Privacy policy

Who we are

Dobbi is a tool for social media specialists who manage Instagram accounts and Facebook Pages for their clients. It is operated by the company below. Write to us with any question about your data.

Company

[Company name — not set yet]

Address

[Address — not set yet]

Email

[Contact email — not set yet]

Data we process

• Your account: your email address and the clients you belong to in Dobbi.
• Your content: the posts, captions, images and videos you create or upload in Dobbi.
• From Meta, for the Facebook Pages and Instagram accounts you connect:
  • their ids, names and usernames
  • access tokens, stored encrypted
  • comments on your posts, with the commenters' usernames and the comment text
  • the text of private replies sent from Dobbi
  • statistics of your posts and accounts
  • the list of posts already on your Instagram profile (picture links, post links and dates), to preview your grid
• From Meta, for an ad account bound to a client:
  • the account's name, currency, time zone, status, amount spent, balance and spend cap
  • its campaigns, ad sets and ads, with their names, objectives, budgets, status, review results, delivery issues and learning phase
  • their daily results: spend, impressions, reach, clicks and actions
  • Meta's recommendations for its ad sets and ads

Why we process it

• Your email address: to sign you in and to show you the clients you work on.
• Your content: to show it to your client for approval and to publish it at the time you choose.
• Page and Instagram ids, names and usernames: to show which accounts a post goes to.
• Access tokens: to publish, read comments, send replies and read statistics for the accounts you connected, and for nothing else.
• Comments and commenters' usernames: to show them to you so you can answer, and to run the reply rules you set.
• Private reply texts: to show what was sent and whether it was delivered.
• Statistics: to show how posts and accounts perform over time, including comparison with the same period a year earlier.
• The list of posts on your Instagram profile: to preview your grid with the posts you plan.
• Ad account data: to show the client its own ad account, campaigns, results and Meta's recommendations in Dobbi.

How long we keep it

A daily job deletes data once its period below has passed.

• Comments and commenters' usernames: 90 days from when the comment was written, to answer comments. Instagram allows a private reply only within 7 days of a comment.
• Private reply texts and their delivery records: 90 days, to show whether a reply was delivered and to help with support.
• Statistics, with the captions of the posts they describe: 13 months, to show how posts and accounts perform over time, including comparison with the same period a year earlier.
• The list of posts on your Instagram profile: each new read replaces the last one, and it is read again when the grid preview is opened more than an hour after the last read. The last list is kept until the account is deleted from Dobbi, and is deleted with it.
• The activity log of Dobbi: 12 months, to review what happened when something goes wrong.
• Notifications: 90 days, to show you what needs your attention.
• Records of when we last read comments for a post: 90 days after the last read, so we read only new comments.
• A connected account whose access ended, because it was disconnected or removed in Facebook: 30 days after its access ended, so you can reconnect it without losing its history. Then the account and everything we read from Meta for it are deleted.
• A connected account whose access stopped working and was not reconnected: 90 days after its access stopped working, then it is deleted the same way.
• Daily ad results: 13 months, to show how ads perform over time.
• The record of actions taken on ad accounts: 12 months, to review what was done and when.
• Campaigns, ad sets and ads that Meta no longer lists: 30 days, then they are deleted.
• An ad account unbound from its client, or whose access ended: 30 days, then the account and everything we read from Meta for it are deleted.
• Breakdowns of ad results by age, gender, platform and country: not stored. They are read live from Meta each time a client asks for one.
• Records of deletion requests: 12 months, as proof that we deleted the data. They hold a coded form of your Facebook user id and no content from your accounts.
• Posts, captions, images and videos created in Dobbi: as long as the client they belong to exists.
• Your email address: as long as you have an account.

Who processes it for us

These companies process data for us, only to run Dobbi:

• Vercel: hosts the application.
• Supabase: database, sign-in and file storage. Data region: [Data region — not set yet]
• Upstash: runs background jobs, such as publishing at the scheduled time.
• Resend: sends email, such as confirmation codes.
• Meta (Facebook and Instagram): the platform you connect. We send it the posts you publish and the replies you send, and read from it the data listed above.

What we never do

• We never sell your data or the data we receive from Meta.
• We never use your data or the data we receive from Meta to advertise for ourselves or for anyone else; the Ads section only shows the client's own ad account to the client.
• We never build profiles of the people who comment on your posts.

How to delete your data

• On Facebook: remove Dobbi under Facebook Settings, Business Integrations. Facebook then asks us to delete the data we hold from Facebook about you and gives you a link to the status of that request. Check the status of a request: Data deletion
• By email: write to [Contact email — not set yet]

Security

Access tokens from Meta are stored encrypted and used only for the accounts you connected.

We never see or store your Facebook or Instagram password: you sign in on Facebook's own page. You sign in to Dobbi with a link sent to your email, so we keep no password for your account either.

To limit how often pages and links can be tried, we count requests per connection address. Connection addresses used for rate limits are stored only as keyed hashes and deleted within a day.

Children

Dobbi is not meant for people under 18.

Changes to this policy

When this policy changes, we publish the new version on this page with a new effective date.

Effective date: 5 October 2026