Privacy Policy

RaidBuster (“we”, “us”) is a service that automatically deletes abusive comment raids on Instagram professional accounts. This policy explains what data we collect, how we use it, and how you can have it deleted.

Data we collect

When you connect your Instagram account through Instagram Login, we receive and store:

• Your Instagram account ID, username, display name and profile picture URL.
• An access token for your account, stored encrypted (AES-256-GCM). We never see your Instagram password.
• Comments made on your media, delivered to us by Instagram: the comment text, the comment ID, the ID of the post it is on, and the commenter's username and Instagram-scoped ID.
• The captions of your posts that receive comments, used as context when checking those comments.

We also store data you give us directly:

• The email address you sign in with (through Google or an email link). We do not receive your Google password.
• Your RaidBuster settings, including custom words.
• Your Telegram chat ID, if you connect Telegram alerts.
• Your subscription status and plan, received from our payment provider (Whop). We do not store card details.

How we use it

• To check each new comment on your posts and decide whether it is part of a raid.
• To delete raid comments from your posts, and hide ones we are unsure about, on your behalf using the Instagram API. We keep a copy of each deleted comment so you can see what was removed and why.
• To show you a log of checked comments, send you raid alerts, and measure usage against your plan.

We request only the permissions needed for this: instagram_business_basic and instagram_business_manage_comments. We do not post, send messages, or read your direct messages.

Who we share it with

We do not sell personal data or use it for advertising. We share data only with service providers that run RaidBuster:

• Our AI model provider — the text of each comment, the caption of the post it is on and your username are sent to an AI model to decide whether the comment is an attack or spam. Commenter usernames are not sent.
• Supabase (database) and Vercel (hosting).
• Telegram — raid alert messages, if you enable them.
• Whop — payments and subscriptions.

Retention

We keep your account data and comment log while your account is connected. If you disconnect RaidBuster from Instagram, we immediately delete your access token and stop processing comments. If you request deletion, we delete your account, settings and comment log.

Deleting your data

You can delete all your data at any time from the dashboard, or by following the steps on our data deletion page.

Security

Data is encrypted in transit. Access tokens are additionally encrypted at rest with a key held separately from the database.

Contact

Questions or requests: omarkonteh34@gmail.com.