Gramdesk is operated by BA Solutions, LLC, Tacoma, Washington, United States ("we", "us"). This policy covers our website at gramdesk.io, the console at console.gramdesk.io and the API behind it at be.gramdesk.io (together, the "Service").
Gramdesk lets a business or a creator (a "Customer") connect its professional Instagram account and work on it with a team: answer Direct messages and comments, publish and schedule posts, read statistics, keep contacts, and use AI to draft or send replies.
We have not appointed a data protection officer, and no representative in the EU or the UK has been appointed. You can reach us about anything in this policy at support@gramdesk.io; people in the EU, the UK and Switzerland can contact us directly at the same address.
We handle the data of four groups of people, and our role differs for each.
| Who | Our role | What we hold |
|---|---|---|
| Customers and their team members | Controller | Account, workspace, team, billing and usage data (§ 3). |
| Team members whose replies the Customer has rated | Processor, for the Customer | The AI ratings of their replies, with an explanation and a suggested reply (§ 3). |
| End users — people who write to or comment on a Customer's Instagram account | Processor, for the Customer | Their Instagram username and ID, profile picture link, the messages and comments they exchange with the Customer, and any contact details the Customer records about them. |
| Website visitors | Controller | Analytics, only with consent; technical data (§ 3). |
The Customer decides to connect its Instagram account and what to do with its conversations, so the Customer is the controller of its End users' data and we process it on the Customer's behalf, under our Data Processing Addendum. If you wrote to a business on Instagram and want to know what it does with your messages, ask that business first; we will help it answer, and we will pass on any request you send us.
When a Customer uses the quality analytics that rate its team members' replies, we do that on the Customer's behalf too.
Meta Platforms, which runs Instagram, is the source of the Instagram data: it sends it to us when a Customer connects an account. Meta is not our service provider, and what Meta does with data is governed by Meta's own policies.
Customers and team members
- Account. Your name, email address, phone number if you add one, interface language, and how you sign in.
- Sign-in. You sign in with an email address and password or with your Google account. Sign-in is handled by Google Firebase Authentication, which holds your email address, name, password (stored hashed by Google) or Google identity. We never see or store your password.
- Phone number. Paying for a plan requires a phone number confirmed with a one-time SMS code. The code is kept for three minutes.
- Workspaces and teams. Workspace name, time zone and plan; who belongs to it and each member's role; invitations (the invited email address, the role, who sent it, and its expiry after 7 days — the invitation link's secret is stored only as a hash).
- Work in the console. Posts you create or schedule, files you upload for them, replies you send, internal notes on conversations, contacts and their pipeline stage, and an activity log of who did what in the workspace.
- Quality analytics. If the workspace uses it, an AI rating of each reply a team member sends (tone, accuracy, politeness, helpfulness), with a short explanation and a suggested better reply.
- Billing. Your plan, billing period, subscription status, invoices, payments and AI-credit balance. When you add a card, the card number and expiry date pass through our servers to Atmos and are not stored by us; we keep the card token Atmos returns (encrypted) and the masked card number.
- Messages we send you. Emails: team invitations, email verification and password reset. SMS: confirmation codes and notices that a trial is ending, a payment failed or a subscription was suspended. We send no marketing email or SMS.
- Technical data. Our servers log requests to the API, which can include IP addresses; errors are reported to Sentry (§ 7).
Instagram data
When a Customer connects an account through Instagram's own login ("Instagram API with Instagram Login"), Instagram asks the Customer to allow Gramdesk to read the profile, manage messages and comments, publish content and read insights. We never receive the Instagram password. We then receive and keep:
- the account's ID, username, name, profile picture link and follower count, and an access token;
- Direct-message conversations: each participant's username, Instagram ID and profile picture link, and the messages, with links to any media in them (the media stay on Instagram's servers);
- comments on the account's posts, with each author's username and ID, and the replies;
- the account's posts, captions, links and engagement figures;
- account and post statistics (insights) and daily follower counts.
We use data received from Instagram ("Platform Data") only to provide the Service to the Customer who connected the account, as Meta's Platform Terms allow. We do not sell it, use it for advertising, build profiles of people from it, or use it for surveillance, and we do not combine it across Customers.
Website visitors
Our website loads Google Analytics and Yandex Metrica only after you choose Accept in the banner. They then record the pages you view, where you came from, your browser and device, the links you click, and your IP address, from which they work out an approximate location. Yandex Metrica's session recording (Webvisor) is switched off. If you accept, the website also lets Sentry record some sessions, with all text, input and images masked in your browser, to help us fix problems; without your consent the website records no session. The website and the console report errors to Sentry, without your identity, and load fonts from Google Fonts. The console records no sessions; when an error happens, it sends Sentry a recording of the moments before it, masked in the same way. The Cookie Notice lists every item stored in your browser.
Gramdesk offers AI features: suggested or automatic replies to Direct messages and comments, sorting messages by intent and sentiment, tagging contacts, finding frequent questions, content plans and account analysis, and the quality analytics in § 3.
- What is sent. Only the text a feature needs: the message and recent conversation history, a comment, a post caption, the Customer's own instructions and knowledge base, account statistics, or a team member's reply. No images are sent to an AI model.
- Who processes it. We choose the AI providers and models; Customers do not. Today the provider is Google LLC (Gemini API). We may also enable OpenAI, L.L.C. or Anthropic, PBC, and will list the change on the Subprocessors page first. All three are in the United States; we use them through their paid APIs, under terms that do not allow them to train their models on the data we send.
- What is kept. We keep the drafts, replies and labels the features produce with the conversation they belong to. Our own log of AI requests records the task, the provider, the model and the number of tokens — not the text.
- Who decides. AI replies to Direct messages can be off, waiting for a person to approve them, or sent automatically; automatic comment replies need two switches turned on by the Customer. A message the AI is not confident about is passed to a person instead of being answered.
None of this makes a decision about anyone that has legal or similarly significant effects. AI output can be wrong; the Customer is responsible for what it sends (see the Terms).
We use personal data only for the purposes below. Where the GDPR, the UK GDPR or the Swiss FADP applies, each rests on the legal basis shown.
| Purpose | What it covers | Legal basis |
|---|---|---|
| Account and Service | Creating and running your account, workspaces and team; signing you in; connecting Instagram; the features you use | Performance of our contract with you (Art. 6(1)(b)) |
| Billing | Charging for plans and AI credits, renewals, retries, invoices | Performance of our contract (Art. 6(1)(b)) |
| Account messages | Email verification, password reset, invitations, SMS codes and billing notices | Performance of our contract (Art. 6(1)(b)); for an invitation to someone without an account, legitimate interests in letting a Customer add the people it chooses (Art. 6(1)(f)) |
| End users' data and AI on it | Processing messages, comments and profiles for the Customer | On the Customer's documented instructions (Art. 28); the Customer, as controller, determines the legal basis |
| Security | Preventing abuse, limits on repeated requests, encryption of tokens | Legitimate interests in keeping the Service and its users safe (Art. 6(1)(f)) |
| Operations | Server logs, error monitoring, and in the console a masked recording of the moments before an error (Sentry); fonts | Legitimate interests in delivering the Service and diagnosing and fixing errors (Art. 6(1)(f)) |
| Website analytics | Google Analytics, Yandex Metrica and masked Sentry session recordings on gramdesk.io | Your consent, given in the banner and withdrawable at any time under Cookie settings (Art. 6(1)(a)) |
| Records | Tax and accounting records | Legal obligation where the law requires it (Art. 6(1)(c)); otherwise legitimate interests in complying with the laws that apply to us (Art. 6(1)(f)) |
You can ask us for the balancing test behind any purpose based on legitimate interests and object to it (§ 9). An email address and a way to sign in are required to create an account, and a confirmed phone number is required to pay; without them we cannot provide the Service. We do not use personal data for advertising.
| Data | Kept for | Then |
|---|---|---|
| Account, workspace and team data | until the account is deleted | deleted; database backups roll off within 7 days |
| Instagram data of a connected account | until the Customer disconnects it in the console or Meta forwards a deletion request; removing Gramdesk in Instagram deletes the access tokens at once and stops syncing | deleted in that workspace on disconnect, in every workspace on a deletion request (see Data Deletion) |
| Contacts (CRM leads) you delete in the console | 30 days in a deleted state | erased by a daily job |
| Files uploaded for posts | until the post's Instagram account is disconnected, a deletion request for that account arrives through Instagram, or the account is deleted | deleted |
| Invoices and payment records | as long as tax and accounting law requires | after the account is deleted, kept with amounts, dates and numbers only, no longer linked to you |
| Server and database logs | 30 days | deleted automatically |
| Database backups | 7 days | overwritten automatically |
| SMS confirmation codes | 3 minutes | expire |
| Invitations | valid for 7 days; the record stays with the workspace | deleted with the workspace |
| Error reports and recordings (Sentry) | the retention period of our Sentry plan | deleted by Sentry |
| Website analytics (Google Analytics, Yandex Metrica) | the retention settings of each service | deleted by the provider |
| Record of a deletion request | at least 30 days after the deletion, without any personal data | kept so the status page keeps answering |
We use the providers below to run Gramdesk. Each receives only what the table shows. The Subprocessors page carries the same list and is where we announce changes.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting: servers, database, file storage, cache, logs, content delivery | All Service data | Sweden (Stockholm); content delivery from edge locations worldwide |
| Google LLC — Firebase Authentication | Sign-in | Email address, name, password (stored hashed by Google), Google account identity | United States |
| Google LLC — Gemini API | AI features and text search (embeddings), via the paid API — the AI provider in use today | The text of messages, comments, captions and other content an AI feature works on (§ 4 of the Privacy Policy); no images | United States |
| OpenAI, L.L.C. | AI features (via API) — used only when we enable it; not in use today | When enabled: the text of messages, comments, captions and other content an AI feature works on (§ 4 of the Privacy Policy); no images | United States |
| Anthropic, PBC | AI features (via API) — used only when we enable it; not in use today | When enabled: the same kind of text as Google Gemini; no images | United States |
| Functional Software, Inc. (Sentry) | Error monitoring and session replays of errors | Error reports and performance traces, without the identity of the user; in the console, a recording of the moments before an error; on the website, session recordings only with the visitor's consent; all text, input and images masked in the browser | European Union (Germany) |
| Resend | Transactional email | Recipient address and the email's content: team invitations (inviter and workspace name), email verification and password-reset links | United States |
| Eskiz (eskiz.uz) | SMS | Phone number and the SMS text: confirmation codes, and notices about a trial ending, a failed payment or a suspended subscription | Uzbekistan |
| Atmos (atmos.uz) | Card payments in UZS | Card number and expiry date when you add a card (passed through our servers, not stored by us); the amount and invoice number of each charge | Uzbekistan |
| Telegram FZ-LLC | Optional: AI escalation notices to a Telegram chat the customer sets up | Workspace name, the sender's Instagram username, the message and up to three previous messages — only if the customer enables it | United Arab Emirates |
| Google LLC — Google Analytics | Website analytics, only with your consent | Pages viewed, referrer, browser and device, IP address (from which Google derives an approximate location), a cookie identifier | United States |
| YANDEX LLC — Yandex Metrica | Website analytics, only with your consent (session recording off) | Pages viewed, clicks and links followed, referrer, browser and device, IP address, a cookie identifier | Russia |
| Google LLC — Google Fonts | Fonts on the website and in the console | IP address and browser information, when the font files are requested | United States |
Atmos, which processes card payments, and the banks behind it also act as independent controllers for the payment data under their own rules. When a reply is sent from Gramdesk it is delivered by Instagram, under Meta's terms.
Apart from these providers, and the members of your own workspace, who see what the workspace holds, we disclose personal data only where the law requires it, for example in response to a valid legal order, or where we believe in good faith it is necessary to protect someone from serious harm. If our business or its assets are transferred, the data may pass to the new owner, bound by this policy.
The Service's database, file storage, cache and logs are hosted by Amazon Web Services in Stockholm, Sweden. Pages and files are delivered through AWS's content network from locations worldwide. Sentry receives error reports in Germany. We are a company in the United States, and our staff and contractors may access data from outside the European Economic Area, the UK and Switzerland. Where the GDPR, the UK GDPR or Swiss law requires a basis for a transfer, it is:
- Amazon Web Services, Google, Sentry, Resend, OpenAI and Anthropic, and transfers to us: the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum and the amendments Swiss law requires, or the EU-US Data Privacy Framework where the provider is certified under it;
- Eskiz and Atmos (Uzbekistan): the transfer is necessary to perform our contract with you — to send you an SMS you need, or to take a payment you make (Art. 49(1)(b));
- Telegram (United Arab Emirates): only if the Customer connects a Telegram chat for escalations. The transfer is made at the Customer's direction, to a chat the Customer controls, and is the Customer's own transfer under its responsibility: the Customer needs its own basis for it, such as consent (Art. 49(1)(a));
- Yandex Metrica (Russia): your explicit consent in the banner (Art. 49(1)(a)). Russia is not recognised by the EU as protecting personal data adequately, and no safeguard such as the Standard Contractual Clauses covers this transfer; Russian authorities may be able to access the data without the protections EU law requires. If you do not accept, nothing is sent to Yandex.
You can ask for a copy of the safeguards that apply at support@gramdesk.io.
Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a portable format, to object to processing based on legitimate interests, to restrict processing, and to withdraw consent at any time without affecting what was done before.
How to use them
- In the console. In Settings you can correct your name and language, disconnect an Instagram account, and delete your account. The Data Deletion page explains what each removes.
- By email. Everything else — including a copy of your data — goes to support@gramdesk.io. We answer within 30 days. A copy of your data is sent as a machine-readable JSON file. We may ask you to write from the address on your account, or otherwise confirm it is you, before acting.
- End users. If your data reached us through a business's Instagram account, we process it for that business; we will forward your request to it and help it answer.
You may complain to a data protection supervisory authority, in particular in the country where you live or work, or where you believe the law was breached. We would appreciate the chance to resolve your concern first.
This section adds what the privacy laws of California and other US states ask us to say. Where it applies to you, it applies together with the rest of this policy.
| Category | What it covers here |
|---|---|
| Identifiers | Name, email address, phone number, account and Instagram IDs, IP address in logs |
| Customer records | Account, workspace and invitation data |
| Commercial information | Plan, subscription, invoices and payments |
| Internet or network activity | Use of the Service, server logs, website analytics with consent |
| Approximate location | Derived from an IP address by Google Analytics or Yandex Metrica, with consent |
| Sensitive personal information | Your sign-in email and password, held by Google Firebase |
We collect this from you, from your team when they invite you, from your browser, from Google when you sign in with it, from Instagram when you connect an account, and from Atmos for payments. We use it for the purposes in § 5, keep it for the periods in § 6, and disclose it for those purposes only to the providers in § 7, within a workspace to its members, and where the law requires.
We do not sell or share personal information, as those words are defined in the California Consumer Privacy Act, and have not done so in the past twelve months. We do not use personal information for targeted advertising, and we do not profile anyone in furtherance of decisions that produce legal or similarly significant effects. We use sensitive personal information only to sign you in, and never to infer characteristics about you. Because there is no sale or sharing, there is nothing for an opt-out or a Global Privacy Control signal to switch off; if your browser sends one, we treat it as an opt-out request all the same.
You may ask to know, access, correct or delete your personal information, and to receive it in a portable format, as § 9 describes. We will not treat you differently for using these rights. An authorised agent may make a request for you with your signed permission; we may ask you to confirm it. If we decline a request, you can appeal by replying to our answer or by writing to support@gramdesk.io with "Appeal" in the subject line, and we will answer the appeal in writing within the time your state's law allows.
For users in Uzbekistan, this policy is our notice under Law No. ZRU-547 "On Personal Data". By registering, you consent to the processing it describes. You have the right to know what data we hold and how we use it, to have it corrected, to withdraw your consent and to have it deleted, by writing to support@gramdesk.io or as § 9 describes, and to complain to the authorised state body for personal data.
Your data is not stored in Uzbekistan: it is stored in Sweden and processed by the providers and in the countries listed in § 7 and § 8, including the United States. The law of Uzbekistan contains rules on where the personal data of its citizens is stored and on registering personal-data databases; we are reviewing how they apply to the Service, and this section will be updated with the result.
All connections to the Service use TLS. The database and file storage are encrypted at rest. Instagram access tokens and card tokens are encrypted in the database with Fernet (AES-128 in CBC mode with an HMAC-SHA256 signature). Invitation secrets are stored only as hashes. The database is not reachable from the internet. Access tokens and full phone numbers are not written to our logs, and error reports are configured not to carry personal data by default. Inside a workspace, roles limit what each member can do, and the activity log records who did what.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
Gramdesk is not for children. You must be at least 16 to use it, and the person who accepts the Terms for a business must be at least 18. We do not knowingly collect data from anyone under 16 for our own purposes; if we learn we have, we delete it. A Customer's End users may include minors; the Customer is responsible for how it treats their messages.
We may change this policy. If a change is material, we will tell Customers by email or in the console at least 30 days before it takes effect. Every version is dated, and the change log records what changed.
BA Solutions, LLC, Tacoma, Washington, United States. Email: support@gramdesk.io.