Privacy Policy

Effective date: 2026-05-28 · Last updated: 2026-05-28

Learn3D Studio ("the Service") is a single-operator tool operated by Vivek Pujari (the "Operator") to manage the Operator’s own Instagram Business accounts and Facebook Pages via the Meta Platform APIs. This policy explains what data the Service collects, why, where it is stored, and how it can be deleted.

The Service does not have a public signup. There are no "users" of the Service other than the Operator. People whose interactions (DMs, comments) are processed by the Service are users of Instagram and Facebook, not of the Service itself, but their interaction content is processed by the Service and is covered by this policy.

1. Data the Service collects

1.1 Data received from Meta when the Operator authorizes the app

• User Access Token and Page Access Tokens issued by Facebook Login for Business. Tokens are encrypted at rest using AES-128-CBC + HMAC-SHA256 (Fernet) with a key stored separately from the database.
• Facebook Page metadata for each Page the Operator administers: Page id, Page name, Page access scope.
• Instagram Business account metadata linked to each Page: Instagram Business Account ID, Instagram username, profile name. Used only to address API calls to the correct account.

1.2 Data received via webhooks (Instagram + Facebook events)

When a person interacts with the Operator’s connected accounts, Meta delivers a webhook payload to the Service. The payload is HMAC-SHA256 verified against the Meta App Secret before any processing. The following fields are stored:

• Inbound message content (DMs and comments): the text of the message, plus any attached image/video/file metadata (the attachment binary itself is not downloaded or stored).
• Sender identifiers: the Instagram or Facebook user id of the sender, plus the sender’s public username when present. The Service does not attempt to deanonymize, profile, or cross-reference senders.
• Conversation and post identifiers: the Instagram comment id, post id, or thread id needed to deliver a reply.
• Timestamps of each inbound and outbound message.

1.3 Data generated by the Service

• Generated reply text sent in response to each inbound message/comment, kept for audit and idempotency.
• Skip-reason audit log: when a safety gate prevents a reply, the reason (e.g., moderation, rate limit, denylist match) is logged.
• Scheduled-post metadata: caption, post type, target Instagram account, scheduled time, returned Instagram media id.
• Post-level Insights snapshots: reach, likes, comments, saves, shares, views, average watch time, sampled at +1 hour, +24 hours, +7 days, and +30 days after each post is published.

1.4 Media files

Video and image files queued for publication are uploaded by the Operator to a private Cloudflare R2 bucket. Files are served to Meta via pre-signed URLs with a 7-day expiry. Files are not shared with any party other than the Meta Graph API fetch at publish time.

1.5 What we do NOT collect

• No tracking cookies or analytics SDKs. The website does not set tracking cookies. There is no Google Analytics, Meta Pixel, Mixpanel, or similar SDK. The only cookie set is the HTTP Basic Auth challenge cookie on the Operator-only dashboard, which is a standard browser primitive.
• No device fingerprinting.
• No location data.
• No data from accounts the Operator does not own.

2. How data is used

• Publishing — caption + media + scheduled time are used to call the Meta Instagram Graph API publish flow at the operator-specified time, to the operator-authorized account only.
• Auto-replies — inbound message text + the brand-voice document the Operator authored for the receiving account are sent to OpenAI’s API to generate a single reply, which is then sent back via the Meta Send API to the same conversation thread within the standard 24-hour messaging window. No proactive outbound messaging.
• Insights display — post performance metrics are shown to the Operator only on the password-protected dashboard.
• Operational logging — token refresh attempts, webhook signature verification results, and API errors are written to log files for the Operator’s debugging.

3. Where data is stored

• Application database: PostgreSQL hosted on Railway in the United States. The database is private and reachable only from the Service’s own application processes.
• Media bucket: Cloudflare R2, private bucket, region ENAM (Eastern North America). Objects are not publicly listable; reads require pre-signed URLs.
• Marketing site + dashboard: Vercel CDN, served over HTTPS only.

4. Third parties

The Service shares data with the following entities only:

• Meta Platforms (Facebook, Instagram). All publishing and replying happens via the Meta Graph API. We send Meta the content the Operator authored or the LLM generated, and the recipient/post identifier required to route it.
• OpenAI. For each inbound DM or comment where auto-reply is enabled, we send the inbound message text, the post caption (for comments only, truncated to ~500 characters), and the Operator’s brand voice document to the OpenAI API to generate a reply. We do not send sender identifiers (id or username) in the prompt. OpenAI’s API processes the request and returns the generated reply. OpenAI may retain prompts for up to 30 days for abuse monitoring per their terms.
• Railway hosts the API backend and the Postgres database.
• Cloudflare hosts the R2 media bucket and routes the marketing site domain.
• Vercel hosts the marketing site and the Operator-only dashboard.

We do not sell any data. We do not use any data for advertising or retargeting. There are no third-party analytics, ad-tech, or data-broker integrations.

5. Data retention

• Webhook events + inbound messages: 365 days, then purged.
• Outbound replies: 365 days, then purged.
• Published posts and Insights snapshots: indefinite (these are the Operator’s own content metrics).
• Access tokens: stored until revoked by the Operator or replaced by a fresh OAuth flow.

If a person sends a Meta "unsend" webhook for one of their messages, the corresponding inbound_messages row is purged within 24 hours.

6. Rights and deletion requests

Senders whose DMs or comments were processed by the Service may request deletion of stored content. See the dedicated Data Deletion page for instructions. Deletions are completed within 30 days of request and confirmed by email.

The Operator can revoke the Service’s access at any time via Facebook → Settings → Business integrations → Remove. Revocation invalidates the stored access tokens on Meta’s side; the corresponding rows in our accounts table can be deleted on request.

7. Children

The Service is not directed at children under 13. The Operator does not knowingly process content from senders under 13.

8. Changes to this policy

Material changes to this policy will be posted on this page with an updated "Last updated" date. Continued use of the Service after a change constitutes acceptance.

9. Annual Data Use Checkup

The Operator commits to completing Meta’s annual Data Use Checkup on schedule for this app, attesting that data use continues to match this policy.

10. Contact

For privacy questions or to file a data subject request:
Email: architectpujari@gmail.com
Domain: ig.learn3dfashion.com
Operator: Vivek Pujari