Privacy policy

Who we are

big. is operated by D.C. Collectibles LLC, doing business as “big.” (“we”, “us”). We are the controller of personal data you provide when connecting your Instagram business account to big.

For your own account data (such as your email and Instagram login), we act as the data controller. For data about people who interact with your Instagram account — those who message you or comment on your posts — we act as a processor on your behalf, and you are responsible for any notice or consent your local law requires you to give them.

Data we collect

• Your Instagram user id and username (creator).
• Fan Instagram-scoped user ids (IGSIDs) of people who message your account.
• The text and timestamp of inbound DMs and the auto-replies we send.
• The text of comments on posts where you enabled comment triggers.
• Cached copies of your Instagram posts (captions and media details such as type, URL, permalink, thumbnail, and like/comment counts) and of the comments on them — the comment text, the commenter’s Instagram username and account ID, and timestamps — so the Manage tab can show your posts and let you reply to, hide, or delete comments. We process commenters’ information only to provide this feature to you; you remain responsible for how you engage your own audience.
• Account email and authentication metadata for dashboard sign-in.

Why we collect it

To deliver the auto-reply service you signed up for: matching inbound messages against rules you authored, sending replies on your behalf, and showing you a log of what happened. Lawful basis: contract (delivering the service) and your explicit Instagram connection consent.

For workspaces on a paid plan, recent direct-message text from a conversation — both the fan’s messages and your own replies in that thread — is sent to OpenAI to classify buying intent so we can suggest hot leads in your inbox; messages are minimized before sending and are never used to train models.

Retention

We retain DM content for as long as your account is active. We plan to roll out a 90-day sweep of fan DM bodies; until that ships, message text is held indefinitely subject to your deletion requests.

Cached Instagram posts and comments are kept only while your Instagram account stays connected and are refreshed when you view the Manage tab. We permanently delete them when you disconnect the account in big., when Instagram notifies us that you removed our app, or in response to a data-deletion request. Deletion on disconnect or removal is effectively immediate, and in every case we complete it within 30 days. This is consistent with our obligation under the Meta Platform Terms to delete Platform Data when it is no longer needed.

Sub-processors

• Supabase — database and authentication.
• PostHog — product analytics and logs.
• Stripe — billing.
• Meta Platforms — Instagram Graph API.
• Resend — transactional email.
• OpenAI — lead-intent classification.

Your rights

You can request deletion of all data tied to your Instagram account at any time. Visit /data-deletion for instructions. Removing big. from Instagram’s “Apps and Websites” panel automatically triggers deletion via the same pipeline.

Legal & safety disclosures

We may access, retain, and disclose your data where we believe in good faith it is required by law or reasonably necessary to detect, prevent, or address illegal activity, fraud, or safety issues. This includes reporting child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and cooperating with law enforcement as required by law.

Contact

Questions or requests: [email protected].