Privacy Policy

1. Introduction & Overview

Cacto ("we", "our", or "us") operates the website https://cacto.cc and associated Instagram direct message automation services. We are dedicated to maintaining the trust and privacy of our visitors, creators, and business users. This Privacy Policy details how we collect, process, store, and safeguard personal information in full compliance with global privacy regulations, including the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act, the California Consumer Privacy Act (CCPA/CPRA), the ePrivacy Directive, and Meta Developer Platform Policies.

2. Information We Collect

We collect information directly provided by you, as well as data received through authorized platform integrations:

• Account & Contact Data: Name, email address, and authentication credentials provided during sign-up, magic link requests, or waitlist submissions.
• Meta & Instagram Platform Data: Authorized profile handles, Instagram Business/Creator Account IDs, public comment text triggers, and webhook events delivered via official Meta Graph API v20.0+ OAuth tokens.
• Financial & Billing Data: Payment processing is handled securely by Stripe. We do not store full payment card details or CVVs on our servers.
• Technical Telemetry & Device Information: Anonymized IP addresses, browser types, operating systems, and page interaction metrics.

3. Meta Graph API Data Standards & Purpose Limitation

Cacto accesses Meta Graph API endpoints strictly through OAuth 2.0 user permission flows (such as instagram_basic, instagram_manage_comments, and instagram_manage_messages). We strictly adhere to Meta Developer Platform Terms (Section 3 - Data Use and Protection):

• Purpose Limitation: Meta platform data is processed solely to execute user-configured comment-to-DM automation workflows and comment reply rotations.
• No Data Transfer or Sale: We never sell, rent, license, or transfer Meta platform data or user contact records to third-party ad networks, data brokers, or marketing aggregates.
• Data Retention & Auto-Purging: Meta platform data and tokens are retained only for as long as necessary to maintain active automation service. Upon permission revocation or data deletion requests, stored tokens and account data are permanently purged.

4. Cookie Tracking Policy & Analytics

In compliance with the ePrivacy Directive and GDPR consent requirements, Cacto uses essential and optional cookies on https://cacto.cc:

You can modify your cookie preferences at any time by clearing your browser cache or updating preferences via the Cookie Banner at the bottom of the page.

5. Data Security & Encryption Standards

All data transmitted between your browser, our servers, and Meta Graph API endpoints is protected using Transport Layer Security (TLS 1.3 / HTTPS). Sensitive access tokens, secret keys, and database records are encrypted at rest using AES-256 encryption within isolated server environments.

6. Your Rights Under GDPR & CCPA

Depending on your jurisdiction, you possess the following privacy rights:

• Right of Access & Portability: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your account and associated Meta data.
• Right to Restrict or Object to Processing: Opt out of optional analytics tracking or communications.

7. Data Deletion Instructions

To execute your right to data erasure or revoke Meta API access, visit our dedicated Data Deletion Request Page, or send an email to support@cacto.cc with your account handle. We confirm and execute complete data purges within 24 to 48 hours.

8. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out to our Data Protection Officer at support@cacto.cc.