Privacy Policy

Who we are

Palsko is a service that helps shops answer customer messages and comments on Instagram, with the help of AI. It is operated by an individual, based in Belgrade, Serbia.

You can reach us at 0xnull.dev@gmail.com about anything in this policy.

Whose data this covers

Shop owners: people who connect their Instagram professional account to Palsko.

Customers of those shops: people who send a message or comment to the Instagram account of a shop that uses Palsko. We handle their messages on behalf of the shop, and the shop decides how they are used.

People who join early access on our website: they give us their email and a few details about their shop.

What we collect

• From the Instagram account you connect: its id, username, profile picture link, account type, the permissions you granted, and an access token. The token is stored encrypted.
• What you enter: shop information such as shipping and returns, your store address and the products we read from your public store, your currency and your assistant settings.
• Conversations: the messages and comments sent to your account, the replies sent from it, the sender's Instagram id and username, their name and a link to their profile picture when Instagram provides them, times, and whether a message had an attachment. We keep the picture link, not the picture itself, and we do not store photos or videos.
• Sign-in: a session cookie. We store only a scrambled (hashed) version of it.
• AI usage records: which model answered, how many tokens it used, the cost, the timing and the outcome. These records do not contain message text.
• Usage of the dashboard: which pages you open and which features you use (for example connecting a store, changing the assistant's setting, sending a draft), linked to your shop and its name. This does not include message text or what you type, we do not record your screen, and no cookie is used for it.
• Error reports: when something breaks, a technical report of what went wrong (the page address without its search terms, the browser, and the part of our code that failed). Message text, what you typed, cookies, access tokens and your IP address are removed first, and the report is not linked to your shop.
• Early access sign-ups: your email, your shop's Instagram username if you give it, where you sell, the website language, your country (worked out from your connection, not stored as an address), the link you came from (such as an ad or a post), your answer to our optional question, and when you agreed to be contacted. We keep a scrambled (hashed) version of your connection's address only to limit repeated sign-ups.
• Visits to our website: which pages you open and which buttons you press. This does not identify you and no cookie is used for it.

How we use it

We use this data only to run the service for you: to show your inbox, let you reply, write draft or automatic replies from the information you provide, show activity numbers, keep the service secure, and see which parts of the service are used so we can improve them.

We do not sell your data or your customers' data, we do not use it for advertising, and we do not use one shop's conversations to improve replies for another shop or to train AI models.

If you joined early access, we email you about early access and the launch, as you agreed when you signed up. Every email lets you unsubscribe, and you can also write to 0xnull.dev@gmail.com to be removed.

AI processing

To write a reply, we send the customer's message (and, where needed, earlier messages from the same chat) together with the shop information you provided to an AI model through OpenRouter. We ask OpenRouter to route only to providers that do not keep or train on prompts.

AI can be wrong. You control whether the assistant only writes drafts for you to approve, or also sends replies on its own.

Who else handles your data

We may also disclose data if the law requires it.

• Meta (Instagram): the source of your messages. Meta's own policies apply to data on Instagram.
• Vercel: hosts the web application.
• Neon: hosts our database in Frankfurt, Germany (EU).
• OpenRouter and the AI model providers it routes to: process message text to write replies.
• PostHog: stores the dashboard usage described above, in the EU.
• Sentry: stores error reports so we can fix problems, in the EU.

Where data is stored

Our database is in the EU. Hosting and AI providers may process data in other countries, including the United States.

How long we keep data

We keep your data while your account is connected. If you ask us to delete it, we delete it within 30 days, as described on the data deletion page. Our database provider may keep backups for a short period after deletion.

Early access sign-ups are kept until you ask us to remove you, or deleted within 12 months after launch if you did not become a customer.

Security

• Instagram access tokens are encrypted when stored.
• Connections to the service use HTTPS.
• Each shop's data is kept separate from every other shop's.
• We limit our own access to what is needed to run and fix the service.

Your rights

You can ask us to show, correct, export or delete your data, to restrict how we use it, or to object to it. Write to 0xnull.dev@gmail.com and we will answer within 30 days.

If you think we have handled your data wrongly, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection in Serbia, or to the data protection authority where you live.

If you wrote to a shop

The shop decides how your messages are handled. You can ask the shop, or write to us at 0xnull.dev@gmail.com with your Instagram username and the shop's name, and we will delete your messages from that shop's account. See the data deletion page.

Age

Palsko is for businesses and is not meant for anyone under 18.

Changes

We may update this policy. The date at the top shows the latest version. We will tell connected shop owners about important changes.