Privacy policy

Last updated 14 November 2026

Replymint helps Instagram creators and small businesses answer comments on their posts. It drafts short replies from the facts a creator approves, and posts them only when the creator approves them or has turned on automatic replies for that kind of comment.

Replymint is operated by Hamalabs LLC (“we”, “us”). This policy explains what we process, why, who helps us, how long we keep it and how to have it deleted. Questions: privacy@replymint.ai.

Who decides what

For the people who sign in to Replymint (creators and their team members), we decide how their account data is used. For the people who comment on a creator’s posts, the creator decides to use Replymint, and we process those comments on the creator’s behalf and only to provide the service.

What we process

• Sign-in and workspace data: your email address, your name if you give it, the workspaces and the agency you belong to and your role in each, and your sign-in sessions (with the IP address and browser they came from).
• Your password, stored only as a salted hash. We never keep the password itself and can’t read it back. When you choose one, we check it against Have I Been Pwned’s list of passwords found in data breaches: only the first five characters of a one-way hash of it leave our server, so the service never learns the password. If the check can’t be made, the password is accepted.
• Trusted browsers: after you enter an emailed code, we can remember that browser for 30 days with a cookie, so it won’t ask for a code each time. The cookie holds a random value; we keep only a hash of it, with when it was created and last used. Changing or resetting your password forgets every trusted browser. We also count wrong passwords for an account (for 15 minutes) and wrong sign-up codes (for a day), keyed by a one-way hash of the address rather than the address itself. Emailed codes, and the links we email to choose a password, are stored only as a hash made with a key kept outside our database.
• Replymint staff only: the key of the authenticator app they use to open our console, stored encrypted with a key kept outside our database, one-time backup codes stored only as hashes, and a hash of the sign-in session each check was made in.
• Instagram account data, with the creator’s permission through Meta: the account’s ID and username, an access token (stored encrypted, with keys kept outside our database), and the posts the creator enables: captions, and the photos and videos needed to understand them.
• Comments on enabled posts: the comment text, the commenter’s Instagram ID and username, and the replies Replymint drafts or publishes.
• Facts the creator adds, such as prices, sizes or shipping details, and what can be read or heard in their photos and videos.
• A store’s own website, when its owner or editor adds the address: its public pages, such as products, prices, and pages about shipping and returns. Our reader (ReplymintBot) follows the site’s robots.txt and never signs in. What it finds is shown to the store’s team, who choose what to add; nothing from it is used in replies until they do.
• Where a seller is paid, when its owner sets it: a PayPal email address or a Venmo mobile number, or the ID of the Stripe account Stripe opens for the seller (bank details and identity checks stay with Stripe). Shown masked to the store’s team and to our staff. And the access keys of a Shopify or WooCommerce store the owner connects, kept encrypted and never shown again.
• Payments, payouts and refunds: amounts, dates, states and the payment companies’ reference numbers for each order, so that every sale is paid out once and every refund made once.
• Operational records: an activity history of actions in each workspace, usage counts, and service logs. Logs never contain access tokens or full comment text.

We do not sell personal data, use it for advertising, or use comments to train AI models.

Agencies

An agency can use Replymint to manage replies for its clients. The agency creates a workspace for each client, and the people on the agency’s team can work in those workspaces. If an agency manages your account, it decides who on its team has access; ask it to make you an owner of your workspace if you want to control that yourself. If you have your own workspace, you can let an agency’s team in with the agency’s access code, as editors or viewers, and end that access whenever you like. An owner can remove anyone from a workspace at any time.

Buying from a store that uses Replymint

Some creators sell from their Instagram posts with Replymint. If you agree to buy something, the seller sends you a link to a private order page. There you give your name, your email address and, when the item is shipped, a delivery address. The seller and the people in their workspace see these details to fulfil your order, and we use your email address only to tell you about that order: details received, payment confirmed, shipped, delivered, cancelled or refunded. You pay on a payment page run by Stripe or PayPal for Replymint, which holds the payment and pays the seller their share once the order is done; if the order is cancelled before then, or you are charged twice, Replymint refunds you. Some sellers instead have you pay on their own Shopify or WooCommerce store, where the seller takes the payment directly. We never see your card: the payment company tells us that the order was paid and, if you did not give us an email address, the one you paid with, which we use the same way. We clear your name, email and address from the order 180 days after it is delivered or cancelled. The seller is responsible for the item and the delivery. If you comment a price on a seller’s post, the seller’s store may answer you in an Instagram direct message; what you write back in that conversation is kept so the seller can read it, is not sent to an AI model, and is cleared 30 days after the conversation ends. Messages you send that seller outside such a conversation are not kept by us.

Address suggestions. When you type the street on your order page, Replymint’s server asks Google Maps for matching addresses, so you can choose yours instead of typing it all. Google receives what you type in the street field, the country you chose, your browser’s language, a random code that links one search together and, when you choose an address, which one. The requests come from our server, so Google doesn’t see your IP address, and they never include your name, your email address or anything else about your order. The address you choose is kept like one you typed.

Delivery tracking. When a seller ships your order with a tracking number, Replymint can follow the package with EasyPost, so your order page shows where it is and we can email you when the carrier delivers it. EasyPost receives the tracking number and the carrier’s name, never your name, your email address or your address. We keep only what the carrier says about the package’s progress and its delivery dates, not the places it passed through or who signed for it.

How AI is used

To draft a reply, Replymint sends the comment, the post’s caption and the creator’s approved facts to a language model. Before that, we remove details such as email addresses and phone numbers from the comment where we can. The model never receives access tokens or credentials and cannot publish anything: our own rules check every draft, and anything uncertain goes to the creator for review. To understand photos and videos, we send images and audio to the image and speech services listed below.

Who helps us

• Render hosts the application and its database in Frankfurt, Germany.
• Alibaba Cloud Model Studio runs the language model (Qwen), in its International region, which keeps processing outside mainland China.
• Groq turns speech in videos into text.
• Mistral AI describes what photos and video frames show.
• Bird sends our emails (sign-in codes, invitations and account notices) and, for people who link a phone to run their store, the text and WhatsApp messages to and from that phone.
• Stripe and PayPal take buyers’ payments for Replymint and pay sellers out (Stripe to a seller’s bank or debit card, PayPal to their PayPal or Venmo account). They, not we, hold card and bank details; Stripe verifies the identity of sellers it pays.
• Shopify and WooCommerce stores that a seller connects: we create the order for the agreed price there and read whether it was paid, with access keys the seller gives us, kept encrypted.
• Google (Places API) suggests addresses while a buyer types their delivery address. It receives what is typed in the street field and the country, from our server; never the buyer’s name, email or IP address.
• EasyPost follows packages that sellers ship with a tracking number, so the buyer and the seller see where an order is and when it was delivered. It receives the tracking number and the carrier; never the buyer’s name, email or address.
• Meta provides the Instagram data the creator authorizes, and receives the replies we publish.

These providers may process data outside your country. We use them only for the purposes above.

How long we keep it

• Comment text and the evidence behind drafts: 90 days while the account stays connected.
• Photos and videos downloaded for analysis: deleted within 24 hours of analysis, and within 7 days if an import fails.
• Service logs: 30 days.
• Messages in a store’s conversation with a buyer: 30 days after the conversation ends.
• A phone number a member links to run their store: until they remove it. What their texts to us, and our replies, said: 30 days.
• What we found on a store’s website: until the site is read again or its address is removed. Products and answers the store added from it stay until the store removes them.
• Where a seller is paid (a PayPal email address or a Venmo number; bank details stay with Stripe) and the access keys of a connected Shopify or WooCommerce store: until the seller removes them or the workspace is deleted. Records of payments, payouts and refunds: as long as the law requires us to keep financial records.
• What the carrier says about an order’s package (its progress and delivery dates): as long as the order is kept.
• Emailed codes expire after 10 minutes, and links to choose a password after 30 minutes or once used; sessions after 14 days, or when you sign out. A trusted browser is remembered for 30 days at most. Records of wrong passwords and wrong codes are deleted after two days.
• When a creator disconnects an account, or removes Replymint in Instagram’s settings, we delete its content within 7 days, and backups that contain it expire within 30 days.

Our staff may keep short notes on the decisions they make about payments, refunds and payouts, such as why a payout was held or a buyer refunded. The notes are kept with those records, for as long as they are.

Deleting your data

• Creators can disconnect an account in Replymint’s Settings at any time, or remove Replymint in Instagram’s settings. Instagram then asks us to delete the data and gives you a link, with a confirmation code, to a page that shows the deletion’s progress.
• Anyone else, including people who commented on a creator’s post, can write to privacy@replymint.ai to ask what we hold about them, to correct it or to delete it. We answer within 30 days.

Security

Access tokens are encrypted with keys kept outside our database, and only the parts of the system that talk to Instagram can use them. Each workspace’s data is separated at the database level, and you reach Replymint over HTTPS only. Our staff operate the service from an internal console that shows account details, plans and usage counts. It cannot show comment or reply text, and every change made there is recorded.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and complain to your data protection authority. Write to privacy@replymint.ai.

Children

Replymint is a service for businesses and creators, not for children. Accounts are for people aged 18 and over.

Changes

When this policy changes, we update the date at the top. We tell users about important changes by email before they apply.