Legal
Privacy Policy
What information Noolu collects when you connect your Instagram account, how we use and protect it, how long we keep it, and how you can delete it.
Effective October 21, 2026
At Noolu LLC (“Noolu,” “we,” “us,” or “our”), we build tools that help creators and businesses manage their Instagram messages and comments, and publish pages. This Privacy Policy explains how we collect, use, share, store, and protect information when you use noolu.pro, when people interact with Instagram accounts that use Noolu, and when we contact creators and businesses about Noolu.
Key Principles
- We never ask for, see, or store your Instagram password.
- We connect only through Meta's official Business Login for Instagram.
- We never sell your personal data or the Instagram data we process for our customers. Our public website uses Google Analytics and Google Ads to measure visits and sign-ups, with your consent where needed (see Cookies).
- You can delete your data yourself at any time.
1.Who We Are & Our Roles
Noolu LLC, 825 E Evelyn Ave, Sunnyvale, CA 94086, USA (info@noolu.pro), runs noolu.pro.
We're the controller for data about our customers, website visitors, referral-program members, and people we contact about Noolu. When we process data about people who message or comment on a customer's Instagram account, we do it on that customer's behalf, as their processor / service provider. If that's you, the creator or business decides how your data is used, so you can contact them directly, or contact us.
2.Information We Collect & Process
A. Information About Our Customers
- Account details: email address, name, and your password, stored only as a bcrypt hash.
- Sign-in details: if you sign in with Google, we receive your Google email, name, and profile picture and keep your email and name; if you sign in with Instagram, your Instagram account ID and username.
- Connected Instagram account: account ID, username, and profile picture URL, plus the access token Meta issues so we can act for your account.
- Your Instagram posts: post and Reel IDs, captions, thumbnails, links, and dates, so you can work with your posts in Noolu: choosing posts for automations, seeing which post a comment is on, and getting AI suggestions (a keyword or a draft automation) from a caption.
- Content you create: what you create or upload in Noolu, such as automations, messages and saved replies you write, images, pages you publish (these are public and show your display name), and what you give our AI features. Uploaded images are stored at a public link so Instagram and your pages can show them. We re-save each uploaded image without the details embedded in the file (such as location or camera information); images uploaded before we started doing this, in October 2026, may still contain them.
- Billing information: Stripe and Dodo Payments customer and subscription IDs, plan, price, status, and billing dates. Card and UPI details are handled by Stripe (USD) or Dodo Payments (INR, merchant of record) and never reach our servers.
- Technical and security data: IP address, browser and device details, pages visited, your approximate country (worked out from your IP address, to decide whether to offer INR pricing and whether our analytics, advertising, and referral cookies need your consent), sign-in attempts, and how much of your plan's limits you've used (such as AI credits).
- Records: when you accepted our Terms and this Privacy Policy, and emails you send us.
B. Information About People Who Interact With Our Customers' Instagram Accounts
When someone comments on, or sends a DM to, an Instagram account connected to Noolu, Meta sends us that event, and Meta also sends us a copy of each DM the account sends. We process:
- Identifiers: the person's Instagram-scoped ID (IGSID), a pseudonymous ID Meta assigns for each account, and their username, used to reply to the right person and to show the account owner who they're talking to.
- Comments and messages: the text of comments people leave on the account's posts and of the DMs it receives (including ones no automation answered, and button taps), with their times, which post a comment was on, and whether an automation ran. We use them to run the account owner's automations and to show them their activity and stats.
- Conversations: we also keep the DM conversations of each connected Instagram account so the owner can read and answer them: messages in both directions, including what the account sends from Noolu, the Instagram app, or other tools, and links to photos, videos, voice messages, files, shared posts and reels, and story replies or mentions (the files stay with Meta). Disconnecting the account stops new messages being saved but doesn't delete the conversations already kept.
- Follow status: when an automation uses a follow gate, we ask Instagram whether the person follows the account, to decide what to send next. Whether they follow it is also kept with their conversation (see Profile details).
- Email addresses: when an automation uses an email gate, it asks the person in a DM to reply with their email address before it sends what they asked for. We find the address in their reply with our own code (it isn't sent to AI providers) and keep it for the account owner, with the person's Instagram ID and username, which automation asked, and when. The account owner can see, download, and delete these addresses in Noolu. The reply itself is also kept as a message in the conversation.
- Profile details: for people in a DM conversation with the account, what Instagram provides about them (profile picture link, follower count, whether they follow the account, and whether they're verified), refreshed at most daily. Kept with the conversation.
- Notes and labels: what the account owner writes about a person. We show them only to that account owner and keep them with the conversation.
- Link clicks: when link tracking is on, the link buttons in automated DMs go through noolu.pro/l/…, so clicks can be counted. Account owners see the counts on plans that include link stats. The redirect stores only the time of each click, not who clicked (like any request, a click also appears in our server logs), and loads no analytics or advertising tools and sets no cookies.
We show this data to the account owner: in their dashboard, in desktop notifications if they turn them on, and, for email addresses, in a file they can download. Noolu staff access it only as described in Data Security. We keep it separately for each account a person interacts with and don't combine it across customers or with data from other sources. Comments, messages, and conversations are deleted after 90 days; email addresses are kept until the account owner deletes them (see Data Retention).
3.Instagram API Permissions
Noolu asks Instagram only for these permissions, which its features need:
instagram_business_basic
Reads your Instagram account ID, username, profile picture, and posts, to connect your account and let you work with your posts in Noolu.instagram_business_manage_messages
Receives the account's DMs and button taps, and copies of the DMs it sends; sends the replies you set up or write; and looks up basic profile details of people in its DM conversations.instagram_business_manage_comments
Receives comments on your posts and Reels, so your automations can answer them and you can see them in Noolu, and sends replies.
We don't sell, license, or buy data we receive from Instagram, use it for advertising, or use it to train AI models.
4.How We Use Data
- Providing the features you use: connecting your Instagram account, running automations (including follow gates and email gates, and keeping the email addresses they collect for you), managing conversations (reading and replying, notes, labels, saved replies, and notifications), stats, your published pages, and AI features you choose to use
- Securing accounts and the service: sign-in, rate limiting, and preventing fraud and abuse
- Billing through Stripe and Dodo Payments, including duplicate-charge protection, refunds, and disputes
- Emails about your account: verification codes when you sign up or add an email, password-reset codes, a notice when an email address already has an account, account deletion confirmations, and notices of changes to our terms, prices, or this policy (Stripe and Dodo Payments send receipts and renewal notices)
- Measuring visits to our public website and how our ads perform (Google Analytics and Google Ads, with your consent where needed), and how our website and app are used (Vercel Web Analytics)
- Contacting creators and businesses about Noolu
- Running the referral program
- Support, fixing problems, enforcing our Terms, and legal compliance
6.AI Features
When you use an AI feature, we send the text it needs (your prompt, a message draft, or a post caption) to our AI provider, currently Groq (US), only to produce the result for you. We don't send the comments or messages people send to your account to AI providers unless you turn on a feature that does; we'll describe any such feature here before it's available. We don't use your content or Instagram data to train AI models.
7.Data Retention
- Comments, messages, and conversations: each comment and message, with the record of any automation it started, is deleted automatically 90 days after it was sent. A conversation's profile details, notes, and labels are deleted 90 days after its last message. Disconnecting an Instagram account, or removing Noolu in Instagram's settings, stops new ones being saved but doesn't delete those already kept. All of it is deleted sooner if you delete your Noolu account, if Meta asks us to delete the Instagram account's data, if you connect a different Instagram account (or someone else connects this one) after disconnecting it, or on request (see Data Deletion).
- Email addresses collected by email gates: not on the 90-day schedule. An account asks each person for their address once: if it already has it, it doesn't ask again. Each address is kept until the account owner deletes it or the person unsends the message they gave it in. Unsending deletes it only while the account is connected to Noolu. Disconnecting the Instagram account doesn't delete the addresses, and once it's disconnected, Instagram no longer tells us about unsent messages; the account owner can still delete them, and so can we on request. To change or remove theirs, a person can unsend that message, ask the account owner, or email us. They're deleted sooner if you delete your Noolu account, if Meta asks us to delete the Instagram account's data, if you connect a different Instagram account (or someone else connects this one) after disconnecting it, or on request (see Data Deletion). Copies the account owner has downloaded are theirs to look after.
- Everything else in your account (such as your profile, connected accounts, automations, saved replies, pages, images, cached posts, link clicks, and how many email addresses you've collected each month): kept while your account exists and deleted when you delete your account. A connected Instagram account's automations, cached posts, and link clicks are deleted sooner, with that account (see Data Deletion).
- Instagram access tokens: deleted when you disconnect the account, remove Noolu in Instagram's settings, or delete your Noolu account.
- Sign-in and security data: verification and password-reset codes, sign-ups waiting for email confirmation, and sign-in attempt counts expire within an hour; records of signed-out sessions within about 7 days.
- Short-lived copies: data our systems hold briefly, such as queued messages, cached usernames, and usage counts, is deleted on its own, most of it within 7 days (monthly AI credit counts within about 35 days). A request for someone's email address waits up to 7 days for their reply and doesn't contain the address.
- Billing records: kept after account deletion for as long as tax and accounting rules require.
- Backups: we back up our database daily and delete each daily backup after about two weeks, so deleted data leaves them within about two weeks. Copies we take before server updates are kept until we delete them by hand.
- Server logs: records of requests to our servers, with the IP address and browser details they arrive with, and of the events we process, which can include a person's Instagram ID and account email addresses, but not the text of comments or messages, people's usernames, or the email addresses email gates collect. Our application logs are kept for 30 days; the logs of our server containers are capped in size and overwritten automatically, oldest first. Access tokens and keys are removed from our application logs.
- Outreach and referral records: see People We Contact About Noolu and Referral Program below.
We keep data longer than stated here only when a law requires it, for example to deal with a legal claim or a request from authorities, and only for that purpose.
9.People We Contact About Noolu
We sometimes email creators and businesses that list a contact email in their Instagram bio, which we find through public search-engine results, to tell them about Noolu. We keep their name, Instagram handle, email address, follower count, a short excerpt of their bio, their location, whether they're a creator or a business, where we found them, our notes on their niche and how well Noolu might suit them, and the emails we sent. Our emails contain a tracking pixel and tracked links: we store when and how often each email is opened and clicked, not your IP address or browser (though these requests also appear in our server logs), and we use this to decide whether to follow up. In the EEA and UK our legal basis is our legitimate interest in promoting our business. Every email has an unsubscribe link; if you unsubscribe, we stop emailing you and mark our records so we don't contact you again. We don't delete these records on a schedule: we keep them, including after you unsubscribe, until you ask us to delete them. To have your data deleted, email info@noolu.pro; we then keep only your email address and Instagram handle, on our do-not-contact list, so that we don't collect your details or contact you again.
10.Referral Program
If you join the referral program, we store your referral code and your commission and payout records, and we share your name, email, and payout amount with Tremendous to send gift cards. If we ask you for tax information (such as IRS Form W-9 or W-8BEN), we collect what the form contains, such as your legal name, address, and taxpayer identification number, and use it only for tax reporting. If you sign up through a referral link, we record who referred you. The referrer sees how many people signed up through their link, how many pay, and the commission on each payment, but not your name, email, or Instagram account. Referral records are kept while the referrer's account exists; payout records and tax information are kept for as long as tax law requires, even after the account is deleted. See the Referral Program Terms.
11.California Privacy Rights (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you rights regarding your personal information:
- Right to Know & Access: request the categories and specific pieces of personal information we hold about you.
- Right to Deletion: request deletion of your personal information.
- Right to Correction: update or correct inaccurate information, directly in your settings or by asking us.
- Selling and sharing: we don't sell personal information. Our use of Google Ads cookies may count as “sharing” for cross-context behavioral advertising under California law; you can opt out by choosing “Essential Only” in the cookie banner or by turning on Global Privacy Control in your browser (see Cookies to change an earlier choice).
- Sensitive information: we use sensitive personal information (such as your account password, or a taxpayer identification number on a tax form for the referral program) only to provide the service and, for tax forms, for tax reporting.
- Non-Discrimination: we won't discriminate against you for exercising your rights.
To make a request, email info@noolu.pro with the subject “California Privacy Request.” We verify requests by checking that they come from your account email. You can use an authorized agent.
12.Children's Privacy (COPPA)
Noolu is for professional creators, businesses, and adults aged 18 and older. It isn't directed to children, and we don't knowingly collect personal information from children under 13 (or under 16 in the European Union). If we learn that we have, we delete it.
Instagram users must be at least 13, so people who message our customers may include teenagers. We process their messages only on our customer's behalf. Parents or guardians can contact us at info@noolu.pro.
13.International Transfers & European Privacy Rights
If you access Noolu from the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on these legal bases:
- Performance of contract: to provide the features you use, manage your subscription, and run the referral program for its members.
- Consent: for analytics and advertising cookies and the referral cookie. You can withdraw it at any time with “Cookie settings” at the bottom of our website (see Cookies).
- Legitimate interests: keeping Noolu secure and preventing fraud and abuse (including sign-in protection, server logs, and backups), measuring how our website and app are used with Vercel Web Analytics, crediting referrers for the customers they referred, contacting creators and businesses about Noolu, and protecting our rights, such as enforcing our Terms or dealing with legal claims.
- Legal obligations: tax, accounting, and lawful requests from authorities.
For people who message or comment on our customers' accounts, the customer is responsible for the legal basis, and we process that data on their instructions.
You have the right to access, correct, delete, restrict, and port your data, and to withdraw consent at any time. Email info@noolu.pro. You can also complain to your local data protection authority. In the UK, you can complain to us first (we acknowledge complaints within 30 days) and then to the Information Commissioner's Office.
Your right to object: you can object at any time to processing based on our legitimate interests. We'll stop unless we have compelling grounds or need the data for a legal claim.
To create an account you need an email address, or Google or Instagram sign-in, and most features need a connected Instagram professional account. Without them we can't provide Noolu.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects, with one exception: if our payment processor warns that a payment is likely fraudulent, we refund it and cancel the subscription automatically. Contact us and a person will review it.
Noolu LLC is a US company. Our database and backend servers are in Finland (EU); our website and app are served by Vercel from the US and its global network. Some of our other service providers (see Who We Share Data With) also process data in the US, under the safeguards those providers offer, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
14.Users in India
You can access, correct, update, and erase your data, withdraw consent, and nominate someone to exercise your rights for you. For questions or grievances, contact our Grievance Officer: Sushmitha Vishwanath Rao, Noolu LLC, 825 E Evelyn Ave, Sunnyvale, CA 94086, USA, info@noolu.pro. We acknowledge grievances within 48 hours and resolve them within 30 days. If we don't resolve your grievance, you can complain to the Data Protection Board of India where the law gives you that right. For payments in INR, Dodo Payments is the merchant of record and also handles questions about those payments.
15.Data Security
We use technical and organizational safeguards, including:
- Noolu staff access customer data only to provide support, fix problems, or meet legal obligations
- Bcrypt password hashing with unique salts
- TLS 1.2 or higher for all data in transit
- Signing out ends that session; changing or resetting your password signs out your other devices
- Rate limiting and protection against password guessing
- Access tokens and keys removed from our application logs and stored error messages
If a data breach affects you, we'll notify you and the authorities as the law requires. If it affects data we process for a customer, we tell that customer without undue delay.
16.Self-Serve Data Deletion
You can delete your account at any time in your account settings; step-by-step instructions are on our Data Deletion page. We cancel any subscription first, then permanently delete everything in your account, including:
- Your profile, email, and sign-in credentials
- Connected Instagram accounts and their access tokens
- Automations, conversations (comments and messages, with notes and labels), saved replies, link clicks, and analytics
- Email addresses your automations collected
- Pages you've published, your bookmarks, and images you've uploaded
- Your Stripe customer record, including saved cards
- Referral earnings not yet paid out
We also stop Instagram sending us your account's comments and messages and, if your account has an email address, email you a confirmation. A few records remain:
- Billing records and referral payout records (kept for tax and accounting), and, if someone referred you, the commissions they earned on your payments, no longer linked to your account
- Copies in our backups: daily backups until they're deleted about two weeks later, and copies taken before server updates until we delete them by hand
- Entries in our server logs, for up to 30 days (application logs) or until they're overwritten (container logs)
- Short-lived copies in our systems, which are deleted on their own, most within 7 days (AI credit counts within about 35 days)
- Reactions you left on other people's pages, no longer linked to an account
- Emails between you and us
- Records that Stripe, Dodo Payments, and Tremendous keep under their own policies
17.Changes & Contact
If a new feature needs a new kind of personal data, a new purpose, or a new kind of recipient, we'll update this policy and tell account holders by email or with a notice in the app before the change takes effect, and where the law requires your consent, we'll ask for it first. We won't use data we already hold in a materially less protective way without your consent.
When we change this policy we update the date above, and for material changes we notify account holders by email or with a notice in the app. Contact: Noolu LLC, 825 E Evelyn Ave, Sunnyvale, CA 94086, USA, info@noolu.pro.