big
PricingDocsLog inJoin the waitlist

Privacy policy

Last updated: October 6, 2026

Who we are

big. is operated by D.C. Collectibles LLC, doing business as “big.” (“we”, “us”). We are the controller of personal data you provide when connecting your Instagram business account to big.

For your own account data (such as your email and Instagram login), we act as the data controller. For data about people who interact with your Instagram account — those who message you or comment on your posts — we act as a processor on your behalf, and you are responsible for any notice or consent your local law requires you to give them.

Data we collect

  • Your Instagram user id and username (creator).
  • Fan Instagram-scoped user ids (IGSIDs) of people who message your account.
  • The text and timestamp of inbound DMs and the auto-replies we send.
  • The text of comments on posts where you enabled comment triggers.
  • Cached copies of your Instagram posts (captions and media details such as type, URL, permalink, thumbnail, and like/comment counts) and of the comments on them — the comment text, the commenter’s Instagram username and account ID, and timestamps — so the Manage tab can show your posts and let you reply to, hide, or delete comments. We process commenters’ information only to provide this feature to you; you remain responsible for how you engage your own audience.
  • Account email and authentication metadata for dashboard sign-in.
  • If you connect Typeform, that account’s id, email and name, and the structure of your forms — questions and field types, so a form can be rebuilt here. We never receive your Typeform responses: the access we request excludes them.
  • If your workspace keeps client records and has been set up to import from a connected meeting tool, file store or calendar: call transcripts, attendee names and emails, and AI summaries; the text of files you pick for a client; and the times of calendar events your clients attend, with which clients are on them. We keep a copy of each transcript file and each file’s text in private storage, and delete all of it when you disconnect that tool.

Why we collect it

To deliver the auto-reply service you signed up for: matching inbound messages against rules you authored, sending replies on your behalf, and showing you a log of what happened. Lawful basis: contract (delivering the service) and your explicit Instagram connection consent.

Cookies

When someone clicks a creator’s short link (a /l/ URL) that leads to a form hosted on big., we set one first-party cookie named bc_session. It holds a random identifier — never your name, Instagram account, or any other personal detail — and expires after 7 days. Its only purpose is to link that click to a form response you may submit afterwards, so the creator can see your response in the context of the conversation that led to it. It is not used for advertising or analytics, and it is never shared with third parties. We act as the creator’s processor for this linkage; each creator is the controller for their audience and is responsible for their own disclosures (we provide boilerplate in our documentation). Clicks on links that lead anywhere other than big. set no cookie at all.

Retention

We retain DM content for as long as your account is active. Fan DM message bodies are automatically redacted 90 days after we receive them; the conversation record (timestamps, direction, message counts) remains available for your stats, subject to your deletion requests.

Cached Instagram posts and comments are kept only while your Instagram account stays connected and are refreshed when you view the Manage tab. We permanently delete them when you disconnect the account in big., when Instagram notifies us that you removed our app, or in response to a data-deletion request. Deletion on disconnect or removal is effectively immediate, and in every case we complete it within 30 days. This is consistent with our obligation under the Meta Platform Terms to delete Platform Data when it is no longer needed.

Cookies and analytics

We use one analytics tool, PostHog, to understand how big is used. It sets no cookie and stores no identifier on your device until you choose “allow cookies” in the banner; until then (and if you decline), analytics runs in a cookieless mode where events are anonymous and nothing persists between visits. Your choice itself is remembered in your browser's local storage, which is required to honor it. You can change your mind at any time by clearing site data for itsjustbig.com, which brings the banner back.

If you are signed in, the same choice also gates our feedback board, UserJot: it does not load, and we do not share your account email with it, until you choose “allow cookies.” Declining or not answering keeps it off.

We do not run advertising trackers and we do not sell or share your data for advertising.

Sub-processors

We list a company below when it processes personal data on our behalf to run big. Services we only read from — where we receive data and send none, such as signing in with Google — are not sub-processors and are not listed. This list is current as of 6 October 2026; if we add a sub-processor we will update it here and change the date.

  • Neon — database hosting.
  • Cloudflare — R2 object storage for files you upload.
  • Render — application hosting.
  • PostHog — product analytics and logs.
  • Stripe — billing.
  • Google Cloud — Key Management Service, which encrypts and decrypts the per-connection keys that protect the third-party API keys and sign-in refresh tokens you connect as integrations. It never receives those API keys or tokens themselves.
  • Meta Platforms — Instagram Graph API.
  • Resend — transactional email (account and billing notices), and product-update email you can unsubscribe from at any time using the link in any of those messages. Unsubscribing never stops account notices.
  • UserJot — feedback board (feature voting/requests), gated behind cookie consent like PostHog above.

Your rights

You can delete your whole account yourself in Settings → Account: it cancels billing, then permanently removes every connection, contact, message, automation, form, and file, immediately. The same screen offers a one-click export of your workspace data as JSON. You can also request deletion of all data tied to your Instagram account at any time; visit /data-deletion for instructions. Removing big. from Instagram’s “Apps and Websites” panel automatically triggers deletion via the same pipeline.

Legal & safety disclosures

We may access, retain, and disclose your data where we believe in good faith it is required by law or reasonably necessary to detect, prevent, or address illegal activity, fraud, or safety issues. This includes reporting child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and cooperating with law enforcement as required by law.

Contact

Questions or requests: [email protected].