign in with Google, provided through Google Firebase Authentication. This section explains, as required by the Google API Services User Data Policy (including its Limited Use requirements) and the Google APIs Terms of Service, exactly what Google user data we access, and how we use, store, and share it. If you do not use Google sign-in, none of the following applies to you.

(a) Google user data we access

When you choose to sign in with Google, we receive the following from your Google account through Google's standard sign-in scopes (email, profile, openid):

• your Google account email address and its verification status;
• your basic Google profile information — your name and profile picture (photo URL);
• a unique Google account identifier (the Google user ID) used to recognise your sign-in.

We do not request access to your Gmail, Google Drive, contacts, calendar, or any other Google service or restricted/sensitive scope.

(b) How we use this data, and why

We use the Google user data above only to:

• authenticate you and confirm you control the Google account used to sign in;
• create, identify, and secure your Croudnest account, and recognise you when you return;
• populate your profile in the app (your name, email, and picture); and
• send you service-related communications at that email address.

We do not use Google user data for advertising, profiling, or any purpose unrelated to providing and securing the Service.

(c) How we store and handle this data

During sign-in, the Firebase ID token is verified by our backend and then discarded — we do not persist the raw token. We store only the limited profile data needed to run your account (your email, name, profile-picture URL, and the account identifier), held securely on our infrastructure (see Section 12) and retained as described in Section 10. Access to this data within our systems is restricted to what is necessary to operate the Service.

(d) How we share this data

We do not sell Google user data and do not transfer it to third parties except: to the service providers that help us deliver authentication and hosting (Google/Firebase and AWS, acting on our behalf); where you direct us to; or where required by law. We do not allow humans to read this data except (i) with your consent, (ii) as necessary for security, abuse prevention, or to comply with law, or (iii) where the data has been aggregated or anonymised.

(e) Limited Use

Croudnest's access to, use, storage, and sharing of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can review Google's own practices in the Google Privacy Policy, and you can revoke Croudnest's access at any time from your Google Account's security settings.

7. Payments

Payments are processed by our payment partners — Razorpay. When you pay, you provide your payment details directly to the relevant processor, who handles them under their own privacy policy and security standards. We receive confirmation and limited transaction data, not your full card details.

8. How we share information

We do not sell your personal data. We share it only with:

• Service providers / sub-processors who process data on our behalf, including:
  • Amazon Web Services (AWS) — cloud hosting and data storage;
  • Razorpay — payment processing;
  • Meta Platforms / Instagram — to send and receive messages through the official API;
  • Google / Firebase — authentication and sign-in.
• Professional advisers, authorities, or others where required by law, to enforce our Terms, or to protect our rights, users, or the public.
• A successor in connection with a merger, acquisition, or sale of assets, subject to this Policy.

9. International data transfers

We are based in India and use reputable global providers (such as those above) that may process data in other countries. Where data is transferred across borders, we take reasonable steps to ensure it is protected consistently with this Policy and applicable law.

10. Data retention

We keep personal data only as long as needed for the purposes in this Policy:

• Account and automation data — for as long as your Account is active.
• After an account-closure or deletion request — we delete or anonymise your personal data within 30 days, except where we must retain certain records (for example, transaction and tax records) to comply with the law.

See our Data Deletion page for how to make a request.

11. Your rights and choices

Subject to applicable law (including India's Digital Personal Data Protection Act), you may:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data;
• withdraw consent or object to certain processing;
• disconnect your Instagram Account at any time, which stops further access.

To exercise these rights, see our Data Deletion page or contact us using the details below. You can also lodge a complaint with the relevant data-protection authority.

If you interacted with a business through Instagram and are not a Croudnest account holder, you may contact us at support@croudnest.com with the business name or Instagram handle and your username. We will assist with deletion requests and delete data we hold in our systems within 30 days, as described on our Data Deletion page.

12. Security

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, and hashed passwords. No method of transmission or storage is completely secure, but we work to protect your information and to address incidents promptly.

13. Children

The Service is for users 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Cookies

We use only strictly necessary ("essential") cookies and similar technologies — for example, to keep you signed in, maintain your session, and protect against security risks. Some of these are set by Firebase Authentication as part of sign-in.

We do not currently use advertising cookies or third-party analytics cookies, and we do not track you across other websites. If this changes, we will update this Policy and, where required, ask for your consent. See our Cookie Policy for more detail.

15. Third-party links

The Service may link to third-party sites or services we do not control. Their privacy practices are governed by their own policies, and we are not responsible for them.

16. Changes to this Policy

We may update this Policy from time to time. We will revise the "Last updated" date and, for material changes, take additional steps to notify you where appropriate.

17. Contact and grievances

For privacy questions or to exercise your rights, contact: