Privacy policy

Who we are

big. is operated by D.C. Collectibles LLC, doing business as “big.” (“we”, “us”). We are the controller of personal data you provide when connecting your Instagram business account to big.

For your own account data (such as your email and Instagram login), we act as the data controller. For data about people who interact with your Instagram account — those who message you or comment on your posts — we act as a processor on your behalf, and you are responsible for any notice or consent your local law requires you to give them.

Data we collect

• Your Instagram user id and username (creator).
• Fan Instagram-scoped user ids (IGSIDs) of people who message your account.
• The text and timestamp of inbound DMs and the auto-replies we send.
• The text of comments on posts where you enabled comment triggers.
• Cached copies of your Instagram posts (captions and media details such as type, URL, permalink, thumbnail, and like/comment counts) and of the comments on them — the comment text, the commenter’s Instagram username and account ID, and timestamps — so the Manage tab can show your posts and let you reply to, hide, or delete comments. We process commenters’ information only to provide this feature to you; you remain responsible for how you engage your own audience.
• Account email and authentication metadata for dashboard sign-in.

Why we collect it

To deliver the auto-reply service you signed up for: matching inbound messages against rules you authored, sending replies on your behalf, and showing you a log of what happened. Lawful basis: contract (delivering the service) and your explicit Instagram connection consent.

For workspaces on a paid plan, recent direct-message text from a conversation — both the fan’s messages and your own replies in that thread — is sent to OpenAI to classify buying intent so we can suggest hot leads in your inbox; messages are minimized before sending and are never used to train models.

Cookies

When someone clicks a creator’s short link (a /l/ URL) that leads to a form hosted on big., we set one first-party cookie named bc_session. It holds a random identifier — never your name, Instagram account, or any other personal detail — and expires after 7 days. Its only purpose is to link that click to a form response you may submit afterwards, so the creator can see your response in the context of the conversation that led to it. It is not used for advertising or analytics, and it is never shared with third parties. We act as the creator’s processor for this linkage; each creator is the controller for their audience and is responsible for their own disclosures (we provide boilerplate in our documentation). Clicks on links that lead anywhere other than big. set no cookie at all.

Retention

We retain DM content for as long as your account is active. Fan DM message bodies are automatically redacted 90 days after we receive them; the conversation record (timestamps, direction, message counts) remains available for your stats, subject to your deletion requests.

Cached Instagram posts and comments are kept only while your Instagram account stays connected and are refreshed when you view the Manage tab. We permanently delete them when you disconnect the account in big., when Instagram notifies us that you removed our app, or in response to a data-deletion request. Deletion on disconnect or removal is effectively immediate, and in every case we complete it within 30 days. This is consistent with our obligation under the Meta Platform Terms to delete Platform Data when it is no longer needed.

Cookies and analytics

We use one analytics tool, PostHog, to understand how big is used. It sets no cookie and stores no identifier on your device until you choose “allow cookies” in the banner; until then (and if you decline), analytics runs in a cookieless mode where events are anonymous and nothing persists between visits. Your choice itself is remembered in your browser's local storage, which is required to honor it. You can change your mind at any time by clearing site data for itsjustbig.com, which brings the banner back.

We do not run advertising trackers and we do not sell or share your data for advertising.

Sub-processors

• Supabase — database and authentication.
• PostHog — product analytics and logs.
• Stripe — billing.
• Meta Platforms — Instagram Graph API.
• Resend — transactional email.
• OpenAI — lead-intent classification.

Your rights

You can delete your whole account yourself in Settings → Account: it cancels billing, then permanently removes every connection, contact, message, automation, form, and file, immediately. The same screen offers a one-click export of your workspace data as JSON. You can also request deletion of all data tied to your Instagram account at any time; visit /data-deletion for instructions. Removing big. from Instagram’s “Apps and Websites” panel automatically triggers deletion via the same pipeline.

Legal & safety disclosures

We may access, retain, and disclose your data where we believe in good faith it is required by law or reasonably necessary to detect, prevent, or address illegal activity, fraud, or safety issues. This includes reporting child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and cooperating with law enforcement as required by law.

Contact

Questions or requests: [email protected].