Privacy Policy

OffHand is run by OffHand Ltd, a company registered in England and Wales (registration in progress). We are the controller for the data about you as an OffHand customer. For the data about the people who comment on or message your Instagram account, you are the controller and we process it on your behalf, only to run the features you switch on. Contact us at hello@offhand.me.

• Your name, email address and age, to create your OffHand login (OffHand is for people aged 13 and over, as Instagram is).
• Your workspace, its members and the settings you choose.
• What you create in OffHand: campaigns, keyword flows, messages, captions, hooks, reply style, artist profile, newsletters and the videos and images you upload.

When you connect an Instagram professional account, you log in on Instagram itself and choose to grant OffHand access. We never see or ask for your Instagram password. Through Meta's official Instagram API we receive:

• Your account's id, username, name, biography and profile picture (instagram_business_basic).
• Your own posts and reels, their captions and media (instagram_business_basic).
• Comments on your own posts and reels, with the commenter's username and id, so OffHand can reply or send the private reply you set up (instagram_business_manage_comments).
• Messages people send your account and their button taps, so a keyword flow can answer them inside Instagram's 24 hour window (instagram_business_manage_messages).
• Views, reach, likes, saves, shares and follower numbers for your own account and posts (instagram_business_manage_insights).
• Permission to publish the reels and posts you schedule, at the time you chose, and the id Instagram gives each one (instagram_business_content_publish).

An access token lets OffHand act for your account. It is encrypted at rest (AES-256-GCM) and used only for the actions you set up.

To run your flows we keep, for your account only: the commenter or sender's Instagram username and id, the comment or message text, what OffHand sent back and when, whether they opened a link, and the email address if they choose to give it in a DM or on your email page. We never message anyone who has not commented on your posts or written to you first, and never outside Instagram's 24 hour messaging window.

• To run the features you switch on: replies, private replies, DM flows, posting and the performance pages.
• To draft replies, hooks and captions in your style. Comment text, your past replies and stills from your own reels are sent to our AI provider for this; nothing is posted until it passes the checks you set.
• To stop duplicates, respect Instagram's limits and troubleshoot failures.
• To send you login links and, if you use newsletters, your emails to your list.

We do not sell data, do not use it for advertising, and do not use one customer's Instagram data to profile people for anyone else.

The OffHand team reads the public reels of a small number of public business and creator accounts through Meta's Business Discovery API, using its own Facebook login, to learn which written hooks perform, for the team's own accounts. We keep the hook text, caption and view numbers, and do not show them to customers. Videos are read once to find the text on screen and deleted straight away. No scraping, browser automation or unofficial access is used anywhere in OffHand.

• Meta Platforms (Instagram), to connect your account and carry out the actions you set up.
• Hetzner Online (Germany), which hosts our servers, database and backups in the EU.
• Anthropic (United States), the AI model that drafts replies, hooks and captions and reads text on reels.
• Resend (United States), which delivers login emails and newsletters.

Where data goes outside the UK, it is protected by the UK International Data Transfer Addendum or an equivalent safeguard.

• Instagram access token: until you disconnect the account or remove OffHand from Instagram. It is cleared at once.
• Campaigns, posts, numbers, comment and reply history, DM logs and email lists: while your account is in OffHand. Disconnecting keeps them so that reconnecting picks up where you left off; a deletion request removes them.
• Raw notifications from Instagram (comments, messages, taps): 30 days, then deleted.
• Server logs: 6 weeks. Backups: up to 30 days, then overwritten.
• Your OffHand login: until you ask us to delete it.

Disconnect an account in Settings to stop everything at once. Remove OffHand in Instagram (Settings, Apps and websites) to do the same from Instagram's side, and request deletion there to have everything we hold for that account deleted automatically. You can also email us. The Data Deletion page has every route.

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and take it elsewhere. Write to hello@offhand.me; we answer within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office (ico.org.uk). People who interacted with an OffHand customer's account can write to that customer, or to us and we will pass it on and help.

Tokens are encrypted, Instagram's notifications are checked against Meta's signature before anything is done with them, the servers are reached only over HTTPS, and only the people who run OffHand can reach the database.

When this policy changes in a way that matters, we update the date at the top and tell customers by email.