Privacy Policy

1 Introduction

Welcome to MonkHQ ("we," "our," or "us"). We provide a social commerce and automation platform designed to help content creators and brands turn public social interactions into private sales conversations, automate comment replies, deliver digital products, and manage influencer marketing campaigns.

We respect your privacy and are committed to protecting personal data. This Privacy Policy outlines how MonkHQ collects, uses, encrypts, and retains your data, particularly in connection with the Meta Platform (Instagram Graph API and Facebook Login), in compliance with GDPR, CCPA, and Meta Platform Terms.

2 Information We Collect

When you create an account or link your Instagram account with MonkHQ, we collect:

Account Information: Name, email address, password hash, and workspace role (Creator, Brand, or Platform Admin).
Meta & Instagram Data: Instagram account ID, username, profile picture URL, public post comments, media IDs, and OAuth tokens.
Automation Configuration: Trigger keywords, automated reply copy, sales funnels, and dispatch metrics.
Billing Details: Subscription tier, tax jurisdiction, and billing status (all credit card details are handled via PCI-DSS compliant processors).

3 Meta API Scopes & Data Usage

MonkHQ requests only the minimum permissions necessary to deliver our automation services. Specifically:

instagram_business_basic

Identifies connected Instagram business/creator accounts and displays account identity in your creator workspace.

instagram_business_manage_comments

Receives real-time webhook events when followers leave comments on your posts or reels to trigger keyword automations.

instagram_business_manage_messages

Allows the creator's authorized bot to send automated DM responses, coupon codes, and link cards requested by commenters.

instagram_content_publish

Allows creators to publish scheduled posts, photos, and reels directly to their verified Instagram feed from MonkHQ.

4 Security & Token Encryption

We treat Meta API access tokens with bank-grade security. All tokens (short-lived and 60-day long-lived tokens) are symmetrically encrypted at rest using AES-128/Fernet cryptographic keys derived from private server secrets. Tokens are never exposed in client-side code, logs, or public API endpoints.

5 No Sale or Transfer of Personal Data

MonkHQ does NOT sell, rent, monetize, or transfer your personal data, follower data, or Meta API content to any third parties, brokers, or advertising networks. Your data is used exclusively to operate your workspace automations.

6 Data Deletion & Deauthorization Rights

You maintain complete sovereignty over your data at all times:

App Deauthorization: You can disconnect MonkHQ at any time from your Instagram / Facebook Settings > Apps and Websites. Our server instantly processes deauthorization via our verified Deauthorization Callback.
Data Deletion Requests: You can request immediate erasure of all your data via our Data Deletion Callback or by emailing our privacy team.

7 Contact Information

If you have questions or concerns regarding our privacy practices or data handling, please contact:

MonkHQ Data Protection & Privacy Office

Email: privacy@monkhq.in • support@monkhq.in

Website: https://monkhq.in