Instagram API Usage

1. Permissions We Request

NextCRM uses the official Instagram API with its own Instagram business login (without Facebook) to work with an Instagram business account. We request the minimal set of permissions necessary:

• instagram_business_basic — retrieve basic information about the Instagram business account;
• instagram_business_manage_messages — read and send Direct messages;
• instagram_business_manage_comments — moderate comments on posts.

2. How We Use Instagram Data

We use the data exclusively to provide NextCRM's core functionality:

• Direct messages and post comments — synced with the CRM, manager replies sent through the NextCRM interface;
• User profile — name and avatar displayed in the chat (not stored permanently — cached for up to 24 hours);
• Orders — created in NextCRM based on the conversation and linked to the customer.

We do NOT:

• share Instagram data with third parties;
• use the data for ad networks, retargeting, or selling profiles;
• retain data longer than necessary for the Service to function;
• use Instagram data to train ML models.

3. Storage of Instagram Data

• Messages — retained while the account is active, plus 30 days after the integration is disconnected. Earlier deletion is possible on request.
• Conversation metadata (timestamp, status) — 90 days.
• User profile — cached for 24 hours, then refreshed or deleted.
• Access tokens — encrypted in the database (AES-256), access restricted to the integration service.

4. User Control

Instagram users can:

• Revoke NextCRM's access directly in Instagram: instagram.com/accounts/manage_access (Settings → Apps and Websites);
• Request deletion of their data (see "Data Deletion");
• Contact NextCRM directly: info@nextcrm.com.ua.

5. App Review and Compliance

The NextCRM app undergoes regular App Review with Meta for each Instagram API business permission. We comply with:

• Meta Platform Terms;
• Developer Policies;
• Data Use Policy;
• Instagram's Community Standards.

If we suspect a violation by a Customer (spam, fraud, prohibited content) — we immediately block the integration.