Privacy Policy

Last updated: 19th April 2026

This Privacy Policy describes how Agen Digital LLP ("BeCreator", "we", "us", or "our") collects, uses, and shares information when you use BeCreator at becreator.app and its related services. Please read it carefully.

1. Who We Are

BeCreator is operated by Agen Digital LLP, a limited liability partnership registered in India. BeCreator is an all-in-one platform for content creators: it provides a link-in-bio landing page, Instagram Auto DMs, appointment bookings, custom forms, and analytics — all accessible from a single creator profile at becreator.app/username.

Contact: [email protected]

2. Information We Collect

a) Account Information

When you sign up for BeCreator, our authentication provider (Clerk) collects and processes your: email address, name, and profile picture. If you sign up via Google OAuth, Clerk retrieves these fields from your Google account. If you sign up with email and password, you provide them directly.

b) Billing Information

Subscription payments are processed by Paddle, our Merchant of Record. BeCreator does not store your full credit card number, CVC, or bank account details. Paddle provides us with limited billing metadata (subscription status, last 4 digits, billing country) needed to manage your subscription.

c) Usage Information

When you use BeCreator, we automatically collect:

Device type, browser type, and operating system
IP address and approximate geographic location
Pages visited, features used, and actions taken within the platform
Date and time of access
Referring URLs

We use PostHog and related analytics services to understand usage patterns and improve the platform. These services may set cookies or similar tracking technologies.

d) Instagram / Meta Platform Data

This section describes in detail what data BeCreator collects from Meta's Instagram platform. We collect this data only when you (a creator) connect your Instagram Business account to BeCreator, or when your followers interact with your BeCreator-powered automations.

When a creator connects their Instagram Business account via OAuth, Meta grants BeCreator access using the following permissions:

instagram_business_basic — read profile information
instagram_business_manage_comments — read comments on your posts and reels
instagram_business_manage_messages — send and receive direct messages on your behalf

Data received and stored from the OAuth connection:

Long-lived access token (used to make API calls on your behalf; expires after 60 days and is refreshed)
Instagram user ID (app-scoped)
Instagram Business Account ID (fbid_v2)
Instagram username
Display name
Profile picture URL (also cached in BeCreator's file storage)
Follower count
Token expiry timestamp
Connection timestamp

Data received through Instagram Webhooks:

BeCreator subscribes to Instagram webhook events for comment activity and direct message activity on your connected account. Webhook payloads are verified using HMAC signature validation against the Meta app secret before processing. From these webhooks, we receive and selectively store:

From comment events: the commenter's Instagram user ID, username, comment text, media ID, and comment ID
From direct message events: the sender's Instagram user ID, message text, and story reply context (when the trigger is a story reply)

Raw webhook payloads are not stored as blobs. Only the specific fields listed above are extracted and stored.

Data stored from DM funnel interactions (end user data):

When a person interacts with a creator's automation (by commenting a keyword, replying to a story, or sending a DM), BeCreator stores the following data about that person (referred to as an "end user" or "DM recipient"):

Instagram profile information: Instagram user ID, username, name, and cached profile picture. Profile data is refreshed approximately every 30 days.
Conversation records: recipient's Instagram ID, recipient username, the comment or message text that triggered the automation, funnel state (whether the recipient follows the creator, email address if voluntarily provided), and scheduling metadata for follow-up messages.
Message history: message text and content for each inbound and outbound message in the conversation thread, message type (DM, comment, quick reply), direction (sent or received), and timestamps. System events (e.g., "conversation completed", "follow verified") are also logged.
Message delivery records: the recipient's Instagram ID, recipient username, message content, scheduled send time, delivery status, error details, and the Meta message ID returned after a successful send.
Collected email addresses: if an end user voluntarily provides their email address during a DM funnel sequence, we store their email address, Instagram ID, and username. This data is stored in BeCreator only and is not synced to any third-party CRM, email marketing platform, or advertising system.

e) Cookies and Tracking

We use cookies and similar technologies for authentication, session management, and usage analytics. For details, see our Cookie Policy.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain BeCreator and all its features
Process Instagram Auto DM automations — receiving webhook triggers, evaluating automation rules, sending direct messages on behalf of the creator, and managing funnel state
Process transactions, manage subscriptions, and handle billing
Send transactional emails — including booking confirmations and email verification messages
Analyze usage patterns to understand how creators use the platform and to improve features
Detect, investigate, and prevent fraud, abuse, and security incidents
Enforce our Terms of Service and comply with legal obligations

We do not sell your personal information.
We do not sell data received from Meta or Instagram.
We do not use Meta Platform Data for advertising, machine learning training, or any purpose unrelated to providing and improving the BeCreator service.

4. Instagram Auto DMs — How It Works

BeCreator's Auto DM feature lets creators automate direct messages on Instagram in response to specific audience actions. Here is exactly how it works:

Creator connects Instagram: A creator authenticates their Instagram Business account via Meta's OAuth flow. BeCreator stores a long-lived access token scoped to that account.
Creator configures a trigger: The creator defines rules — for example, "when someone comments the word GUIDE on this post, send them a DM." Supported trigger types include keyword comments on posts/reels, any comment (no keyword requirement), story replies, and inbound DMs matching a keyword.
Audience member triggers the automation: When a follower (or any Instagram user, depending on the creator's settings) comments the configured keyword, replies to a story, or sends a matching DM, Instagram delivers a webhook event to BeCreator.
BeCreator sends the automated DM: BeCreator processes the webhook, checks the creator's automation rules, and sends a direct message from the creator's Instagram account to the person who triggered it. Messages are sent via the Instagram Graph API (graph.instagram.com/v22.0/me/messages). All automated messaging operates within Meta's standard 24-hour messaging window for user-initiated conversations.
Optional funnel steps: Depending on the creator's configuration, the automation may include: a follow gate (checking whether the recipient follows the creator before sending the main message); an email capture step (asking the recipient for their email address); and follow-up messages scheduled after the initial DM.

Opt-Out ("STOP")

End users can stop receiving automated messages from a creator at any time. When a recipient sends "STOP" (or equivalent opt-out keywords) in the DM conversation, BeCreator:

Immediately marks the active conversation as deactivated for that recipient and creator pair
Cancels all pending scheduled messages (queued DM jobs) for that recipient from that creator
Records the opt-out so no future automations from that creator will trigger for that recipient

This opt-out is scoped per creator: opting out of one creator's automations does not affect automations from other creators. Creators can also manually deactivate their automations at any time from the BeCreator dashboard.

End users may also contact [email protected] to request deletion of all data BeCreator holds about them.

Commerce Boundary

All payment transactions occur on becreator.app or the creator's own external pages. BeCreator does not process payments or complete sales transactions inside Instagram Direct Messages. DMs may contain links directing users to web-based pages, but the DM itself is never the checkout or payment surface.

We do not sell personal information to third parties. We share data with the following service providers ("subprocessors") only to the extent necessary to operate BeCreator:

Convex — Database, serverless functions, file storage, and webhook processing. Data is stored and processed on US-based infrastructure.
Clerk — Authentication and identity management. Handles sign-in, session tokens, and (for Google OAuth users) retrieval of name, email, and profile picture from Google.
Paddle — Merchant of Record for subscription billing and payment processing.
Resend — Transactional email delivery (booking confirmations, email verification).
Vercel — Web application hosting and edge network.
PostHog — Product analytics, usage tracking, and feature adoption analysis.

Meta / Instagram: When you use BeCreator's Auto DM features, data flows between BeCreator and Meta's platform (via OAuth, Graph API, and webhooks). Meta Platform Data received through these integrations is governed by Meta's Platform Terms and Developer Policies. We use this data solely to operate the Auto DM and related features on your behalf. We do not share Meta Platform Data with any party other than those listed above.

We may also share data:

Legal requirements: When required by applicable law, court order, or lawful government request, or to protect the rights, property, or safety of BeCreator, our users, or the public.
Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
With your consent: In any other circumstance where you have explicitly authorized the sharing.

6. Data Retention

Account data (name, email, profile): retained while your account is active. Deleted after the 14-day grace period following your account deletion request.
Instagram connection data (access tokens, profile data, cached profile pictures): deleted when you disconnect your Instagram account from BeCreator or when you delete your BeCreator account.
Automation configuration (triggers, templates): retained while your account is active. Deleted on account deletion.
Conversation and message data (DM conversations, sent and received messages, message delivery records): retained while your account is active to support your inbox and analytics. Deleted when you disconnect Instagram or delete your account.
End user data (Instagram profile information and conversation records for DM recipients): retained while the associated creator account is active. Deleted when the creator disconnects Instagram or deletes their account. Also deleted upon a valid deletion request from the end user.
Collected email addresses: retained while the creator's account is active. Deleted on account deletion or upon request from the end user who provided the email.
Billing records: retained as required for legal and financial compliance obligations, even after account deletion.

7. Your Rights

For creators (BeCreator account holders)

Access: Request a copy of the personal data we hold about you.
Correction: Correct inaccurate or incomplete account information directly in your dashboard, or by contacting us.
Deletion: Request deletion of your BeCreator account at any time from account settings. After a 14-day grace period (during which you can cancel), all your data is permanently removed, including your Instagram connection, automations, conversations, and bookings.
Disconnect Instagram: Remove your Instagram connection at any time from the dashboard. This revokes BeCreator's access token, deletes the stored connection record, and removes associated automation data.
Portability: Request your data in a portable format by emailing [email protected].

For end users (people who received automated DMs)

Opt out of automated messages: Send "STOP" in the DM thread at any time. BeCreator will immediately stop all automated messaging from that creator to you and cancel any pending messages.
Request data deletion: Email [email protected] to request deletion of all data BeCreator holds about you (conversation records, message logs, collected email). We will respond within 30 days and process deletion of your records identified by Instagram user ID.

For EU and UK residents (GDPR / UK GDPR)

If you are located in the European Union or United Kingdom, you have the following rights under the GDPR and UK GDPR:

Right of access (Article 15)
Right to rectification (Article 16)
Right to erasure / "right to be forgotten" (Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object to processing (Article 21)

Legal bases we rely on:

Consent: When you connect your Instagram account and authorize BeCreator to manage messages on your behalf.
Contract: Processing necessary to fulfill our agreement with you as a BeCreator subscriber (operating your link-in-bio, automations, bookings, etc.).
Legitimate interests: Service operation, security, fraud prevention, and analytics — where these interests are not overridden by your data protection rights.

To exercise your GDPR rights, contact us at [email protected]. You also have the right to lodge a complaint with your local supervisory authority.

8. International Data Transfers

BeCreator is operated by Agen Digital LLP, based in India. Your data is stored and processed primarily in the United States through Convex and may also be processed by other subprocessors in various countries (see Section 5).

For users in the European Union or United Kingdom, transfers of personal data to countries without an adequacy decision (including the United States and India) are conducted under appropriate safeguards as required by applicable law, which may include Standard Contractual Clauses offered by our subprocessors. You may contact us at [email protected] for more information about the safeguards in place for your data.

By using BeCreator, you acknowledge that your data may be transferred to and processed in countries outside your country of residence.

9. Children's Privacy

BeCreator is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a child, we will take steps to delete it promptly. If you believe we have collected data from a child, please contact us at [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you by email or through a notice on the platform. Your continued use of BeCreator after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or data requests related to this Privacy Policy, please contact us:

Agen Digital LLP
Email: [email protected]
Website: becreator.app/contact