Contact us
Log inTry free

Privacy Policy

theZio · Last updated 19 October 2026

theZio (“theZio”, “we”, “us”), operated by Punyakriya Industries Private Limited, is a tool that lets Instagram creators set up automatic replies to comments on their own posts. A creator connects their own Instagram account, defines keywords, and we send an automatic reply or direct message on their behalf when someone comments with a matching keyword. This policy explains exactly what data we handle, why, how we protect it, and how you can have it deleted. It specifically covers data obtained through Instagram and the Meta Platform. It applies to the theZio website (thezio.co) and the theZio Android app, which is the same service.

1. Who this policy is for

There are three groups of people whose data we handle:

  • Creators - people who sign up and connect their Instagram account to use theZio
  • Audience members - people who comment on, or send a message to, a creator’s Instagram post and trigger an automatic reply.
  • Page visitors and buyers - people who open a creator’s theZio page (thezio.co/<handle>), and who get a free product or buy one there.

2. What we collect

From creators (your account):

  • Your email address, and your name and phone number if you add them. If you sign up with a password, we store only a one-way hash of it, never the password itself.
  • Your plan and billing status. Payments are handled by Razorpay; we never see or store your card or bank details.
  • Digital products, files and images you upload, and your link in bio page.
  • If you sell paid products: your support email or phone (shown to your buyers), your legal name, PAN and address, your GSTIN if you add one, and the bank account or UPI ID for your payouts. Your PAN is stored encrypted (we need it for tax returns), with a keyed fingerprint to spot a PAN used on two accounts. Your bank account number is stored encrypted and used only to pay you: we check it with a small test deposit (ourselves, or through RazorpayX once we pay through it) and pay you by bank transfer. We show only its last 4 digits and the IFSC (or a masked payout UPI ID), and keep the name your bank gives for it and, if used, RazorpayX’s ids. We also keep a ledger of your sales, fees, taxes, refunds and payouts.
  • Your own Meta Pixel or Google Analytics id, if you add one to your page. Those tools then run on your page for your visitors, under your own account with Meta or Google.

From creators (via Instagram Login):

  • Your Instagram user ID and username.
  • An Instagram access token, used only to read comments on your posts and to send replies and direct messages on your behalf. It is stored encrypted (see Security).
  • The keywords, reply text, and automation settings you configure.

From audience members (via Instagram webhooks):

  • The Instagram-scoped user ID and username of the person who commented or messaged.
  • The content of the comment or message, the comment ID, and the post (media) ID - so we can match keywords and reply correctly.
  • An email address only if the creator enables email capture for an automation and the audience member voluntarily provides it in reply.

From visitors and buyers on a creator’s page:

  • Visits and taps, counted for the creator: the page or product opened, the link tapped, the site or tagged link that brought you, and your country. To count unique visitors we keep keyed one-way hashes of your IP address and browser, never the address itself.
  • Your email address, when you give it to get a free product or to buy one. It is shared with that creator, who may email you about it.
  • For a purchase: the product, the amount, the payment status and Razorpay’s payment ids. Your card, bank and other payment details go to Razorpay and are never seen or stored by us.

From visitors to thezio.co and creators using the dashboard:

  • Usage analytics: the pages you open (the address only, never what you type), the buttons and links you tap, how long a page is in active use, the site or tagged link that brought you here, your device type and your country (from your IP address; the address itself is not stored).
  • First-party cookies: two random ids, so a visit and a returning browser can be counted, and one that remembers which link first brought you here. If you sign up, this is linked to your account so we can see which sources bring creators.
  • On public pages of the website only (not the dashboard, and never inside the theZio Android app), Google Analytics through Google Tag Manager may also measure visits.

We do not collect plain-text passwords, payment card details, contact lists, or any data beyond what is needed to run the automation and the service described above. We do not scrape Instagram or build audiences from accounts that did not interact with the creator.

3. How we use data

  • To detect comments matching a creator’s keywords and send the configured reply or DM.
  • To prevent sending the same person duplicate replies.
  • To see which pages, features and sources are useful, from usage analytics, so we can improve the product and our marketing. We never sell it.
  • To interpret the intent of a comment, the comment text may be processed by an automated language model (Anthropic’s Claude API) solely to decide whether it matches a keyword. This text is not used to train any model and is not retained by that provider beyond the request.
  • Brand deal inbox (Pro creators only): a comment that matches none of the creator’s automations, or a direct message outside an automation, may be checked for a brand or business collaboration enquiry. Messages that look like one are sent to Anthropic’s Claude API, under the same terms as above, to summarise the enquiry and draft a reply for the creator. The flagged message (first 500 characters), the sender’s username and that summary are shown only to the creator, and are deleted with the creator’s account. If the creator switches it on, theZio sends the sender one reply written by the creator; it never sends text written by the model.
  • DM Agent (Pro creators only, when the creator switches it on): a direct message that is not part of an automation or a brand enquiry may be answered automatically. It is first checked against the creator’s own keyword replies; if none fits, the message and the last few messages of that conversation are sent to Anthropic’s Claude API, under the same terms as above, to draft a reply using only answers, products and links the creator saved. A reply is sent only if it passes theZio’s checks (no link or price the creator did not provide), and it is marked as an automatic reply. A short log of these messages is shown only to the creator and deleted after 30 days.
  • To show the creator their own automation activity in their dashboard.
  • To deliver a free or paid product, email the download link, pay the creator their sales every week by bank transfer, deduct the tax the law requires, issue tax invoices, and handle refunds and complaints.
  • To keep access tokens valid (automatic refresh) so automations don’t silently stop.

We do not sell personal data, and we do not use it for advertising or share it with advertisers.

4. Instagram and Meta Platform data

Data obtained through the Instagram Graph API and Meta Platform is used only to provide the features described in this policy. Our use of information received from Meta APIs follows the Meta Platform Terms and Developer Policies. We do not transfer Instagram data to data brokers, ad networks, or any party for purposes unrelated to running a creator’s own automations. A creator can revoke theZio’s access at any time from Instagram → Apps and Websites; doing so stops all data collection for that account.

5. How we store and protect data

  • Instagram access tokens are encrypted at rest using AES-256.
  • Data is stored on managed infrastructure with access restricted to our service.
  • Transport is encrypted over HTTPS.
  • Incoming webhooks are signature-verified to reject forged requests.

6. Service providers we use

We rely on a small set of processors that handle data strictly to run the service, under their own security and privacy commitments:

  • Supabase - database storage.
  • Railway - application/server hosting.
  • Redis - temporary message queue for rate-limited sending.
  • Vercel - dashboard hosting.
  • Cloudflare - storage for the files and images creators upload.
  • Razorpay - plan subscription payments, checkout for products bought from creator pages, and creator payouts and bank account checks (RazorpayX).
  • Resend - account emails (verification, password reset, alerts) and download links for products.
  • Anthropic - optional comment-intent classification and brand deal summaries (see Section 3).
  • Google - Google Analytics and Tag Manager, on public website pages only (not the dashboard or the Android app), to measure site visits.

7. Data retention

We keep data only as long as needed to provide the service. Creator account data is kept while the account is connected. Conversation and comment records are kept to operate and report on automations and are deleted when the related automation or account is deleted. Raw webhook logs are kept short-term for reliability and troubleshooting, then removed. Usage analytics are kept for 13 months, then deleted, and a creator’s usage is deleted with their account. Visits, emails and orders on a creator’s page are kept while that creator’s account exists, so they can see their sales, and are deleted with it. A visitor can ask us to delete the email they gave for a free product sooner (Section 8); Razorpay keeps its own record of every payment as the law requires.

When a creator deletes their account, everything above is erased at once, including uploaded files. We keep only what we must: payout records for our Influencer Program (no longer linked to the account), security and audit logs, and short-term webhook logs, which expire on their normal schedule. An account that has sold through its page also has tax and payment records the law requires us to keep (sales, fees, refunds, payouts and invoices): such an account is closed through support, and those records are kept for as long as the law requires. Razorpay keeps its own payment records as the law requires. To stop repeat free trials we keep a one-way, keyed fingerprint of your email and Instagram account id, with nothing else. We also keep a short note that the account was deleted (your handle, name, email, plan and dates), seen only by our team and erased after 180 days.

8. How to delete your data

Creators can delete their account themselves, on the website or in the Android app: log in and open Settings → Delete account. Your automations stop, your data is erased straight away and any Pro subscription is cancelled. See our Data Deletion page for every option.

You can also disconnect at any time from Instagram → Apps and Websites. To ask us to delete your data for you - or, for an audience member, deletion of records tied to your interactions - email hello@thezio.co with the Instagram username involved (or, for a page visitor or buyer, the email address you used). We will delete the associated data within 30 days and confirm by email. Razorpay keeps its own records of a payment as the law requires.

9. Children

theZio is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child’s data has reached us, contact us and we will delete it.

10. Changes to this policy

If we change this policy, we will update the date at the top of this page. Material changes will be reflected here before they take effect.

11. Contact

For any questions, complaints, or requests about privacy or your data, reach us at: