1. Introduction
SwipeReply helps creators and businesses answer the comments and direct messages on their Instagram account. To do that, we process personal data: yours, and data of the people who write to you. This Privacy Policy explains what we collect, why, on which legal basis, who receives it, how long we keep it and what rights you have.
It applies to the website swipereply.com, the SwipeReply web application at app.swipereply.com and the connection between SwipeReply and your Instagram account. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
2. Controller
Kollwitzstraße 76
10435 Berlin, Germany
Managing directors: Ludwig Petersen
Email: hi@swipereply.com
SwipeReply is a brand of Dnkfbrk GmbH, registered at the Amtsgericht Charlottenburg under HRB 255497 B.
3. What SwipeReply does with your data
SwipeReply connects to your Instagram Professional account (Creator or Business) through the official Instagram API provided by Meta. Once connected, SwipeReply reads the comments and direct messages you receive and writes replies in your voice. There are three ways to reply:
- Reply Drafts: SwipeReply writes a draft for every comment or message. Nothing is sent until you approve it with a swipe.
- Auto Reply: for categories you switch on, such as praise, emoji or price questions, SwipeReply answers on its own within the rules you set. Complaints and sensitive requests always wait for you.
- Automations: a keyword in the comments triggers a public reply and a direct message with a link, according to a rule you create.
To write replies that sound like you, SwipeReply uses the context of your account: the caption of the post, a transcript of the reel, the comment thread, your past replies, the example answers and knowledge base you add, and, where you enable it, a web search for facts that are not in your material. Corrections you make to a draft are stored as memory so future replies improve.
4. Data we process
4.1 Account and billing data
- Name, email address and login credentials (passwords are stored hashed)
- Company name and address if you provide them, plan, billing period and usage (number of replies)
- Payment data, processed exclusively by Stripe. We never see or store full card numbers.
4.2 Instagram data
When you connect Instagram, you authorise SwipeReply to access the following through the official Instagram API:
- Your profile: username, account id, display name, profile picture
- Your posts and reels: captions, media and the transcripts we generate from your reels
- Comments and replies on your posts, including the public username and the text of each comment
- Direct messages your account receives and the messages SwipeReply sends on your behalf
- Access tokens that allow SwipeReply to act for your account. You can revoke them at any time in the app or in your Instagram settings.
4.3 Content you add
- Knowledge base documents, example answers, links and product information
- Rules: tone, banned words, safe topics, Auto Reply categories, Automation keywords and messages
- Edits and corrections to drafts, which SwipeReply stores as memory for future replies
4.4 Generated content and activity logs
- Drafts, your approvals, rejections and edits
- Replies and direct messages sent through Reply Drafts, Auto Reply and Automations, with timestamps
- Support and error logs needed to run the service
4.5 Website and technical data
- Browser type and version, device type, operating system, language
- IP address (kept short term for security and error logging)
- Referrer URL, pages visited, interactions and timestamps
- Cookies and similar identifiers as described in section 9
4.6 Contact and support
When you use the contact form or write to us, we process your name, email address, the topic, your Instagram handle if you add it, and the content of your message.
4.7 Data of people who interact with your account
To draft and send replies, SwipeReply processes personal data of the people who comment on your posts or message you: their public username and profile, the text of their comment or message, and the time it was written. We process this data on your behalf and only to answer them. It is not used to train AI models and it is not shared with anyone except the processors listed in section 7.
5. Purposes and legal bases
5.1 To provide the service (Art. 6(1)(b) GDPR)
- Creating and managing your account, connecting your Instagram account
- Writing drafts, sending replies and direct messages within the settings you chose
- Billing, invoices and subscription management
- Answering your support requests
5.2 Legitimate interests (Art. 6(1)(f) GDPR)
- Security, abuse prevention and error detection
- Improving the product, in aggregated and, where possible, anonymised form
- Measuring which of our marketing reaches new users
- Enforcing our Terms of Service
5.3 Consent (Art. 6(1)(a) GDPR)
- Newsletters and marketing emails
- Optional cookies and tracking pixels, where consent is required
You can withdraw consent at any time with effect for the future, for example through the link in every marketing email or by writing to us.
5.4 Legal obligations (Art. 6(1)(c) GDPR)
We keep invoices and accounting records as required by German commercial and tax law.
6. AI processing
SwipeReply generates replies with large language models operated by third party providers: Anthropic, OpenAI and Google (Gemini). To write a reply, we send the provider the context it needs: the comment or message, the post caption, the reel transcript, relevant past replies, excerpts from your knowledge base and your rules. Where you enable web search, a search query derived from the comment is sent to a search provider and the results are used as context.
These providers process the data as our processors under data processing agreements. Under their API terms they do not use your data to train their models. We do not train or fine tune AI models on your data or on the data of your community unless you explicitly agree to it.
By default, a human decides: every draft waits for your swipe. Auto Reply and Automations send replies automatically, but only for the categories and keywords you switched on and within the rules you set, and every automatically sent reply is logged in the app. We do not use your data for automated decisions that have legal or similarly significant effects on you in the sense of Art. 22 GDPR.
7. Recipients and processors
We do not sell or rent personal data. We share it only with service providers who process it on our behalf under GDPR compliant data processing agreements, where we are legally required to, or in the event of a merger or acquisition with adequate safeguards. Our processors are:
- Meta Platforms Ireland Limited (Instagram API): the connection to your Instagram account, reading comments and messages, posting replies
- Anthropic, OpenAI and Google: generating replies (section 6)
- Stripe: payment processing, invoices and subscription management
- Webflow: hosting of the website swipereply.com and delivery of contact form submissions
- PostHog (EU hosting): product analytics on the website and in the app
- Meta Pixel: measuring which of our advertising on Instagram and Facebook leads to sign ups
- n8n: workflow automation, for example transactional emails and internal routing
- Hosting and infrastructure providers for the application and its database
Aggregated, anonymised data, for example how many replies SwipeReply sends per month across all accounts, may be published or shared. It cannot be traced back to you.
8. International transfers
Some of our processors are located in the United States or process data there, in particular Anthropic, OpenAI, Google, Meta, Stripe and Webflow. Where personal data leaves the EU or EEA, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for certified companies, on the EU Standard Contractual Clauses, and on additional technical measures such as encryption in transit.
9. Cookies and tracking
We use the following cookies and identifiers:
- Essential cookies for login, session handling and security in the app. These are required and cannot be switched off.
- First party identifiers on swipereply.com (for example _sr_eid and _sr_fbc) that help us attribute sign ups to the ad or link that brought you here
- PostHog for product analytics: which pages and features are used, so we can improve the product
- Meta Pixel to measure our advertising on Instagram and Facebook
Analytics and advertising cookies are used on the basis of your consent where the law requires it, otherwise on the basis of our legitimate interest in understanding and improving the service. You can delete or block cookies in your browser at any time. Some parts of the app will not work without essential cookies.
10. Storage and security
We use industry standard technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or destruction: encryption in transit, access controls, logging, backups and least privilege access for our team. Data is stored on servers in the European Union or, for the processors named above, in countries with the safeguards described in section 8.
11. Retention
- Account data: for as long as your account exists, then deleted within 30 days unless we must keep it by law
- Instagram content, drafts, sent replies and memory: for as long as your Instagram account is connected and the data is needed to answer your community
- Invoices and accounting records: 10 years under German commercial and tax law
- Technical logs: usually no longer than 90 days
- Contact and support messages: for as long as needed to handle your request and document it
12. Disconnecting Instagram and deleting your data
You are in control of the connection and of your data:
- Disconnect Instagram in the app settings. SwipeReply then stops reading comments and messages and can no longer post for you.
- Delete your account in the app settings, or write to us. We delete your personal data, your Instagram content in SwipeReply and your community data within 30 days, except where the law requires us to keep records such as invoices.
- You can also remove SwipeReply's access in your Instagram or Facebook account settings under apps and websites. Access tokens become invalid immediately.
13. Your rights
If you are in the EU, the EEA or the United Kingdom, you have the following rights regarding your personal data:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent at any time (Art. 7(3) GDPR)
To exercise these rights, write to us through the contact page. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59 to 61, 10555 Berlin.
14. Children
SwipeReply is not intended for people under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
15. Changes to this policy
We update this Privacy Policy when the product or the law changes. The current version is always published on this page with the date of the last update. For material changes we inform you by email or in the app.