Data
deletion.

1. What the app stores

If you are an affiliate

• Your Instagram username and account IDs
• Your email address
• An access token that lets the app read the comments on your posts and send messages from your Instagram account, stored encrypted
• The keyword that triggers a reply, and the text of the message it sends
• Which version of the Partner Tools agreement you accepted

If you commented on an affiliate’s post

• Your Instagram username
• Your Instagram-scoped ID: the number Instagram gives the app for your account
• The text of your comment
• The message the app sent you, and Instagram’s receipt for it
• The times of your comment and of the reply

Information about the people who comment is used only to send that affiliate’s reply. It is kept separately for each affiliate, and it is never used for our own marketing.

Only totals reach evilasf.com: for each post, how many messages were sent and how many failed each day, with the post’s ID and web address. Never a commenter’s ID or username, their comment, or a message ID. If the message you were sent includes a link to evilasf.com and you tap it, that visit is recorded as our privacy policy describes in section 3.10.

2. How long we keep it

• A commenter’s username, Instagram-scoped ID and comment: 30 days after the reply reaches a final status (sent, or failed for good), then deleted. What stays is a scrambled (hashed) key, the reply’s status and times, and the ID of the post, none of which includes the username or the comment.
• Message and recipient IDs from Instagram’s receipt: 30 days.
• The requests the app sends to Instagram to deliver a message, and Instagram’s responses: 30 days.
• Logs of the app checking for new comments: 30 days.
• Alerts to our staff about problems in the app: 90 days after the problem is resolved. Alerts carry no information about commenters.
• Links we send an affiliate to connect their account, and the sign-in state used while connecting: 7 days after they are used or expire.
• An affiliate’s access token: until they disconnect or ask us to delete their data, then deleted at once.
• When an affiliate disconnects: what the app holds about the people who commented on their posts is deleted 24 hours later. The daily totals stay.
• An affiliate’s other details (username, account IDs, email address, keyword, message and agreement version): until they ask us to delete them.
• Our staff’s audit log of what they did in the app: 1 year.
• Deletion requests: 1 year, as a reference code and a status only.

3. How an affiliate disconnects

Remove the app from your Instagram account. In the Instagram app on your phone:

1. Tap your profile picture in the bottom right to go to your profile.
2. Tap the ☰ menu in the top right.
3. Below Your app and media, tap Website permissions.
4. Tap Apps and websites, then tap Active at the top.
5. Tap Remove next to EvilASF Partner Tools.

On a computer, at instagram.com: click More in the bottom left, then Settings. Below Your app and media, click Website permissions, then Apps and websites, then Active, and click Remove next to EvilASF Partner Tools.

These are the steps in Instagram’s Help Center, and Instagram does move its menus. If you cannot find them, email [email protected] and we will disconnect you.

Once the app is removed, it can no longer send messages from your account. Instagram tells the app when you remove it: the app deletes your access token at once, and what it holds about the people who commented on your posts 24 hours later. The daily totals stay. Instagram may also pass on a request to delete your data. Then the app also deletes your Instagram username and account IDs at once, along with what it holds about the people who commented on your posts. To have your other Partner Tools details deleted too, ask us as described below.

4. How to ask us to delete your data

Anyone can ask: an affiliate, or someone who got a message from the app. You do not need an account with us.

Email [email protected] with your Instagram @username. If you have changed your username since you commented, include the old one as well. If you are an affiliate, write from the email address you gave us, so that we know the request is yours; otherwise we may ask you to confirm it another way.

We will delete your data within 30 days and reply to tell you when it is done.

5. What we delete, and what we keep

What we delete

• If you commented: your username, Instagram-scoped ID and comment, the message the app sent you and Instagram’s receipt for it, wherever the app still holds them.
• If you are an affiliate: your Instagram username and account IDs, email address, access token, keyword, message and agreement version, and what the app holds about the people who commented on your posts.

What we keep

• The daily totals of messages sent and failed for each post. They contain nothing about any one person.
• What is left of each reply to you: the scrambled key, status, times and post ID described above. They do not include your username or your comment, and they are deleted 24 hours after the affiliate disconnects.
• If you are an affiliate, the commission and payout records we must keep for tax and accounting, for as long as the law requires (typically 7 years).
• A record of your request: a reference code and its status, for 1 year, so that we can show it was carried out.
• Our staff’s audit log of what they did in the app, for 1 year.

This covers EvilASF Partner Tools only. If you also have an account with us, you can delete it yourself in the app under Settings → Account, as our privacy policy explains.

6. Contact

Questions about this page or about a request: [email protected]. To report a security vulnerability in EvilASF Partner Tools, write to the same address. Our privacy policy covers the app in full, in section 3.12.