Privacy Policy

everythread is an Instagram AI agent platform. Businesses (“Brand Operators”) use everythread to operate AI-powered assistants on their Instagram accounts. The assistants read incoming direct messages and comments and respond on behalf of the Brand Operator.

This policy covers:

• Data we receive from Meta Platforms, Inc. (“Meta”) through the Instagram Graph API and Messenger Platform.
• Data we receive from end users (“you”) who message or comment on Instagram accounts operated using everythread.
• Data we receive from Brand Operators who use the platform.
• Billing data for Brand Operators who subscribe, which is collected and processed by our payment provider, Stripe.

This policy applies to the everythread platform globally, regardless of where you are located.

We only collect the minimum data needed to operate the AI agent. We do not collect Instagram passwords, payment card data (card payments are handled by Stripe; see Section 2.4), or any data outside the scope described below.

We use the information described in Section 2 only for the following purposes:

• Operating the AI agent. Reading your message or comment, generating a response in the Brand Operator’s voice, and replying via the Instagram Graph API.
• Conversation continuity. Maintaining short-term conversation history so the agent can respond coherently within an active thread.
• Agent quality and safety. Detecting abuse, spam, prohibited content, and routing complex or sensitive messages to a human at the Brand Operator.
• Service operations. Logging errors, monitoring uptime, and debugging the platform.
• Billing. Taking subscription payments through Stripe and keeping each Brand Operator’s subscription status current.
• Compliance. Meeting our obligations under the Meta Platform Terms, Developer Data Use Policy, and applicable law.

We do not use your information for:

• Selling, licensing, or renting your data to anyone.
• Advertising, ad targeting, or building advertising profiles.
• Profiling based on protected characteristics.
• Re-identifying or de-anonymizing data.
• Training general-purpose AI models. Your conversation data is not used to train foundation models.
• Combining data across Brand Operators or with data from other sources, except as needed to operate the platform.

We retain data only as long as needed to operate the platform:

• Active conversation context: retained for up to 90 days of inactivity, then automatically deleted.
• Brand Operator configuration data: retained for the duration of the Brand Operator’s contract, then deleted within 30 days of contract termination.
• Aggregate, de-identified statistics (e.g., total messages handled per day): may be retained indefinitely. Cannot be linked back to you.

If you request deletion of your data (Section 5), we delete it within 30 days regardless of the schedule above, except where we are legally required to retain it.

You have the following rights regarding your data, regardless of where you live:

• Right to access — request a copy of the data we hold about you.
• Right to correction — request that we correct inaccurate data.
• Right to deletion — request that we delete all data we hold about you.

We implement industry-standard safeguards:

• Encryption in transit (TLS 1.2+) for all data exchanged with Meta and sub-processors.
• Encryption at rest for stored conversation data and configuration.
• Access controls — least-privilege access, with all administrative access logged.
• Webhook signature verification — all incoming Meta and Stripe webhooks are validated against their signing secrets to prevent spoofing.
• No password storage — Brand Operators authorize via Meta’s OAuth flow only.
• No card data on our servers — payment details are collected by Stripe’s payment form and sent directly to Stripe, a PCI DSS Level 1 certified payment provider.

When you message a Brand Operator’s Instagram account that is operated using everythread, your message may be read and replied to by an AI agent rather than a human. Brand Operators are required to disclose AI-generated responses where required by law (e.g., California SB 1001, EU AI Act). The agent will hand off to a human at the Brand Operator when your request requires human judgment.

You can opt out of AI interaction at any time by stating “speak to a human” or similar language in the conversation, by ceasing to message the account, or by blocking the account on Instagram.

This Privacy Policy is designed to comply with the Meta Platform Terms and the Developer Data Use Policy. Where any conflict arises between this policy and Meta’s policies, Meta’s policies control. We do not use Meta data for any purpose prohibited by Meta, including but not limited to: selling data, profiling on protected characteristics, surveillance, re-identification, unauthorized data combination, or use of data against users’ interests.

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be communicated via the everythread website and, where required by law, by direct notice. Continued interaction with a Brand Operator’s account after a change constitutes acceptance of the updated policy.