Privacy policy

1. Controller and contact

The data controller is Manuel Jesús Ramos Jiménez, an individual using the Disskero brand. Disskero is not a company or a separate legal entity. There is no registration service for external customers.

Contact for privacy, enquiries and rights requests: audio@disskero.com.

• Full operator identification · Legal notice

2. Current processing

• Connect and maintain the operator’s own professional account through official Instagram Login; verify identity, permissions and validity and refresh the token when appropriate.
• Read the account’s own posts and retain independent campaign configurations: name, keywords, messages, buttons, conditions and original resource links.
• Validate and record official comment notifications and, when authorized, messaging interactions, linking them to the media and campaign. Authentic comment reception and the outbound flow have not yet been established end to end.
• Protect the dashboard, prevent duplicates and reingestion after erasure, handle rights requests and diagnose errors using minimal data. The execution engine is closed; deploying it does not itself enable sends.

3. Data and sources

Instagram data comes from Meta’s official APIs and webhooks, the owner’s authorization and interactions on Instagram. The administrator enters campaign configurations.

• Connected account: official identifiers, username, display name, professional account type, avatar URL when available and granted permissions.
• Connection credentials: encrypted OAuth token, issue and expiry dates and verification status. AutoChat does not request or store the Instagram password.
• Accepted comments: comment and media identifiers, text, author identifier when supplied by Meta, date and technical references for validation, deduplication and campaign association.
• Campaign configurations and history; sanitized technical states and errors for OAuth, maintenance and subscription.
• Administrative access and hosting: the provider may process technical connection and security data, such as IP address, date and user agent, under its service.

The receiver does not store the complete webhook payload, authorization headers or secrets in application logs. Pseudonymous identifiers and hashes are not necessarily anonymous. Unnecessary sensitive or third-party data should not be included in comments or configurations.

4. Features not yet enabled

Automated public replies, private messages with buttons, follow checks and resource delivery require operator activation and the relevant official permissions. Outbound sending is disabled as of the date of this policy.

Future activation may only serve the requested interaction or resource within Meta’s permissions and messaging windows. It does not enable general advertising or a marketing subscription. Conversation identifiers, follow status and attributed link openings would only serve that flow and its statistics; acceptance by Meta does not prove receipt on a device, and an opening does not prove a human visit.

DM text is not used to build a conversation archive. Prepared measurement uses opaque links without first-party cookies; identifiable previews are excluded, although a forwarded link may attribute an opening to the original recipient. Before enabling these purposes, the status will be updated and this information supplied in the appropriate context.

5. Legal basis

Limited handling of expressly requested interactions and security relies on the controller’s legitimate interest (GDPR Article 6(1)(f)), assessed for purpose, necessity, expectations, minimization and objection. No special-category data is sought and no decisions with legal or similarly significant effects are made.

Handling rights requests and data-protection obligations relies on Article 6(1)(c). Commenting or following does not establish a contractual relationship. A public comment does not authorize advertising campaigns or unrelated subsequent uses.

You may object to legitimate-interest processing by writing to audio@disskero.com. The affected processing will stop unless a documented legal exception applies. Any future marketing communication requires its own lawful authorization; Meta’s technical availability does not provide it.

6. Providers, recipients and transfers

Meta operates Instagram under its own terms and privacy policy; AutoChat uses its official APIs exclusively. Cloudflare supplies hosting, execution, D1, queues and access control; its data processing agreement covers data processed on the operator’s behalf.

Exclusive EU residency is not guaranteed. Cloudflare’s DPA provides for the Data Privacy Framework and standard contractual clauses as applicable. Information and relevant safeguards may be requested from the controller.

Ordinary dashboard access is restricted to the operator. Data is not sold and customer accounts are not connected. Disclosure may be required by law. Providers may process their own service and security data under their respective policies.

• Instagram privacy policy
• Cloudflare data processing agreement

7. Retention

The criterion is to keep only what is needed for the interaction, security and rights handling. Pruning is scheduled on the server and is also available as an administrative operation. It can minimize comment text and direct identifiers after 30 days, remove technical receipts after 30 days, reception records after 90 days and individual metrics after 366 days. These are operational service criteria, not statutory deadlines or immediate erasure of every copy.

Minimal pseudonymous campaign membership and identity-scope aliases remain only as needed to prevent another first reply or handle rights. Restricted erasure or objection markers prevent reingestion and are reviewed when the objection is withdrawn, their purpose ceases or the account closes. They contain no comment text and are not treated as anonymous.

Campaign configurations and history support management and recovery; logical deletion is not physical erasure. Any third-party data exceptionally entered in a configuration requires selective review and erasure without destroying unrelated campaigns. The token remains encrypted while connected; disconnecting does not remove all history.

Rights requests are documented only as needed to handle them and demonstrate compliance or a specific obligation. Recovery copies and provider logs follow their actual retention windows; immediate disappearance is not promised. Erasures must be reapplied before reactivating a restored system. You may request review or erasure without waiting for these criteria.

8. Security

The dashboard uses Cloudflare Access and server-side checks; tokens remain encrypted and outside browser JavaScript. POST events require valid HMAC-SHA256 signatures, size limits and account validation; persistence prevents duplicates.

These measures reduce risk but do not guarantee absolute security. Passwords or tokens are not requested to handle rights requests.

9. Rights and complaints

Subject to legal conditions, you may request access, rectification, erasure, restriction, objection and, where applicable, portability. If processing relies on consent, you may withdraw it without affecting earlier lawfulness. You may also request information about applicable transfer safeguards.

Requests should be sent to the approved privacy contact and include only what is necessary to locate the data and reasonably verify the requester. The deletion instructions describe the proposed process.

The usual legal response period is one month from receipt. It may be extended by two further months because of complexity or the number of requests, with notice and reasons within the first month. You may complain to the Spanish Data Protection Agency.

• Data deletion instructions
• Spanish Data Protection Agency

10. This site and policy changes

This legal site contains only static content: it contains no forms, tracking scripts, analytics or first-party tracking cookies. Hosting may process technical data needed to serve and protect the pages.

Information updated on 3 November 2026. Material changes to purposes or processing require this information to be reviewed before implementation. Full operator identification is provided in the legal notice.