Privacy Policy

Zidos Direct · effective 5 November 2026

Who we are

Zidos Direct (direct.zidos.app) is operated by SERGEI IVANOV PR BEOGRAD, Resavska 33, 11000 Belgrade, Serbia (tax ID / PIB 115904971), the data controller. Contact: hello@zidos.dev.

What the service does

Business owners connect their Instagram professional account (Instagram API with Instagram Login) or their YouTube channel (Google sign-in) and set rules. When someone comments with a chosen word, the service replies under the comment and, on Instagram only and only if the owner enabled it, sends one private message to that person.

Data we process

• From the account owner: Instagram account ID and username, or YouTube channel ID and title; the OAuth access or refresh token (stored encrypted); the rules and reply texts the owner writes.
• About people who comment or message the connected account: comment and message IDs, their public username, the comment text, the direct messages they write to the connected account even when they have not commented, replies the owner sends from the Instagram app, the type of an attachment without the file or its URL, Instagram-scoped or YouTube channel IDs, delivery status and timestamps, and clicks on tracked links sent by the owner. The bot saves email, phone, and other answers sent by a person in response to a question, to transfer them to the account owner; they are deleted by the same paths.
• Files the owner uploads to hand out in direct messages (PDF and images): kept until the owner deletes them, deletes the account or disconnects through Meta; anyone who has the file's unguessable link can open it.
• If the account owner sets a webhook address, data about a contact (an answer the person gave, a link click, tags) is sent to that address, which the owner chose and controls; we do not control what happens to it there.
• If the account owner connects Google Sheets, each answer a person gives in a data-collection step (the date, their public username, the field, the answer and the rule name) is added as a row to a spreadsheet that Zidos Direct creates in the owner's own Google Drive; the owner controls that spreadsheet, and disconnecting stops new rows. Flow steps the owner adds can also put a row on a tab of that spreadsheet, find a row by a column value and copy listed cells into the person's contact fields, or overwrite listed cells of a found row.
• If the account owner switches on AI replies, the text of an incoming direct message and the owner's knowledge base and example replies are sent to Anthropic to generate the reply, and Anthropic's answer is sent back as a message. The same applies to a description the owner types to have a rule drafted. The knowledge base is kept until the owner changes it or deletes the account.
• From the account owner about their team: the name and role of each person they invite. These are kept until the person is removed or the last connected account is deleted.
• We do not collect passwords, do not scrape pages, and do not follow, like or post on anyone's behalf beyond the replies and messages the owner configured.

How we use it

Only to match comments to the owner's rules, post the configured replies, send the configured message, avoid duplicate replies, respect platform rate limits and quotas, show the owner statistics about their own rules, show the owner their own Inbox and Contacts (who commented, what they wrote, what was sent and what they replied — only to the owner of that account), and handle opt-out and deletion requests. We do not sell data, use it for advertising, or use it to train AI models.

Google user data (YouTube and Google Sheets)

With the scope youtube.force-ssl the service reads new comment threads on the connected channel's videos and posts replies to them under rules the channel owner enabled. With the scope drive.file the service can open only the spreadsheet it created for the account owner, and uses it only for what the owner set up: adding rows of collected answers, listing its tabs and header rows, adding a tab, and, in flow steps the owner added, finding a row by a column value and reading or overwriting the cells those steps list; it cannot see any other file in the owner's Drive. Zidos Direct's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not transferred to third parties, not used for advertising, and not read by humans except with the owner's consent, for security or abuse investigation, or as required by law.

Meta platform data (Instagram)

Instagram data is processed through Meta's official APIs under the Meta Platform Terms, only for the purposes above.

Retention

• Comment, message and delivery records, including direct messages written without a comment, replies the owner sends from Instagram, and attachment types without the files: 30 days, removed by STOP, DELETE, account deletion and disconnect.
• Tracked link records: up to 365 days, so links in sent messages keep working.
• Deletion confirmations: 90 days. Keyed hashes that prevent re-contacting people who opted out, or whom the account owner paused permanently, are kept while the account is connected.
• Account tokens, rules and quick replies: until the owner disconnects or asks for deletion.

Tags and notes the owner keeps about a contact, and the text of replies the owner writes manually from the inbox or sends from the Instagram app, are stored under the same retention periods and are deleted by the same paths as the conversation they belong to.

Your choices and deletion

• People who receive a message can reply STOP to stop automated messages or DELETE to delete data linked to the conversation.
• Account owners can delete an account in the cabinet (Account, Delete account): everything stored for it is removed at once and its Google access is revoked at Google. A paid subscription is cancelled first under Plan.
• Account owners can disconnect Instagram in Instagram settings (Apps and websites) or revoke Zidos Direct at myaccount.google.com/permissions; Meta's data deletion callback removes the account and all its data.
• Anyone can request access, correction or deletion at hello@zidos.dev.

Processors and location

Data is stored on servers operated by the controller in Serbia. Traffic passes through Cloudflare (network and TLS). Data is sent to Meta and Google only to read comments and deliver replies through their official APIs and, when the owner connects Google Sheets, to add, find and update rows in the owner's spreadsheet, and to Anthropic only when the account owner has switched on AI replies or asks for a rule to be drafted.

Security

Webhook signatures are verified, tokens are encrypted at rest, raw webhook storage is off by default, and access is limited to the operator.

Changes

We will post changes on this page with a new effective date.