What Data Does Viralyze Collect and Why?
Viralyze collects only what it needs to do the job you set it: comment and story-reply events so keywords can match, DM threads so replies land in your Inbox, and the lead details generated by your links, lead magnets, bookings and checkouts. All of this comes through the official Instagram (Meta) API after you log in on Meta's screen. Your password is never seen, nothing is posted to your feed, and personal data is not sold. Under India's DPDP Act, you are the data fiduciary for your audience's data and the app is the processor.
Here is the breakdown by category, with the reason each piece exists.
What does it read from Instagram?
Through the API, with your permission, the app receives:
- Comments on the posts you attach automations to (or all posts, if you choose any-post), so the keyword can be matched.
- Story replies, when a story trigger is set.
- DM threads that started from an Auto-DM, so you can reply from the Inbox within the 24-hour window.
- Basic profile information and follower counts, for the home screen analytics.
It does not read private DMs that did not originate from an automation, and it cannot post, like, follow or comment on your behalf beyond the public reply you configured.
Why does it store my audience's details?
Because that is the product: turning comments into contacts. When someone comments a keyword, their handle and the originating comment are stored so the DM can be sent and the conversation kept with context. When they download a lead magnet, their email is stored because you asked for it. When they book or buy, their name, contact details and the order are stored so you can deliver and so refunds can be processed.
Every contact carries a source tag (which automation, link or booking produced it) and you can export the whole list to CSV any time. That export is yours; the people in it are your audience, not Viralyze's.
Who owns the data under the DPDP Act?
You do, in the sense that matters legally. Under the Digital Personal Data Protection Act, the creator is the data fiduciary for audience data and Viralyze is the data processor acting on your instructions. In practice that means you decide what to collect (for instance, whether a lead magnet asks for email), you can export or delete it, and Viralyze handles it only to provide the service.
Consider an astrologer who collects emails through a free "KUNDLI" lead magnet. Those emails sit in her contacts list; she can export them for her newsletter or delete them. They are not used for anything else.
What does Viralyze never do?
- Never asks for or stores your Instagram password; login happens on Meta's screen.
- Never posts to your feed or stories.
- Never sells personal data to anyone.
- Never follows or unfollows accounts for you.
- Has no affiliation with Instagram, Meta or Google, and does not share your audience with them beyond what the API itself involves.
What about payment and calendar data?
Payments run through an RBI-authorised payment aggregator; card and UPI details are handled by that aggregator, not stored by the app. The app keeps the order record (what was bought, amount, status) so you can see revenue and process refunds.
Google Calendar access is used to read busy events on the calendars you tick and to write bookings to the calendar you choose. The app does not read event contents on calendars you have not ticked.
Frequently asked questions
**Can I see exactly which permissions I granted?** Yes. Meta's screen lists them at login, and they appear under connected apps in your Instagram settings, where you can revoke them.
**If I revoke access, is my contacts list deleted?** No. Revoking stops new data from flowing; your existing contacts stay until you delete them or your account.
**Does the WhatsApp reminder share my client's number with anyone?** Only with the messaging provider needed to deliver the reminder, for that purpose alone.
Start the 7-day free trial of Viralyze, no card needed, and see every permission on Meta's login screen before you grant it.