Version: DRAFT v0.1 · 14 October 2026 · subject to legal review and to the feature being available
This Annex explains what Actib does when a restaurant connects its Instagram professional account and how the data Actib receives is handled. It complements the Privacy Policy and the WhatsApp and Meta Annex.
1. Controller
- Legal name:
ACTIB TECHNOLOGIES, S.EP. - RUC:
155790094-2-2026 - Domicile: Panama City, Republic of Panama
- Privacy contact:
support@actib.app
[LEGAL REVIEW] Confirm whether the law requires publishing the full domicile. The full address is not published on this site by decision of the owner.
2. What this is
When a restaurant connects its Instagram professional account to Actib, Actib reads and replies to direct messages and comments and prepares posts on the restaurant's behalf, through Meta's Instagram API. The restaurant's administrator starts the connection and can cancel it.
Until Meta approves Actib for each permission, this feature is not available for restaurant accounts. Actib does not connect an account unless its administrator authorizes it on Instagram.
3. Data we process
- From the restaurant's account: Instagram ID and username, account type, profile picture, follower and post counts, and an access token that Actib stores encrypted. Also who connected the account and when.
- From people who message or comment: their Instagram ID, their username and name where Meta provides them, the text and attachments of their messages and comments, and the date.
- From posts: images or videos, caption text and draft status, and who approved it.
- Technical data: logs of events received from Meta and operating counters, without message content.
4. Why
Only to give the restaurant the features it turned on: receiving and answering messages and comments, and publishing content its administrator approved.
- Actib does not reply automatically on the restaurant's behalf: a person sends each reply.
- Nothing is published without the express approval of the restaurant's administrator.
[VERIFY BEFORE PUBLISHING]Actib does not send Instagram messages or comments to language-model providers, does not use them for advertising, does not sell them and does not build profiles from them.
5. Roles
The restaurant decides why its customers' messages and comments are processed; Actib processes them as a technology provider on the restaurant's behalf, under the applicable DPA. For account data and the staff who connect Instagram, Actib decides the purpose.
6. Who receives data
- Meta Platforms: the source of the data and the destination of replies and posts. Meta processes data under its own policies.
- Google Cloud / Firebase: hosting and databases.
We do not share this data with other third parties except where the law requires it. The general provider list is in Subprocessors.
7. Security
[VERIFY BEFORE PUBLISHING] Tokens are stored encrypted and never displayed. Access to the data is limited to the restaurant's account and authorized Actib staff. Actib logs events without storing message text in the logs.
8. Retention
[PENDING] Periods per category. When Instagram is disconnected, Actib deletes the token and stops processing the account.
9. Your rights and how to delete your data
Write to support@actib.app with your Instagram username.
- If you administer a restaurant's account: you can disconnect Instagram in business.actib.app, Settings, Redes, and remove Actib in your Instagram account's app settings. Instagram notifies Actib, which starts deletion of the stored data.
- If you messaged or commented on a restaurant's account: write to us and we will delete the messages and comments of yours that we hold, or coordinate with the restaurant where they are the one responsible.
You will receive a confirmation code and can check the status of your request on the status page. More detail in the Data Deletion Instructions.
10. Contact
Email: support@actib.app