Privacy notice
This notice explains how LinkBounce processes information during its controlled testing phase. LinkBounce is operated by SALEFDE LLC.
Information we process
- Your account: name, email address, protected password credentials, session information and workspace ownership.
- Your Instagram connection: professional account ID, username, account type, granted permissions, token expiry and an encrypted access token. Instagram authentication happens with Meta; LinkBounce does not collect your Instagram password.
- Your campaigns: selected post IDs and cached post details, trigger words, reply text, destination links and campaign status.
- Comment and delivery records: IDs of matching comments, posts and commenters, event times, delivery state, error codes and quota accounting. We process comment text to match your rule. The current delivery event records do not store the commenter's username or comment text.
- Privacy requests: the contact email, request type and information you choose to enter in our form.
Why we use this information
We use it to provide account access, connect Instagram, show your posts, run campaigns you explicitly activate, send eligible private replies through Meta, prevent duplicates, enforce usage limits, troubleshoot failures and handle privacy requests. You decide which campaign to activate. Saving a draft does not send a message.
Who receives information
Meta processes Instagram sign-in, account permissions, API requests and private replies under its own policies. Cloudflare carries traffic through the current HTTPS test tunnel. Application records are stored in our PostgreSQL database on infrastructure operated for this test service. Authorized operators can access records when necessary for service operation and request handling. We do not sell personal information.
Optional campaign link measurement
When a creator enables tracking, the explicit destination link in a private reply is replaced with an opaque LinkBounce link. The server stores its approved HTTPS destination, workspace, campaign, media and DM intent association, expiry, API acceptance time and first eligible request time. It keeps daily raw request, suspected scanner/preview and estimated unique link counts. Redirects set no tracking cookie and store no visitor IP address, full User-Agent, browser fingerprint or Instagram identity in the token. IP and request headers are processed transiently for rate limiting and approximate scanner filtering. One link's first eligible request counts once; this does not establish a unique human, delivery or purchase.
Links expire 90 days after creation. Pausing a campaign or turning tracking off preserves existing links; explicit revocation, destination approval withdrawal and workspace suspension or deletion stop redirects. Expired destination mappings are cleared by maintenance. Link attribution, event deduplication keys and daily aggregates are retained for up to 400 days, with bounded maintenance cleanup; verified workspace deletion purges them. Backups follow the existing retention and deletion-registry process.
Creators must give recipients appropriate transparency, establish an applicable legal basis and obtain consent where required for their use and jurisdiction before enabling measurement. First-party routing and the absence of cookies do not automatically exempt tracking from privacy or ePrivacy obligations. Ask the creator or use our data request process to exercise applicable rights.
Cookies and storage
LinkBounce uses necessary session cookies to keep you signed in and protect your workspace. The current workspace does not require advertising cookies. Disconnecting Instagram removes the locally stored token and pauses managed campaigns; it is not the same as deleting your entire LinkBounce account.
Retention and deletion
We retain account and campaign records while needed to provide the service. You can request deletion through the form below. Deletion is reviewed and performed manually after we verify the relevant account or data relationship. Limited security, abuse-prevention or legally required records may need to be retained separately. Privacy request records are reviewed by the operator and removed when no longer required; no automatic deletion or instant-erasure promise is made.
Your choices
You can pause a campaign, disconnect Instagram in LinkBounce, and remove the app's permission in Instagram's Apps and Websites settings. You can request access, correction or deletion through our request form. If you commented on a creator's post, identify the creator account and approximate comment date without sending your password, identity documents or access tokens. We may need to coordinate with that creator and verify your request.
Security, locations and changes
Access to workspaces is restricted by account ownership, Instagram tokens are encrypted at rest, and the public service uses HTTPS. Meta, Cloudflare and the operator's systems may process information in different countries. No system guarantees absolute security. This notice will be updated when the service, infrastructure or contact process changes. This controlled test notice does not claim a security certification.
Contact the operator
Operator: SALEFDE LLC. Submit a privacy request; the form records your request and supplies a reference. A public business email address will be added when that channel is operational.