Instagram integration privacy

Last updated: October 20, 2026

This page explains what happens to Instagram data when an organization connects an Instagram professional account to Flikk, and it adds to our main Privacy Policy.

What we receive from Meta

• An access token for the connected Instagram professional account, with the instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_messages permissions
• The account's Instagram user ID and username, which we use to show which account is connected
• Comments on the account's posts that Meta delivers to our webhook, which include the commenter's username, their user ID and the comment text
• Whatever the organization's flows ask Instagram for, such as the account's posts, comments and replies

What we use it for

We use this data only to run the flows the organization builds, such as publishing a post, replying to or hiding a comment, sending a direct message, or starting a flow when a comment arrives, and we never sell it, use it for advertising or share it with anyone except the services the organization's own flows send it to, including AI providers.

We handle data about the people who comment on or message an organization's account only on that organization's behalf, and we follow the Meta Platform Terms for all data we receive from Meta.

AI agents

An organization can build flows where an AI model reads comments or messages and writes replies, and in that case:

• The comment or message text and the person's username are sent to the AI provider the organization picks, which is OpenAI, Anthropic, Google or OpenRouter, using the organization's own account with that provider
• That provider handles the data under its own terms with the organization, and Flikk has no say over how it stores it
• Flikk itself never uses Instagram data to train AI models
• Replies an AI model writes are stored in the flow run like any other step, and they can be deleted the same way

What we store and where

• Access tokens are encrypted with AES-GCM before they are stored, in our database and in our flow engine, both run by our hosting providers
• The connected account's user ID and username are stored with the connection
• Each flow run keeps the event that started it and what each step returned, which can include usernames, comment text, message text and post details
• Flows that are paused, for example while waiting for a reply, keep their working data encrypted until they continue

How long we keep it

We keep this data until the organization deletes it, and nothing expires on its own today.

Who can see it

Members of the organization that connected Instagram can see its flow runs, within the permissions their team gives them, and Flikk staff access it only when needed for support or security.

How to delete it

• Delete a single flow run through the Flikk API, which removes everything that run stored
• Disconnect Instagram in Flikk, which deletes the stored token and account details
• Delete the organization, which deletes all of its runs, tokens and paused flows
• Remove Flikk from your Instagram settings under apps and websites, which tells us to delete the tokens connected to your account
• Email privacy@flikk.dev and we will delete your data within 30 days

Every way to delete your data is listed on our data deletion page.

Contact

For questions about this page, email privacy@flikk.dev.