1. What we collect
- Sign-up and sign-in (required): email, password (stored as a one-way hash), time of consent
- Marketing (optional): time of opt-in
- Instagram connection: Instagram account ID and username, access token (encrypted), post information
- Auto DM processing: Instagram ID and username of people who comment or message, the comment or message text, delivery records
- Link page visitors: hashed IP, browser details, referrer, clicks
- Payments (paid plans): card details are handled by the payment processor; we keep only the approval number, amount and time
- Generated automatically: access and error logs, visit statistics (pages visited, referrer, and a hash of IP and browser mixed with the date — the IP itself is not stored and visits can't be linked across days)
2. Why we use it
- Identifying members, sign-in and account recovery (email verification, password reset)
- Providing the Service: link pages, auto DMs, statistics
- Billing, refunds and promotions
- Preventing abuse, security and incident response
- (If you opted in) news about features and offers
3. Retention and deletion
We delete personal information without delay when you close your account, except where the law requires us to keep it for a period:
- Contract, withdrawal, payment and supply records: 5 years (E-Commerce Act)
- Consumer complaint and dispute records: 3 years (E-Commerce Act)
- Website access logs: 3 months (Protection of Communications Secrets Act)
- Electronic files are deleted in a way that cannot be recovered.
4. Sharing with third parties
We do not share personal information with third parties, except that message text and recipient IDs are sent to Meta Platforms, Inc. (Instagram) to deliver the auto DMs you set up, and where the law requires it.
5. Processors
- Vercel Inc.: web hosting
- Railway Corp.: database and worker hosting
- Email delivery provider: verification and notice emails
- Toss Payments: payment processing (when paid plans launch)
6. Transfers abroad
To run the Service we transfer personal information abroad as below. If you do not want this, do not sign up or close your account; the Service cannot be used without it.
- Recipients: Vercel Inc., Railway Corp. (the US and other countries where their data centers are)
- Items: everything listed in section 1
- When and how: sent over the network whenever the Service is used
- Purpose and retention: storage and processing to provide the Service, until you close your account or the processing contract ends
7. Your rights
You can ask at any time to see, correct or delete your personal information, or to stop its processing. You can change your password, withdraw marketing consent and close your account yourself on the Account page; for anything else, contact the privacy officer below.
8. Security
- Passwords are hashed (scrypt); Instagram tokens are encrypted
- Visitor IPs are hashed; the raw address is not stored
- HTTPS everywhere, least-privilege access, sign-in attempt limits
9. Cookies
We use cookies to keep you signed in and to remember your language. You can block cookies in your browser, but features that need sign-in will not work.
10. Privacy officer
You can also contact the Korean Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
- Officer: 황성주 (대표)
- Contact: support@replylink.co.kr
11. Changes
We announce changes to this policy in the Service at least 7 days before they take effect.