Last updated: 23 September 2026
This Privacy Policy explains what information snazzy collects, why, who else sees it, and what you can do about it. snazzy is operated by Ashlytic Labs LLP (“snazzy”, “we”, “us”), and helps people schedule and publish content to Instagram professional accounts they own or manage, and automate replies on those accounts.
This is the part most scheduling tools do not have, so it is worth being explicit. If you switch on Auto-DM, Instagram sends us the comments and messages that other people leave on your account so that snazzy can reply on your behalf. For that we process:
We process this data on your instructions, to operate the automation you configured. You remain responsible for what your rules say and for following Instagram’s messaging policies. We do not use this data for anything else, we do not build profiles from it, and we do not use it to contact anyone ourselves.
If you tag a brand as a paid partner on a post, we store that brand’s Instagram ID with the post so Instagram can display its “Paid partnership” label when the post publishes. If that label cannot be attached for any reason, we will not publish the post rather than publish a sponsored post without its disclosure.
_fbp and _fbc values, or the ad click ID from your link). We do not store your IP address; it is only passed on in that one message. This is subject to the same choice as the tag: if you have not accepted it, nothing is sent.Meta uses what it receives through these two under its own terms as well as ours, so for this part Meta and snazzy are jointly responsible. Meta’s own privacy policy is at facebook.com/privacy/policy.
When your automation sends a message containing a link, snazzy rewrites it to a snazzy address so a click can be counted. What we record is a timestamp and which link was clicked — nothing else. No IP address, no device or browser information, and nothing identifying the person who clicked. The counts you see are totals, not a list of people.
Paid plans are sold through Paddle, who act as the Merchant of Record. Your card details go to Paddle and never reach us — we do not see, process or store them. We store the subscription and customer identifiers Paddle gives us so we know which plan you are on and can offer you a way to cancel.
We do not sell your data. We do not use your content to train our own models. We do not post anything you did not schedule, we do not send messages your rules did not ask for, and we do not access accounts you have not connected.
Every cookie below is listed with who reads it. All but one are set by snazzy itself and read by nobody else; the exception is Meta’s, which is marked.
Strictly necessary — these are set for everyone, because the site cannot work without them:
snazzy_session — keeps you signed in for 30 days.snazzy_oauth / snazzy_goauth — one-time, thirty-minute values that protect the Instagram and Google sign-in steps from cross-site request forgery.lang — remembers the language you chose.snazzy_consent — remembers the cookie choice you made below, for six months. Without it we would have to ask you again on every page.Optional — these tell us which links, campaigns and ads bring people to snazzy:
snazzy_ref — records that you arrived through someone’s referral link, so that person is credited if you subscribe. Kept for 60 days. Set and read by snazzy only.snazzy_attr — records the campaign tags on the link you arrived through. Kept for 60 days. Only the first link you arrive on counts. Set and read by snazzy only._fbp and _fbc — set by Meta’s tag, read by Meta (and passed on by us with sign-up and connection events), to measure our ads (see “How you found us”). _fbc appears only if you arrived from an ad. Meta keeps them for 90 days. Loading the tag also lets your browser send Meta any cookies Meta already has on it.If you are in the UK, the EEA or Switzerland, none of the optional cookies are set and Meta’s tag is not loaded unless you accept, and you are asked before anything optional is stored. Choosing “Essential only” — or simply not answering — means none of it happens. If you accept and later change your mind, choosing “Essential only” deletes snazzy’s two cookies and stops the tag and the sign-up events from then on; the _fbp and _fbc cookies Meta already set stay until it expires or you clear it in your browser.
Everywhere else these are on by default. Wherever you are, Cookie choices at the bottom of every page brings the choice back, and “Essential only” switches all of it off in the same way.
We send a small number of messages about your account: a welcome mail, and at most two reminders if you never connect an account — that is the whole sequence, there is no third.
Those carry an unsubscribe link and unsubscribing stops them for good. Operational notices do not, deliberately: when a post of yours fails to publish, your automation hits its limit, or a payment fails, you need to know, and an unsubscribe link on a message like that is a way of losing you the thing you were paying for. You can stop those by closing your account.
You can disconnect an Instagram account at any time, which revokes snazzy’s token and stops all publishing and automation for it. You can also revoke snazzy from Instagram directly, under Settings → Apps and Websites.
Everything else expires on a clock, whether or not anyone asks:
| What | Kept for |
|---|---|
| Automation events — what each rule did and why | 90 days |
| Clicks on links inside automated messages | 90 days |
| Connect-funnel records — whether a connection attempt succeeded | 90 days |
| Which hashtags you searched | 7 days — the length of Instagram’s own allowance window |
| Error and diagnostic records | 30 days |
| Sign-in attempt records, used only for rate limiting | 2 hours |
| Short-link click counts | 30 days |
| Your cookie choice, so we can show we honoured it | 2 years |
The 90-day figure for automation events and link clicks is the same on purpose: those two describe the same interaction from opposite ends, and letting one outlive the other would leave half a conversation on file.
The data controller is Ashlytic Labs LLP, a limited liability partnership registered in India under LLPIN ACY-9468 (verifiable on mca.gov.in). We decide what is collected and why, and we are who you contact about any of it: privacy@snazzyposts.com.
We are small enough not to have a Data Protection Officer, and not required to appoint one. Privacy mail goes to a person, not a queue.
If the UK or EU GDPR applies to you, these are the lawful bases we rely on. Where the basis is consent you may withdraw it at any time, and where it is legitimate interests you may object.
| What | Why | Basis |
|---|---|---|
| Your account, your scheduled posts, publishing and automation | To provide the service you signed up for | Contract |
| Your Instagram tokens and connection | To act on the accounts you connected, as you direct | Contract |
| Billing records | To take payment and to meet tax and accounting obligations | Contract and legal obligation |
| Account and operational email | To tell you a post failed, a limit was hit, or a payment did not go through | Contract |
| The two activation reminders | To help you finish setting up | Legitimate interests — you can unsubscribe from these and they stop for good |
| Diagnostics, error records, rate limiting and abuse prevention | To keep the service working and to stop misuse | Legitimate interests |
| Data about people who message or comment on your accounts | To deliver the automated reply you configured | Legitimate interests — see “Data about other people” above |
| Referral and campaign cookies | To tell which links and campaigns bring people here | Consent in the UK, EEA and Switzerland; legitimate interests elsewhere |
| Meta’s measurement tag, and sign-up and connection events sent to Meta with a hashed email, your IP address, browser type and Meta’s click identifiers | To measure whether our ads on Instagram and Facebook bring people who actually use snazzy | Consent in the UK, EEA and Switzerland; legitimate interests elsewhere — you can object with “Essential only” at any time |
We do not sell your data. The one thing we share for advertising is what “How you found us” describes: Meta’s tag and the sign-up and connection events, used to measure our own ads. These are every processor involved, what each one gets, and where it sits:
| Processor | What it handles | Where |
|---|---|---|
| Cloudflare | Hosting, the database, and your uploaded media | Global edge network |
| Meta Platforms | Publishing and reading your posts; sending and receiving messages, as you direct. Separately, if you allow it, measuring our ads (the tag, and sign-up and connection events with a hashed email, IP address, browser type and Meta’s click identifiers) — for that part Meta is jointly responsible with us, not only our processor | USA / global |
| Paddle | Payments. Paddle is the merchant of record and takes your payment details directly — we never see your card | UK / EU |
| Resend | Email delivery, so it receives your address and the message | USA |
| Sign-in, only if you choose it | USA / global | |
| Anthropic | Optional AI caption and hashtag suggestions — only the text you type into that box. Under their API terms it is not used to train their models | USA |
We may also disclose information where the law requires it.
snazzy runs on Cloudflare’s global network, so your data may be processed in any country where Cloudflare operates. We are in India, and several of our processors are in the United States.
India has no European Commission adequacy decision, and neither do some of the other places involved. Where data leaves the UK or EEA, the transfer relies on the Standard Contractual Clauses in our agreements with those processors, together with the technical measures described here — Instagram tokens are encrypted at rest, and card details never reach us at all. You can ask us for the detail of those safeguards at privacy@snazzyposts.com.
If the UK or EU GDPR applies to you, you can ask us to give you a copy of your data, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to processing we base on legitimate interests. Where we rely on consent you can withdraw it, and withdrawing is as easy as giving it — the cookie banner’s “Essential only” deletes snazzy’s optional cookies rather than merely stopping new ones, and Cookie choices at the bottom of every page brings the banner back whenever you want it.
Email privacy@snazzyposts.com and we will answer within 30 days. There is no charge. We will never make you worse off for asking — no downgrade, no restriction, no closed account.
If you think we have got it wrong, you can complain to your local data protection authority: in the UK the Information Commissioner’s Office, and in the EEA the supervisory authority for the country you live in. We would rather you came to us first, but that is your right and not conditional on doing so.
We will update this page and change the date above when what we do changes. If a change is significant, we will say so by email rather than only here.
Questions about privacy, or a request about your data? Email privacy@snazzyposts.com.